Computer and Mobile Based Social Engineering

Computer-Based Social Engineering:

Hoax Letters:  These are fake emails sending warnings about malware, virus and worms causing harm to the computers.
Chain letters: Asking people to forward emails or messages for money.
Spam Messages: These are unwanted irrelevant emails trying to gather information about users.
Instant Chat messengers: Gathering personal information from a single user by chatting with them.
Phishing: Creating a cloned fake website trying to gather sensitive information about users. It can be done by sending a fake email as though coming from an original website and then trying to collect confidential information.
Phishing can also be executed through fake mobile applications.


Mobile based Attacks:

SMS based: Sending a fake SMS saying that the user has won a bounty, urging him/her to register with confidential information or try and collect other important details.
Through Malicious Apps: Applications downloaded from third party sources may be malicious; they can access authentication information and other sensitive details.
Through Email and messengers: Attackers can send spam emails or malicious links through messenger applications. When the victim clicks on it- he may be redirected to a malicious site, or a malware could be downloaded or it may lead to some other malicious activity.

Social engineering on corporate side:

Find an insider: It can be a disgruntled employee who may be the target.
Develop relationship: Develop a friendship with this person and maintain this relationship to the point he trusts you.
Exploit the relationship: Extract the information about the company and other sensitive information exploiting the trust that he placed in you.

Insider Attacks:

An insider attack is very difficult to detect. If a disgruntled employee wants to take revenge; he can install malicious applications to steal/modify information, causing significant damage to the organization or he can be bribed by the competitor to reveal or steal company secrets, intellectual property information, etc.

Countermeasures:

  • Educating the employees about the security policies and frameworks, best practices, etc.
  • Creating awareness among the users and employees about social engineering attacks.
  • Enforcing strict perimeter policy, authentication mechanisms.
  • Coming up with effective security policies.
  • Enforcing proper access privileges.
  • Classifying information and protecting access to them.
  • Using Updated antivirus, anti-phishing tools. 
  • Monitoring and auditing.

Post a Comment

0 Comments