Welcome to Social Engineering!
In our study of Cyber Security, we often focus on technical things like firewalls or encryption. However, hackers know that the easiest way to break into a secure system isn't always through the computer code—it’s through the people using the computers. This is what we call Social Engineering. It is the "art" of manipulating people so they give up confidential information.
Don’t worry if this sounds a bit like spy movie stuff; by the end of these notes, you’ll be able to spot these tricks a mile away!
What is Social Engineering?
Social engineering is a set of techniques used to trick people into revealing sensitive information or giving access to secure systems. Instead of looking for a "bug" in the software, the attacker looks for a "bug" in human nature, such as our tendency to be helpful or our fear of getting in trouble.
The main purpose of social engineering is to bypass technical security measures by targeting the human element. Even the most expensive security system in the world can't help if a human being simply gives the password away!
The Three Key Techniques
The AQA syllabus requires you to know three specific types of social engineering. Let’s break them down:
1. Blagging (Pretexting)
Blagging is the act of creating and using an invented scenario (a pretext) to engage a targeted victim in a way that increases the chance the victim will divulge information or perform actions that they would be unlikely to do in normal circumstances.
Example: An attacker might call you pretending to be from your bank’s security department. They might say, "There is a suspicious transaction on your account for \(£500\). To stop it, I just need to confirm your identity by asking for your secret answer." Because they have created a sense of urgency and a believable story, you might be tempted to tell them.
Key Takeaway: Blagging is all about the "story" or the fake identity the attacker takes on.
2. Phishing
Phishing is a technique of fraudulently obtaining private information, often by sending an email that appears to be from a legitimate business like a bank or a social media website. These messages usually contain a link to a fake website that looks exactly like the real one.
How to spot it:
- Generic greetings: Instead of your name, it says "Dear Customer".
- Urgent language: "Your account will be deleted in \(24\) hours if you don't click here!"
- Suspicious links: The link might look like www.yourbank.com, but if you hover over it, it actually goes to www.hacker-site.net.
- Poor spelling and grammar: Large companies usually have professional editors, so "Click hear too fix ur account" is a huge red flag.
Key Takeaway: Phishing is usually a digital attack (email or SMS) aimed at stealing login details or credit card numbers.
3. Shouldering (Shoulder Surfing)
Shouldering is the simplest form of social engineering. It involves direct observation: literally looking over someone's shoulder while they are using a computer or an ATM.
Example: You are at a cash machine (ATM) entering your \(4\)-digit PIN. A person standing behind you in the queue watches your finger movements to learn your code. They could also do this while you are typing your password into a laptop in a busy coffee shop.
Key Takeaway: Shouldering is a physical attack that happens in the real world, not just over the internet.
How to Protect Against Social Engineering
The best protection against social engineering isn't a piece of software—it's awareness and education. If people know what the threats look like, they are much less likely to fall for them.
Ways to stay safe:
- Be skeptical: If you receive an unexpected email or phone call asking for details, don't trust it immediately. Banks will never ask for your full password or PIN over the phone.
- Verify identities: If someone claims to be from a company, hang up and call the company back using a phone number from their official website.
- Check the URL: Always look at the address bar in your browser to make sure you are on the real website before typing a password.
- Privacy filters: For shouldering, you can use a physical screen filter on your monitor that makes the screen look black to anyone not sitting directly in front of it.
- Shield your PIN: Use your hand to cover the keypad when typing passwords or PINs in public places.
Quick Review: Common Mistakes to Avoid
Don't confuse Phishing and Pharming! While they both involve fake websites, Phishing relies on you clicking a link in a message (Social Engineering), whereas Pharming is a technical attack that redirects you to a fake website even if you type the correct address (covered in the general Cyber Security threats section).
Chapter Summary
Social Engineering: Manipulating people into giving up secrets.
Blagging: Using a fake story or "pretext" to trick someone.
Phishing: Sending fake emails/messages to steal data via fake websites.
Shouldering: Watching someone enter a PIN or password in person.
Main Protection: User education, training, and staying alert.
Note: Social engineering is just one part of Cyber Security. For information on technical threats like viruses and trojans, see the chapter on Malicious Code (Malware).