In the most basic terms, social engineering is a hacking technique which involves the art of manipulating people. It is one of the most important skills that hackers need to have and one of the most dangerous techniques they use to hack into computer systems. Hence, social engineering is all about hacking your target through people. Examples of targets include website, company, an organization or even an ordinary person. The whole idea is to use people associated with that target and use those people to hack into that target.
Norton explains in the article “What is social engineering? Tips to help avoid becoming a victim” that to access a computer network, the typical hacker might look for a software vulnerability. A social engineer, though, could pose as a technical support person to trick an employee into divulging their login credentials. The fraudster is hoping to appeal to the employee’s desire to help a colleague and, perhaps, act first and think later.
Most big companies spend a lot of money on securing their software; hence, they have a team of security personnel and ethical hackers trying to hack into the company and making it as secure as possible. However, their employees are often left uneducated and tech them to secure themselves against social engineering attacks.
Hacking Terminology
In the hacking world, a hacker is an expert on a particular system who wants to learn more about the system (International Cyber Security Institute, ICSI, 2020). Hackers feel that looking at a system’s flaws is the best way to learn more about it.
White Hat Hackers
According to ICSI, white hat hackers, upon finding vulnerabilities in a system, report the vulnerability to the vendor of that system. They are often paid by companies, organizations, government agencies, to hack into their system in order to secure the system from cyber attacks.
Black Hat Hackers
These group of hackers aim to cause some type of harm to the system after gaining access to a particular system. They might steal data, erase files or deface websites. They are sometimes called crackers.
Grey Hat Hackers
These are law abiding citizens who sometimes venture into illegal activities for a wide variety of reasons. They sometimes conduct illegal activities for reasons they feel are ethical like hacking into a system belonging to a corporation that the hacker feels is engaged in unethical activities.
Social Engineering Procedure
1. Information Gathering
This is the fundamental step of social engineering. It allows you to understand your target to know what it is and how it communicate with other entities then come up with an effective attack strategy. Summarily, the information gathering process involves –
- Gathering information about the target
- Discovering associated websites, links and companies
- Discover associated people, names, and other details
- Discovering associated social network accounts
- Displaying all information on a log/graph and build attack strategies
2. Generating Evil Files
Once an attack strategy is ready, the next thing is to move into the technical aspect of the attack. Evil files are the files that allow you to gain access to the target system. This include:
- Backdoors
- Keyloggers
- Password recovery tools
- Credential Harvesters
- Spying tools
- Downloadable and executable payloads
- Download and report payloads, etc
3. Enhancing Evil Files
The next step after having evil files ready is to enhance the evil files and create trojans by converting the evil files to files that the target person will trust and open. This is done by making the files look and function like any files that you want. It can be made to look like an image, an E book, an audio file, etc. In summary, this step involve:
- Bypassing all antivirus programs
- Creating trojans for the target operating system
- Embed evil code into documents
- Create perfect spying tools.
4. Delivery Methods
This is where the created trojan is delivered to the target person based on the information gathered on the target. This may include:
- Smart social engineering techniques
- Fake login pages
- Fake update pages
- Fake update popups
- Mail Spoofing
- Fake website/YouTube traffic, etc.
5. Post Exploitation
This is the last stage of the attack where you determine what you can do with the access that you gained. This include:
- Controlling the hacked computer
- Accessing computer file system to modify or read files
- Spying
- Privilege Escalation
- Accessing camera
- Pivoting, etc.
6. Security
Lastly, after gaining access to the computer, this is the stage where you examine all the loop holes exploited from the social engineering attack and secure the computer from it. This include:
- Securing computer from social engineering attacks
- File Integrity
- Analyzing Files
- Analyzing network connections and running services
- Running files in sandbox, etc.
Finally, I’ll leave you with a statement from Norton, “Social engineering is everywhere, online and offline. Your best defense against these kinds of attacks is to educate yourself so that you’re aware of the risks — and to stay alert.”
Got any question, comment or suggestion. Feel free to leave them in the comment box.