Six ways to spot social engineering
鈥Average reading time: 5 minutes
If you want to break into someone鈥檚 house, it is so much easier if the home owner opens the door and lets you in.
This basic truth is well-known to cyber-attackers. Yes, it鈥檚 possible to hack into IT systems using complex 鈥榖rute force鈥 and 鈥榤an in the middle鈥 techniques. But many bad actors prefer a more direct approach: to simply trick victims into handing over the keys.
This is called social engineering, and it describes a type of cyber-attack in which criminals manipulate company insiders into revealing confidential information.
Sadly, the attacks are frequent. In the summer of 2022, for example, an 18-year-old by posing as an employee and texting a staff member to request a password.
In its , Verizon reported that 82% of breaches involved a human element, including social attacks (along with errors and misuse).
It added that, in 2021, five out of six organizations confirmed that they had experienced an email-based phishing attack that tricked users into a risky action, such as clicking a bad link, downloading malware, providing credentials or
executing a wire transfer.
So how do they do it?
Well, it鈥檚 not complicated. In fact, social engineering deploys techniques that have been used by tricksters and con artists for hundreds of years.
No coding skills needed. Just a bit of psychology and some patience.
But being aware of these tricks can help to arm people against them. So here are eight of the most prevalent techniques鈥
# 1. 鈥淗ey, we鈥檝e met before鈥
It鈥檚 easier to gain someone鈥檚 trust if you think you know them. Hackers are well aware of this. And in a connected world, it is pretty easy for them to find the information they need. They can check LinkedIn for example, and explain that they were at the same industry conference you attended last month. They might even check 鈥榦ut of office鈥 replies from colleagues to gather information they can to write something like鈥︹滺ey John. Since Jane is on vacation till September 10, can I ask you a question?鈥
# 2. 鈥淭here鈥檚 no time to check, I鈥檓 in a hurry鈥
Once a hacker has successfully gained a victim鈥檚 trust, it might be a while before they perform the attack. But when it comes, there could be some kind of time pressure. It could be a text or email that says: 鈥淚've lost my login details and my plane takes off in five minutes. Please help!鈥
# 3. 鈥淚鈥檓 your boss. Do what I say鈥
It鈥檚 easy for hackers to find out the names of senior executives at an organisation. The details are all public. So once hackers successfully enter the company system, they can then pose as the boss and request information from staff. If the 鈥榖oss鈥 makes a demand that bypasses security processes, employees will find it hard to refuse.
# 4. "I really need your help"
Most people are kind and friendly. Regrettably, cyber-attackers abuse this positive aspect of human nature to get what they want. Thus, a hacker that has forged a connection with his or her target will ask a favour such as: "Can you open this file for me? I can鈥檛 access it on my laptop.鈥 The recipient will do as asked, and the attacker will hack into the system.
# 5. 鈥淵ou鈥檝e won!鈥
Everyone loves a freebie, right? It鈥檚 amazing how even high earners will fall for a trick that involves a gift of some kind. But the reward doesn鈥檛 have to be financial. In a work environment, an infected file could even come in the form of an email that reads: "You have a secret crush 鈥 click here to find out who it is."
# 6. 鈥淒on鈥檛 be awkward鈥
It鈥檚 human nature to fall in with the herd. No one (well, almost no one) wants to stand out. Hackers will exploit this. They will send an email saying something like: "You're the only one who hasn鈥檛 answered this questionnaire. Please do it now."
As you can see, social engineers have a range of tricks they can use. They also have time. So if one fails, they will persist until they find a way in.
This is worrying. And it explains why, for all the attention of cybersecurity, attacks such as the one on Uber still succeed.
Still, there are several ways businesses can reduce the threat. It鈥檚 just a question of keeping employees trained and aware of the most common techniques. You can find more information here.
Related contents:
- Cybersecurity in 2022? Remote working and mobile are changing everything
- What to do in a data breach
- The Internet of threats