In the last lecture, we saw how social engineering is the art of convincing people to reveal confidential
information in this lecture.
We are going to see three main types of social engineering that we should be aware of.
So there are three types of social engineering, human based, computer based and mobile risk, starting
with the human based social engineering also called impersonation.
It is the most common technique with the attacker pretends to be someone legitimate or an authorized
person.
Attackers impersonate a legitimate oppressed person, either personally or using a communication medium
such as phone or email impersonation attackers and tricking a target to reveal sensitive information.
Wishing or voice over IP is an impersonation technique or also called electronic fraud, in which the
attacker tricks individuals to reveal personal and financial information using voice technology.
The telephone system are also simply calling the targets.
There are three main types of human based social engineering eavesdropping, shoulder surfing and dumpster
diving.
Eavesdropping is interception of audio video, a written communication.
It can be done using communication channels such as telephone lines, emails or even instant messaging.
Shoulder surfing uses direct observation techniques such as looking over someone's shoulder to get information
such as password pin account numbers, shoulder surfing and also reading from a longer distance with
the aid of vision enhancing devices, binoculars that are equipped with capability of optimizing long
distance information.
Dumpster diving is looking for treasure in someone else's trash.
It involves collection of phone bills, contact information, financial information, operations, related
information and many other computer based social engineering is information which is carried out with
the help of computers.
Pop-Up Windows.
These are windows that suddenly pop up while surfing the Internet and asks for users information to
log in or sign up.
You might have encountered Pop-Up Windows Hoax Letters.
Hoax letters are emails that issue warnings to the user on new viruses, Trojans, worms that may harm
users to steam generators, generators or emails that offer free gifts such as money and software on
the condition that the user has to forward the mail to certain number of persons.
Instant Messenger.
It is getting personal information by chatting with the selected online user to get information such
as Burdette's and Maiden names, spam e-mails, irrelevant, unwanted and unsolicited email to collect
the financial information, Social Security numbers and network information as some types of fraud emails.
Phishing is the practice of sending an illegitimate email, falsely claiming to be a form of legitimate,
said in an attempt to acquire users personal or account information.
Phishing emails, pop redirect user to fake web pages of mimicking trustworthy sales and ask them to
submit the personal information.
In mobile based social engineering.
Information is obtained with the help of mobile apps.
Attackers create malicious apps with attractive features and similar names to that of popular apps and
publish them on major app stores, unaware that users download these apps and get infected by the malware
that sends credentials to the attackers.
This is how mobile based social engineering takes place in first attack that infects the victim.
Speci next attacker uploads a malicious application to an app store.
The victim logged on to his or her bank account malware in the system with a proper misspelling.
The victim download an application onto his cell phone to receive security measures, victim downloads,
the malicious application on his or her phone.
At this point, the attacker can access second authentication factor sent to the victim from the bank
where all your money in the account is hence stolen by the attacker.
Let us discuss countermeasures to other social engineering attacks.
Good policies and procedures are ineffective if they are not taught and reinforced by the employees.
After receiving training, employees should sign a statement acknowledging that they have understood
the policies.
The main objectives of social engineering, different strategies are to create user awareness, robust
internal networks and secure policies, plans and policies.
Therefore, the company should train individuals on security policies to generate awareness about such
attacks, restrict access of outsiders in a tourist area, prepare a proper incident response team,
scrutinize information, implement to effect the Atlantic Ocean, archive critical data, perform regular
risk assessments and verify the background of the employees.
What's next?
We will have a practical on social engineering.