- Let's go over a few
social engineering techniques.
The first one that I want to go over
is phishing and spear phishing.
Which still, some of the most
effective social engineering campaigns
that we see nowadays.
Now, starting with phishing.
Phishing is basically whenever an attacker
sends a piece of email to a user
and basically it presents that user, potentially,
with some information that can be
attractive enough to convince them
to follow a malicious link
or click on an attachment.
And then from there the attacker
can compromise their system.
Now, spear phishing is a similar technique,
but in this case,
the email attempt is actually constructed
in a very specific way and directly targeted
to a specific individual or specific company.
For example, let's take a look
at this spear phishing email
that I have in front of your screen, right?
So this is where an attacker
knows a little bit more about the victim.
And in this case, the victim
is Omar, is myself, right?
And that the attacker is spoofing
an email address from Chris Cleveland,
which is an editor from Pearson.
And that attacker already knows that I am working
on a chapter for a book that I'm writing
and then it impersonates Chris
and basically sends an email saying, "Hey, Omar
I actually found a few errors
in Chapter 8 in your next book."
And of course, you know,
"Please find the edits and the attachment
of this document".
And then is asking me to,
"Kindly confirm and advise."
And of course that email has an attachment
that is called chapter 8
and that has a PDF that probably has
some type of payload that it
probably takes advantage of
either a zero day vulnerability
or some non-vulnerability.
And if I double click on that attachment,
it can actually, you know, execute that payload.
And then, you know, the sky's the limit,
the attacker can do many different things.
Redirect me to malicious sites,
put a back door in my system,
establish a command and control communication,
manipulate the system,
further steal information and so on.
The next concept that I want to cover
is a term called whaling.
And basically whaling
is similar to phishing and spear phishing.
But in this case, the attacker
targets high profile business executives
and key individuals of a corporation.
So if you think about a whale, right, a fish
this is actually the term referring
to the attacker, targeting
a big fish of a corporation.
So a big, high profile, you know,
key individual within their corporation as well.
So a high profile and
key individual of a corporation.
The next concept that I want to cover
is called vishing.
And this social engineering technique is whenever
an attacker basically carries out
the social engineering campaign
over a voice conversation, over the phone, right.
Then the attacker, of course,
persuades the user to reveal private information,
probably financial information or any other details
about a person or a company or, you know,
whatever the attacker is actually after.
Whether it's stealing credit card numbers,
social security numbers, information about
key individuals of their organization and so on.
So that is vishing or voice phishing.
Now there's another social engineering technique
called short message service
or SMS phishing, right?
SMS phishing is basically whenever an attacker
find different ways, other than email,
in this case using SMS, or text messages
to actually send either malware or
malicious links to mobile devices.
One example of SMS phishing
is the typical Bitcoin related SMS scams,
or text messages, that we get all the time, right
or messages, you know, related to
potentially a package that you're waiting from
a specific company that you buy,
you know, many things from like
Amazon and so on, right?
And then, you know, from there
they may present a link that will
redirect you to malicious site
and steal different types of information.
Another way that many pen testers and attackers
have successfully compromised many systems
is by just leaving USB sticks,
sometimes referred to as USB keys or pen drives,
basically leaving them unattended
and placing them in some strategic locations.
And often even personalizing a little bit
of the attack by putting the USB key in a key chain.
And then in the same key chain,
probably putting a couple of,
you know, random keys
like physical keys for a door
and probably even pictures of
like a cat or a dog, or even labeling them
saying, you know, "pictures from my vacation
at the beach", right.
Or "bikini pictures" or "photo shoot".
And then the naive user that
just want to make sure
that he or she, you know, wants to actually
try to find out who the USB key belongs to.
Then it puts that USB key into their PC.
And then from there,
the attacker can potentially, you know,
execute some code, you know, some type of payload
and then compromise their system.
Another social engineering attack type
is the watering hole attack.
And basically this is a targeted attack
but basically takes place whenever the attacker
profiles the websites, and
these are legitimate websites that the
intended victim typically access, right.
Then, the attacker can
potentially scan those websites
for potential vulnerabilities.
And if the attacker locates
some type of vulnerability
like a cross site request forgery,
cross site scripting,
and probably inject some malicious JavaScript
or any other similar, you know, code injection
that is designed to redirect the user
to a malicious site and of course, you know,
that way the attacker can then
do many different things.
Steal cookies, or session IDs
from the user's browser.
It can, you know, of course manipulate the user
to reveal additional information,
install malware and, you know,
many different other ways that the attacker can
potentially compromise data or
the victim's system, as well.
Now, another thing to highlight is that
all these attacks can be done
by an external attacker.
That means, an attacker that is external
to your organization but
they can also be carried out by insiders.
And the insider threat is extremely
relevant nowadays, a lot of attacks starts
from the inside and in the next lesson,
we'll take a look at
a few pointers related to that insider threat.