In this episode.
We're going to go through social engineering.
Now, you should already have the foundational knowledge of social engineering, whether it's phishing,
spear phishing, phishing, or smishing.
And we're going to go over those at a very high level very quickly throughout this episode.
But Sisa really wants you to understand the idiosyncrasies associated with each type of social engineering
attack, meaning you should expect to see scenario based questions and from those scenarios be able
to identify is this type of social engineering attack a spear phishing or a phishing email?
Maybe it's a phishing call or a smishing text message.
It really kind of defines on how you're going through that.
Don't expect to see some easy questions when it comes into this.
Some of these questions are actually, quite frankly, difficult.
And you need to be able to identify is this a legitimate email or it is a phishing email that really
comes into play with the Sisa, and expect to see examples of those specific emails throughout the exam.
Now they're not going to pound you day for day on 50 different email types, but I would expect to see
at least one question in your exam with a sample email that you need to identify.
Is it a legitimate email?
Is it a phishing email?
Is it a spear phishing email?
Or is it just a regular social engineering attack?
Be prepared for those types of questions.
Social engineering encompasses well, phishing and phishing is just an email indirect attack, meaning
that it's broad in scope.
It's not really directed to an individual or a specific person.
It's more kind of based towards an entire company.
It's going to use things like, hey you or hi, it's going to not call you by name or title.
It's not going to have any defining characteristics that pinpoint to a person.
Specifically, these are phishing emails and very broad in scope.
A spear phishing email, in contrast, is very direct.
It's an email attack that's associated to a specific person and should include titles, your specific
name, usually first and last name, but not always.
It'll understand your title.
They may even pull out some specific information about you, like your child's name or your specific
department and ask for something like normal to start off with, which really doesn't seem that imposing
from malicious actors point of view.
However, most spear phishing emails are in it for the long game and not the short attack, meaning
while it starts off soft, it will eventually turn into a hard kill where they're going to try to kick
you on a lake or provide them with credit card information.
Remember, spear phishing emails are very directed.
They're going to have your name.
They're going to have maybe even your phone number.
They're going to have attributes associated with your position and maybe even your personal family members.
With phishing or voice solicitation, these types of attacks are over the voice line for obvious reasons,
but they can include robocalls.
They can also include direct calls where they understand not only your name and your sensitive information.
Just like a spear phishing email will, they also encompass things that are very broad in scope, like
you might see on a phishing email.
To be honest, they're just phishing or phishing emails and spear phishing emails rolled into a voice
Solicitation, where they're trying to get you to actually talk to them.
They usually encompass something where they're trying to use authority to get you to provide them information,
or they're enacting upon your empathy to get you to provide information because you feel sorry for them,
whatever their route.
It really is a phishing attack used over a voice line.
Now, there's a great example that we provided in the documentation for a YouTube link by Chris Haney,
and he does a great job of showing how phishing could really work in a real world environment.
Phishing can include impersonation, where they provide you a known relationship either through a coworker,
a spouse, or even it.
It's not uncommon with a company that I work for where they would have these malicious actors call somebody
at the company and say, hey, I'm with it.
I'm trying to get your computer updated to the newest whatever, I need your IP address.
And they'd be like, oh, okay, well, how do I get my IP address?
And the malicious actor would literally tell them to type in the CMD command and then ipconfig in order
to give them the IP address to where they can literally tag into it and provide an RDP connection to
it.
They just then have to get the user to click on the okay for remote control their computer, and meanwhile
the employee thinks that they're doing good.
They're helping out it.
The malicious actor is taking over their system.
Social engineering, especially phishing, can be very dangerous as there is very much a call for people
that speak English very well to take advantage of employees.
Most people that are expecting a phishing call expect robo calls, or they expect somebody with an accent
that doesn't really sound United States or English in perspective.
When they're confronted with somebody that speaks English very well and is easy to talk to.
These phishing attacks become very dreadful for the organization.
There's something called baiting, and while we haven't really covered baiting in the past, uh, baiting
is a feature where we're providing a free device in public.
Usually this means I go out to a parking lot or an employee break room, and I just throw USBs on the
ground for a break room.
We once did a physical device where we would took a box of USB drives.
We left them in the break room, and then we put a little sign that says free one terabyte or I'm sorry,
26 gigabyte, uh, USB drives.
Take one.
You'd be surprised how many people pick those up at the break room because they thought they were.
Hey, they're in the break room.
What harm could come into play?
It's important for banning that.
You as a cybersecurity analyst not only know what it is, but you train your employees properly on the
fact that we don't take free devices.
This is the reason that we normally shut off USB ports on our computers inside of our offices and organizations.
But banning is literally giving something for free, hoping that somebody will pick it up with a normal
USB drive, there's nothing to be concerned, but with a faulty or malicious USB drive, malicious actors
can put programming code on there.
That happens behind the scenes that people will never see.
Uh, baiting is very dangerous attack that we should be fully aware of.
Then there's something called pretexting.
This is a fabricated scenario.
In order to obtain information, this scenario could be in a numerous different ways.
You can also use Pretexting in combination with other factors of social engineering.
For instance, I can pretend to be the IT department, which we just talked about, and give a fabricated
scenario of I need to update your windows system that combines phishing with pretexting.
You could also do that with phishing or even spear phishing, where we're providing a fabricated scenario
of, hey, I'm with the HR department and I need to verify that your home information is X, Y, and
Z.
That information is probably made up.
And if we can spoof that HR email address, we can get the potential victim to provide us not only with
their home address, their telephone number, but sometimes even the last four of those Social Security
numbers.
Now, I want you to think about that from a malicious point of view.
If I can get you to give me your home address, your telephone number, your first, last and middle
name, as well as the last four digits of your Social Security number, I can pretty much open a credit
card in your name, or find your banking institution and get them to open up the account.
To me, this provides some serious problems within a personal perspective, but also from an organizational
perspective of how many times have you called it and they asked for a specific Related information to
you to reset your password so you can see from that perspective, Pre-texting plays a valuable role
inside of cybersecurity from a social engineering perspective.
Finally, I wanted to talk about reciprocated links.
These are obscured links where we don't provide the full link.
As an attacker, we provide a short link.
You've probably seen these in bit.ly codes or a short URL identifier that says something like click
here.
Most people or most random users will just scroll over it and click the link, having no idea where
it goes to.
For instance, I could create a Amazon page that says you've just won a $100 Amazon gift card.
Click here now, and it's just a box that says click here.
We get the user to click on the link, and they go to a off site website for Amazon that looks perfectly
legitimate, but instead of Amazon.com, it's Arizona, or to Inscom or an O.
You get the point, right?
So those different links provide a segment or an attack vector for an the user.
To short come the specific Vulnerabilities of a potentially wary subscriber, meaning I'm going to try
and get that wary subscriber to click on something they shouldn't.
We can do URL encoders like Bitly.
We can do subdomain spoofing, where I spoof the subdomain so it doesn't really look like it.
I can do a homograph attack where I'm moving the information away from its primary information, and
it goes somewhere else.
And I could do a script redirect track where we're redirecting traffic from website over to another.
I can use those different attack vectors to hide a link within a box, or even another subset of text,
just because it says HTTP and it provides that link doesn't mean that I can't make those letters or
that link go to a completely different website.
These are all part of that attack methodology or that attack vector attack, where I'm fooling the user
into doing something they normally wouldn't do.
Uh, offering $100 to a low minimum wage worker isn't out of the question, and I never actually have
to provide them the gift card.
They'll still click on the link.
Now, we talked about social engineering in this episode.
We talked about obscured links.
We talked about the basic foundations of the different social engineering attack vectors that you should
already be aware of, and we refresh your memory on those different attacks.
Remember, for Cisa, you should expect questions that are scenario based that lead you towards a specific
attack vector.
It's not uncommon to see one of your answers.
Being social engineering, and social engineering could be the proper answer in those exams if the right
example isn't there.
For instance, if you see an attack methodology for spear phishing.
But spear phishing isn't an answer, don't be afraid to click on that social engineering attack, because
fishing, phishing, and smishing don't make sense and would still fall under that social engineering
attack.
Answer.
And CompTIA is notorious for pulling those types of stunts within their exams.
Remember, as a systems analyst, you need to not only know the concepts of social engineering, but
how they're implemented within an attack vector or an attack methodology on a whole nother level.
It's not enough just to be able to identify it from the different scenarios or the theoretical concept.
You need to be able to look at the email and identify, is this a spear phishing email attack and why?