What is Social en­gin­eer­ing?

Any computer spe­cial­ist will agree that security is top priority at all levels of the OSI model. But often the biggest threat doesn’t come from within the network, but instead from the fic­ti­tious layer 8: 40 cm in front of the screen, where human users interact with tech­no­logy. Cyber criminals have worked out how to ma­nip­u­late typical human character traits and be­ha­vi­our­al patterns like help­ful­ness, trust, respect, pride, gratitude, aversion to conflict, or fear, in order to gain illegal access to IT systems – a method known as social en­gin­eer­ing that threatens billions of people every year. For companies, it’s essential to train employees ac­cord­ingly, and to provide clear guidelines for dealing with con­fid­en­tial in­form­a­tion.

You can have the most secure password in the world, but it counts for nothing if it’s given out freely to strangers. Social en­gin­eer­ing consists of a range of psy­cho­lo­gic­al tricks used in a form of in­dus­tri­al espionage to obtain important security in­form­a­tion from employees. Attackers use this in­form­a­tion to then in­filt­rate a company’s IT system and gain access to protected data. This is known as social hacking, the complete process of using social en­gin­eer­ing suc­cess­fully. In addition, social en­gin­eer­ing is used to coax employees into taking careless action. This could be by tricking them into in­stalling unknown programs or carrying out ques­tion­able financial trans­ac­tions. Direct contact between the per­pet­rat­or and the victim isn’t a pre­requis­ite either. E-mail phishing is an indirect form of social en­gin­eer­ing too. Another tra­di­tion­al technique is a call from an alleged system ad­min­is­trat­or re­quest­ing a user password for troubleshoot­ing purposes.

While the idea of social en­gin­eer­ing might sound banal at first, it’s actually been proven to be one of the most effective methods of in­filt­ra­tion. The reason for this is because there are certain positive and negative character traits that exist in almost everyone. So, in the majority of cultures, it’s con­sidered socially desirable to come across as nice, con­sid­er­ate, and helpful. Many people find it difficult to refuse a request in what they believe to be an emergency situation. Others will always try to cooperate out of fear of reacting in­cor­rectly in unknown situ­ations.

But it’s not always the good qualities of human behaviour that are the focus of ma­nip­u­la­tion ex­per­i­ments. Pride in your own work or the success of the company can also lead everyone from employees to CEOs to brag and reveal sensitive in­form­a­tion – for example in a staged interview, to customers, or when meeting new job ap­plic­ants. It’s also often the case that a tendency to avoid conflict can lead people to go against critical safety reg­u­la­tions. But the strongest motive for all ir­ra­tion­al actions is fear. An example of how fear could be used in this case could be through a fake supplier threat­en­ing to cut off the internet for the afternoon unless he’s provided with in­form­a­tion about the router and its con­fig­ur­a­tion. If a caller uses lots of relevant, specific ter­min­o­logy and a sense of urgency and threat, it can put a lot of pressure on employees, par­tic­u­larly ones with a low technical un­der­stand­ing. Social hackers also take advantage of employees’ fears of their superiors: a popular technique is to send fic­ti­tious payment in­struc­tions by e-mail, pre­tend­ing to be a boss.

When trying to make their victims feel com­fort­able, hackers usually pose as col­leagues, bosses, or ap­plic­ants. But if they’re trying to take an external approach, fraud­sters will sometimes pose as associate service providers, carrying out customer sat­is­fac­tion surveys or research for an institute, in­ter­ested potential partners, or even dis­gruntled or confused customers.

Social engineers don’t always restrict them­selves to one-time in­ter­ac­tions either. And some take the approach of chatting away with small talk to make the employee feel at ease, or ask certain routine queries first to make the approach more be­liev­able. These tech­niques usually work by creating a level of trust and un­der­stand­ing between employee and hacker, with the hacker offering up plausible questions and fitting in­form­a­tion about himself/herself to the point where the victim is sub­con­sciously convinced the hacker can be trusted. Remember: These attacks are usually me­tic­u­lously planned and re­searched. Some popular sources of in­form­a­tion for this back­ground research include the company website and social networks like Facebook or LinkedIn. And in extreme cases, hackers have been known to go one step further and carry out ‘dumpster diving’, meaning they rummage through a company’s trash looking for any business documents that have been thrown out.

Despite tech­niques like dumpster diving for research purposes, most social en­gin­eer­ing attacks are carried out by e-mail or over the phone, because these methods require less technical effort and more anonymity. But this doesn’t mean that these are the only dangers for your company. Revealing business secrets, passwords, or other access tips in public places like bars, cafes, or res­taur­ants can put your company at risk, even if it’s during a relaxed at­mo­sphere with other col­leagues about seemingly innocuous things like figures, work processes, or customer contacts. Employees regularly receive business calls on their private mobiles and often feel open and com­fort­able dis­cuss­ing business-related matters in public with no regard for who might be listening.

A software-based variant of social en­gin­eer­ing based on special malware programs that scare users into per­form­ing certain actions. This is known as ‘scareware’. Programs like this usually work as follows: the software makes a sudden and alarming threat that appears on the user’s screen, while offering a simple solution, just as your operating system would. The threat is fake, and the solution actually winds up giving important security in­form­a­tion to the attacker. Scareware usually dominates the centre of the computer screen when it appears too, to take advantage of our tendency to simply click ‘continue’ or ‘ok’ when messages pop up on screen. They usually take the ap­pear­ance of common brand names and logos that we recognise too, to try and trick you into in­stalling damaging software that can access your personal in­form­a­tion.

As an example, scareware could disguise itself as a free antivirus program, designed to inform the user upon in­stall­a­tion about a range of fic­ti­tious computer viruses and to protect the computer via a full version that can be down­loaded for a nominal fee. If the user enters payment details, the warnings are simply turned off.

Scareware doesn’t even have to in­filt­rate your computer operating system. In some cases, you can be tricked by a pop up or another form of animation on a website that warns you you’ve fallen victim to hacking and suggests a solution. The ‘defense’ being offered here usually is the actual attack – often fa­cil­it­ated by making you download damaging software in a Trojan horse technique. A variation of this attack pattern is to display the fake error message as a browser warning rather than a web page no­ti­fic­a­tion. This can be more suc­cess­ful because users tend to trust their browsers more than web pages.

When it comes to pro­tect­ing your own company from social en­gin­eer­ing, the most important thing is to make your employees fully aware that they have access to con­fid­en­tial in­form­a­tion. Training is an effective way to build awareness of the topic of economic espionage, as this gives you a chance to explain common attack patterns like the ones mentioned above and their con­sequences for staff and the business. It’s also sensible to create a set of strict rules regarding the handling of sensitive company data to add to your existing code of conduct in the workplace. Every employee should be com­pletely clear on which in­form­a­tion is con­sidered secret, where sensitive data can be used, and how it should be properly stored.

Standard pro­ced­ures for ad­min­is­trat­ive activ­it­ies can also be used to offer employees pro­tec­tion and guidance on how to behave in critical situ­ations. For example, if every office worker knows that it’s strictly forbidden to give out any personal passwords from the company’s IT network over e-mail or telephone, even if being asked by a manager or colleague, then it will become harder for hackers to obtain this in­form­a­tion.

Since social en­gin­eer­ing relies on human error, it’s difficult to entirely eradicate the dangers of it through pre­vent­at­ive measures. There’s always a pos­sib­il­ity that hackers will manage to work their magic, but you can make it more difficult for hackers to access your sensitive in­form­a­tion if you make sure to consider the following points:

• Keep a healthy suspicion of strangers in business: the bigger a company is, the easier it is for criminals to pass them­selves off as col­leagues, service providers, or other business as­so­ci­ates. Pro­tect­ing yourself from this danger can to an extent be done by simply keeping a healthy suspicion of people you don’t recognise. Sensitive data should only be offered to col­leagues whose identity can be confirmed. By making a point of getting to know every new employee and having regular team events, you can help build your knowledge of coworkers and employees, to make sure you’re never caught out.

• Don’t offer private details over the phone: as a rule, sensitive in­form­a­tion should never be given out over the telephone. This is es­pe­cially true for incoming calls and with unknown com­mu­nic­a­tion partners. Even seemingly un­im­port­ant or in­cid­ent­al in­form­a­tion can be used by hackers who are col­lect­ing in­form­a­tion about your company’s operation so as to trick an employee further down the line.

• Be wary of e-mails with unknown sender addresses: if the sender of an e-mail can’t be easily iden­ti­fied beyond all doubt, approach with caution. All employees should report the e-mail to a manager or a member of the IT de­part­ment before sending any response. If the message contains an unusual or un­ex­pec­ted call to action, for example a request for an out­stand­ing payment, it’s very important to check the au­then­ti­city of this claim before pro­ceed­ing with the request.

• Be on the lookout for strange links or e-mail at­tach­ments: time and again, internet users find e-mails in their inbox con­tain­ing links to forms or web pages asking for data. Hackers use tech­niques like this to get hold of banking in­form­a­tion, passwords, or customer numbers. But in the business world, practices like these are com­pletely un­ne­ces­sary. Serious banks, online shops, or insurance companies would never ask you to open a separate web page and enter sensitive in­form­a­tion. Be aware of file at­tach­ments in e-mails too. These could contain spyware or malware which starts in­stalling in the back­ground and gives hackers external access to your system. You can minimise this risk by making sure that employees only ever open at­tach­ments from trusted senders.

• Ensure data pro­tec­tion on social networks: a lot of pre­par­a­tion and work goes into most social en­gin­eer­ing attacks long before the actual hack takes place. Along with in­form­a­tion on the company website, fraud­sters often use the data made readily available on social networks in order to create a be­liev­able backstory for a ma­nip­u­la­tion attempt. In general, the rules is as follows: the more in­form­a­tion about them­selves that employees or coworkers offer on social media, the more vul­ner­able they are to the dangers of social en­gin­eer­ing. By making your employees aware of this fact, you can increase the chances of them using private settings on sites like Facebook, Instagram, or Twitter. There’s also the option of setting mandatory re­stric­tions in your office’s code of conduct, though taking away employee freedoms isn’t always re­com­men­ded.

The com­plex­ity of the topic and the diversity of ap­proaches taken by hackers makes it im­possible to prepare staff for all types of social en­gin­eer­ing attacks. But through regular training exercises and edu­ca­tion­al seminars on the im­port­ance of data pro­tec­tion, you can raise awareness of the potential danger posed by cyber hackers. However, pre­vent­at­ive measures should never go too far. If they start to harm team spirit, create an at­mo­sphere of general mistrust in col­leagues, or create fear of mistakes, then they’re more trouble than they’re worth.