Let’s define the term “Social Engineering”. Simply put, it is the art of manipulating people into doing something, like divulging confidential information or performing actions that would expose information, and making them feel good about doing it, i.e they “solved” a problem or helped someone, etc. This allows the hacker to obtain information in a non-threatening manner. Let us now explore some examples how easy it is for a hacker to utilize social engineering to obtain confidential or sensitive information.
There are several examples where social engineering can be used for personal gain, other than divulging information. One very common example that is employed by many people on a frequent basis: paying a compliment to the hostess at a fine restaurant thinking you may be seated at a nicer table or seated faster or doing the same to your waiter or waitress to get faster service.
All too often in today’s society, social engineering is being used for dubious reasons, so a hacker can obtain sensitive personal and/or company information. This has now become a real threat to the security of your employees, confidential client information and company records and/or banking information.
A Few Social Engineering Tricks And Scams:
The IT Support Person Scam:
The social engineer gains access to your computer systems by calling as an IT support person. Generally, this is easier to do when there is a lot of buzz about a virus or malware in the media. It can, however, happen at any time. The person posing as IT support (the imposter) calls a user and attempts to lead them through some sort of fix for the malware. The imposter continues to stress how important fixing this is and causes the end-user to become frustrated. Once the user becomes frustrated, the imposter says something along the lines of “Let’s save us both time. Why don’t you give me your password, I’ll deal with the problem and call you back”.
A variant of this scam, with some additional twists, has been used to take significant amounts of money (six figures in this case) from a law firm's bank accounts. Law Firm's Trust Account Hacked! Six Figures Taken!!!
Jury Duty or Subpoena Scam:
The phone rings in the early evening. The caller states the person answering the phone has failed to report for jury duty, or appear as required by a subpoena. This usually takes the answerer by surprise. The caller then asks for the answerer’s full name, social security number, and date of birth, so they may “verify” they are the person who failed to appear. The unsuspecting readily supplies this information and ends up becoming the victim of identity theft.
The Foreign Traveler Scam:
This generally happens when a hacker gains access to an email account or a Facebook account. The hacker then uses the account to send a bogus email or Facebook posts to the real account owner's contacts. The post reads something like this:
Body: "I feel terrible disturbing you with this but I don't have any other option. I had to travel to Alaska for something urgent but now I am in a tight situation here. Please I need your help with a loan of $1800 to sort myself out. I will refund you immediately when I return this weekend. If you can help with this let me know so I can tell you how to get it to me."
Click this to send funds.
Thanks, Becky
Of course, Becky’s close friends would hate to see Becky stuck in a foreign country so they will click a link and follow the instructions to send money to “Becky”. The bank will look like a legitimate bank website (Chase or Bank of America) fooling even the most observant individuals. It will ask Becky’s saviors to send funds to her via a bank account set up in her name in that foreign country.
Disaster Relief Scam:
This scam usually happens right after a disaster such as a hurricane or has happened most recently the bombing at the Boston Marathon. Fake donation sites appear on the internet by the hundreds or even thousands. The purpose of these sites is to use the emotional appeal of helping victims to capture credit card or bank account information from those who are well meaning, and would like to help. We definitely encourage those who wish to help in these situations, BUT, check out the website and the foundation set up before you donate.
Free Gift cards or Airline Tickets:
This type of threat happens often via email on Facebook, Tumblr, and Pinterest. The user is prompted with an “ad” that indicates that the user will receive a free gift card or software upgrade or perhaps even some of Bill Gates fortune, for filling in a survey. Stay away!!! These companies are not really giving away anything. They are merely collecting information from the unsuspecting that can be used to steal an Identity.
Unauthorized Access to Your Building or Offices:
Typically someone will be hanging out in a smoking area and chatting it up with fellow smokers who have access to a secure building or office. When the real employees go to enter the facility, the imposter merely follows them using a technique called “tailgating”. If the employees ask the imposter for their ID, access card, or badge, the imposter will simply tell the employees they left their access card in their office. “Cigarettes, a Social Engineer’s best friend”.
Another way of gaining unauthorized access to your building or offices is for the “imposter” to have lots of packages or simply say “I’m in a hurry, please let me in”.
Social Engineering is here to stay. If it sounds too good to be true or employees feel something just doesn’t feel right, they should trust their gut instinct. Odds are unless you are vigilant, you will not know you are a victim until it is too late. It is very important to have a stated IT policy in place, as well as a safety policy, and to have your employees familiar with both of them. The more aware they can be the less likely you, your employees, or your company will become the victim or an unwilling hacker.
