Social Engineering

Social
Engineering
Cum ne protejam?
Ce este Social Engineering?
Arta de a manipula oamenii astfel încât să renunțe la
informații confidențiale sau să încalce practicile standard
de securitate.
What Info is Confidential?
Despre Social Engineering
 Toați suntem o țintă potențială!
 Este adesea mai ușor pentru infractorii
cibernetici să manipuleze un om decât o
rețea sau un sistem de calculatoare.
 Atacurile pot fi relativ low-tech, low-cost și
ușor de executat.
 Tehnologia se accelerează rapid odată cu
sofisticarea atacurilor.
Social Engineering Attack
Pregatirea unui atac Stabilirea unei relații
- Identificați victima (victimele) - Angajați ținta

- Adunați informații de fundal - Învârte o poveste
- Preia controlul asupra interacțiunii
- Selectați metodele de atac
Obtain Information Close the Interaction

- Expand the foothold  Remove any traces of malware
 Bring the attack to a natural end
- Execute the attack
- Disrupt business and/or steal data
Common Social Engineering Attacks
Phishing/Spear
Pretexting Vishing
Phishing
Smishing Baiting Scareware
Dumpster Shoulder
Ransomware
Diving Surfing
Pretexting
What is Pretexting?
Pretexting Techniques & Goals
How is Pretexting Done?
• Attackers impersonate co-workers, police officers, bankers, tax

authorities, or charitable organizations.
• An attacker builds a credible story (pretext) that leaves little
room for doubt on the part of their target.
• A false sense of trust is developed with the target.
• A pretexter may ask a series of questions designed to gather
personally identifiable information.
Why is it Done?
• Obtain Sensitive Information – Social security number, mothers

maiden name, place or date of birth or account numbers.
Phishing
Phishing
Common Signs of Phishing
Too Good To Be True
• Eye-catching or attention-grabbing offers designed to attract people’s
attention immediately. For instance, a claim that you have won an iPhone,
a lottery, or some other prize.
Sense of Urgency
• Act fast because the super deals are only for a limited time.
• Your account will be suspended unless you update your personal details
immediately.
Hyperlinks
• Click here to claim your offer.
• Click here to change your login credentials.
Attachments
• Often contain ransomware, malware or other viruses.
Phishing Email
Phishing Email
Other Forms of Phishing
Spear Phishing
• Similar to phishing, spear phishing is an email or electronic

communications scam targeted towards a specific
individual, organization or business.
Vishing (Voice Phishing)
• An attacker calls their target and uses an automated

recording designed to generate fear. The recording will ask
the target to call a number to resolve the issue.
Smishing (SMS Phishing)
• An attacker tries to trick you into giving them your private

information by sending you a text message.
Hangphish
Class Activity 1
Baiting
Baiting
What is Baiting?
Involves offering
something physically
or digitally enticing to
a target in exchange
for login information
or private data.
Baiting Techniques
Free Media Download
• Attackers publish download links on the web, mostly
containing malicious software, offering free music, movie, or
video games if the target surrenders their login credentials to a
certain site.
Unusually Low-Priced Product
• Attackers advertise extremely low priced products in an
online store they created hoping individuals will attempt to
purchase the product and give up their credit or debit card
details.
Compromised USB Drive
• Infected USB drive used to inject malware, redirect you to
phishing websites, or give a hacker access to your computer.
Scareware?
Ce este Scareware?
Malicious computer
programs designed to trick
a user into buying and
downloading unnecessary
and potentially dangerous
software, such as fake
antivirus protection.
How Does Scareware Work?
Commonly generates pop-ups
that imitate Windows system An offer to obtain downloadable
messages often pretending to be software to fix the problem is
antivirus software. The message made or the user is advised to call
usually states that infected files a telephone number displayed in
have been found on the users the message for technical support.
computer.
The user obtains/downloads the

The users money is lost if
software which is effectively
payment was made, and their
useless or allows the attacker that
computer will most likely become
the user called to connect to their
unstable due to the newly installed
computer remotely to install
malware.
malware.
What is Ransomware?
Malicious software
(malware) that prevents
users from accessing their
system or personal files
and demands a ransom
payment from the user in
order to regain access.
Ransomware - WannaCry
Scramble Engineering
Class
Activit
y2
Dumpster Diving
An attacker digs through

trash looking for personal
or confidential
information that can be
used to carry out an
attack on a person or
business.
Shoulder Surfing
Shoulder surfing involves

looking over a person's
shoulder to gather personal
information while the victim is
unaware. This is especially
effective in crowded places
where a person uses a
computer, smartphone or ATM.
Defend Against Pretexting!
Dumneavoastra ați încălcat Codul Contravențional al Republicii

Moldova. Ați accesat conținut sexual ilegal, veți fi amendat cu 400
de lei. Pentru a nu expedia cazul dumneavoastră în Instanta de
Judecata puteți sa achitați online amenda de 400 de lei pe adresa de
următoare.
Defend Against Phishing!
How to Avoid Phishing Scams

• Do not respond to communication you are unfamiliar with.
• Do not call any phone numbers listed in an email, text
message, or instant message.
• Do not click on any links in an email message and do not
open any attachments contained in a suspicious email.
• Do not enter personal information in any pop-up screens.
Legitimate organizations don’t ask for personal
information using pop-up screens. Instead, contact the
supposed organization and verify.
• If in doubt, delete the email or message.
Defend Against Baiting!
How to Avoid Baiting Scams
• Think twice before clicking unfamiliar hyperlinks while
surfing the web.
• Use reputable retailers when shopping for products or
services.
• Do not click on any hyperlinks that offer free music,
movie, or video game downloads.
• Avoid any hyperlinks your search engine returns that are
classified as ads.
• Do not insert any USB drives into your computer that you
find laying around. Turn it into your organizations security
team.
Defend Against Scareware!
How to Avoid Scareware Scams

• Always use up-to-date web browsers to ensure the
latest security updates are applied.
• Turn on pop-up blockers.
• If you get a pop-up, completely shut down the browser.
Use Ctrl-Alt-Delete to close the browser if your are
unable to close it normally.
• Do not click any links in a pop-up if you do get one.
• Always keep your antivirus program updated.
• Don’t give up personal information requested by a pop-
up.
Cybersecurity Facts and Stats
 Cyberattacks are the fastest growing crime
globally.
 There is a hacker attack every 39 seconds.
 Total cost of cybercrime globally has added up to
over $1 trillion in 2018.
 Approximately $6 trillion is expected to be spent
globally on cybersecurity by 2021.
 95% of cybersecurity breaches are due to
human error.
UNM - Information Assurance
Areas of Study Offered

• Cybersecurity and Information Assurance
• Data Analytics (Big Data)
• Database Management and Warehousing
• Fraud, White Collar Crime and Digital & Financial
Forensics
• Information Systems Acquisition, Development
and Management
• System & Network Administration and Security
Visit https://ia.mgt.unm.edu/ for more information
Crossword Engineering
Class Exercise 3
References
13 Alarming Cyber Security Facts and Stats. Cybint Cyber Solutions. 3 Dec. 2018.
https://www.cybintsolutions.com/cyber-security-facts-stats/
Social Engineering. Imperva Incapsula. 2 Mar. 2019.

https://www.incapsula.com/web-application-security/social-engineering-attack.html
Three Scary Social Engineering Facts. Proofpoint. 31 Oct. 2016.

https://www.wombatsecurity.com/blog/three-scary-social-engineering-facts

Social Engineering

Uploaded by

Copyright:

Available Formats

Social Engineering

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Social Engineering

Uploaded by

Copyright:

Available Formats

What is social engineering?

What is social engineering?

What are some common social engineering attacks?

What are some common social engineering attacks?

Social

- Identificați victima (victimele) - Angajați ținta

Obtain Information Close the Interaction

Smishing Baiting Scareware

How is Pretexting Done?

• Attackers impersonate co-workers, police officers, bankers, tax

• Obtain Sensitive Information – Social security number, mothers

• Similar to phishing, spear phishing is an email or electronic

Vishing (Voice Phishing)

• An attacker calls their target and uses an automated

Smishing (SMS Phishing)

• An attacker tries to trick you into giving them your private

The user obtains/downloads the

An attacker digs through

Shoulder surfing involves

Dumneavoastra ați încălcat Codul Contravențional al Republicii

How to Avoid Phishing Scams

How to Avoid Scareware Scams

Areas of Study Offered

Social Engineering. Imperva Incapsula. 2 Mar. 2019.

Three Scary Social Engineering Facts. Proofpoint. 31 Oct. 2016.

You might also like