{"id":7330,"date":"2021-05-19T12:05:33","date_gmt":"2021-05-19T12:05:33","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7330"},"modified":"2021-05-19T12:05:35","modified_gmt":"2021-05-19T12:05:35","slug":"6-social-engineering-tactics-in-action-in-2021","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/6-social-engineering-tactics-in-action-in-2021\/","title":{"rendered":"6 social engineering tactics in action in 2021 and what to do about them"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7330\" class=\"elementor elementor-7330\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">It\u2019s long been acknowledged that human beings are the weakest link in any organisation\u2019s cybersecurity.&nbsp;<\/span><span style=\"word-spacing: normal;\">Education and training campaigns by employers, government agencies, and other professionals have raised awareness of <\/span><a href=\"https:\/\/blog.bitsrc.io\/common-social-engineering-attack-strategies-c39042fb4ece\" target=\"_blank\" rel=\"noopener\" style=\"word-spacing: normal;\">social engineering tactics<\/a><span style=\"word-spacing: normal;\">, and regularly remind users to be alert, but as with any form of cyber attack, the methods used by cyber criminals to lure their victims in are also evolving, using the latest technologies to fool people into giving up money, data, or access.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">What is social engineering?<\/span><\/h2>\n<p><a href=\"https:\/\/en.wikipedia.org\/wiki\/Social_engineering_(security)\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Social engineering<\/span><\/a><span style=\"font-weight: 400;\"> are scams that manipulate people into revealing sensitive information to cyber criminals, or providing them with access to a system or network, to use in a cyber attack.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Social engineering scams are built on using the way the people think and act. They often use familiar technologies and combine them with emotions, to manipulate people into acting without thinking.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Social engineering tactics may also exploit people\u2019s lack of knowledge about the value of their information, or the amount of information needed to provide a service.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">One of the most prolific social engineering tactics is phishing (see below), but attackers are constantly updating their methods. Below is a list of some of the tactics on the rise in 2021.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Tactic 1: Phishing emails<\/span><\/h2>\n<p><a href=\"https:\/\/outofsite.biz\/cynance\/10-cyber-security-mistakes-to-avoid\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Phishing<\/span><\/a><span style=\"font-weight: 400;\"> is one of the most prolific social engineering tactics, accounting for up to 70% of all cyber attacks. It has been around a long time, and continues to be used simply because it is cheap to carry out, and still relatively successful, especially <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/the-council-tax-refund-scam\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">during the early days of the Covid-19 pandemic<\/span><\/a><span style=\"font-weight: 400;\"> when people were concerned about money and confused about what was going on around them.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Phishing emails are emails sent by scammers who want to trick you into pressing a button, downloading a file, or clicking on a link that will enable them to download malware onto your device. The emails will often use official branding and wording to confuse victims, and often play on their emotions with lines such as \u201cdon\u2019t miss out\u201d, \u201cact now\u201d, and more.<\/span><\/p>\n<p><b>What can you do about phishing emails?<\/b><\/p>\n<p><span style=\"font-weight: 400;\">While phishing emails are getting more sophisticated, there are still often many tell-tale signs that the email is a scam.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">When you receive a suspicious looking email, look for poor spelling or grammar, content errors that don\u2019t quite add up, excessive requests for information, nonsensical sender email addresses made up of a string of numbers and letters, hidden domain names, and shortened links.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In addition, never share sensitive information over email to someone you don\u2019t know.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Tactic 2: Smishing<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Smishing can be defined as phishing via SMS or text message. These scam messages are designed to entice users into giving up personal information, or downloading a piece of malicious software to their phone via a link or document sent in the message.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">While smishing has been around for a while, smishing social engineering tactics are growing as people become accustomed to doing more and more actions on their phone, including using text messages for security verification purposes. In addition, people are just not as aware of smishing social engineering tactics as they are of phishing, so the returns are greater for scammers.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Smishing is also evolving to messaging apps such as WhatsApp. A <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/smishing-text-messages-are-cyber-attacks-on-phones\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">smishing attack earlier this year<\/span><\/a><span style=\"font-weight: 400;\"> spread a worm to Android phones through a link to a fake app sent from user to user in spam text messages.<\/span><\/p>\n<p><b>What can you do about smishing attacks?<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Number one is slow down. People are often quick to tap on links in text messages before they have read the message or thought about what they are doing. Slow down, think about the contents of the message, and try to verify the sender.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Some smishing attacks lead to an app, often outside an official app store. Never download an app from anywhere other than an official app store which will have some security protection.&nbsp;<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Tactic 3: Malicious QR codes<\/span><\/h2>\n<p><a href=\"https:\/\/www.digitalcitizen.life\/simple-questions-what-are-qr-codes-and-why-are-they-useful\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">QR codes<\/span><\/a><span style=\"font-weight: 400;\"> are increasingly being used by businesses for any number of purposes including payments, account authentication, and more. The Covid-19 pandemic also <\/span><a href=\"https:\/\/blog.malwarebytes.com\/scams\/2020\/10\/qr-code-scams-are-making-a-comeback\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">increased the use of QR codes<\/span><\/a><span style=\"font-weight: 400;\"> as businesses looked for touchless technologies, for example in places of paper menus in restaurants, diners can scan a QR code and download the menu to their smartphone.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">As a result, malicious QR codes have become social engineering tactics as scammers send QR codes within phishing emails and smishing texts in place of links to redirect users to their malicious downloads or sites. Malicious QR codes are also used in clickjacking schemes, where QR codes are placed in public places offering more information for visitors, but in reality the QR code leads to a malicious site.<\/span><\/p>\n<p><b>Avoid getting caught out by a malicious QR code:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">As with phishing or smishing, don\u2019t scan a QR code within an email if you don\u2019t know and trust the sender. If you see a physical QR code sticker, check that it is the original QR code, and not a sticker that has been stuck on top. Use a QR scanner that checks or displays the link before it follows it.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Tactic 4: Deepfake videos<\/span><\/h2>\n<p><a href=\"https:\/\/www.creativebloq.com\/features\/deepfake-examples\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Deepfake videos<\/span><\/a><span style=\"font-weight: 400;\"> are faked videos or audio recordings that look and sound totally genuine. The name deepfake comes from the use of deep learning artificial intelligence to create videos that are so realistic most viewers will never notice that it is a fake. One of the most famous examples of a deepfake video is a public service announcement by <\/span><a href=\"https:\/\/www.youtube.com\/watch?v=cQ54GDm1eL0\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Barack Obama<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Deepfake videos are being used in social engineering scams whereby a \u2018trusted figure\u2019 is used to trick people into providing or <\/span><a href=\"https:\/\/builtin.com\/cybersecurity\/deepfake-phishing-attacks\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">transferring money<\/span><\/a><span style=\"font-weight: 400;\"> to malicious actors, including most famously a deepfake audio clip that convinced a company CEO to transfer money to his parent organisation.<\/span><\/p>\n<p><b>What can you do about malicious deepfake videos?<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Cybersecurity training and knowledge is one of the best ways to combat deepfake videos.&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Knowledge of good cybersecurity practices will help you ask the relevant questions to assess the situation. For example: Does what you are hearing and seeing make sense? Is it the usual way things work, or does it look unusual? Can you verify the instructions with another source before following them?<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Tactic 5: Browser push notifications<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Another oldie but a goodie, browser push notifications or popups asking for approval before performing an action have been around for a long, long time.&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">However they are still being used as social engineering tactics by scammers because they are effective when people skip reading the notification and simply click yes to get to their destination. Once the user clicks the approve button, the notification will divert them to their malicious site, spam them with phishing emails, or download malware through the link.<\/span><\/p>\n<p><b>What can you do about browser push notifications?<\/b><\/p>\n<p><span style=\"font-weight: 400;\">This is one form of social engineering that can be avoided through a technical solution. Effective, up to date <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">network security<\/span><\/a><span style=\"font-weight: 400;\"> including an antivirus package and browser protection should be able to block many of the push notifications in the first place, or block the malicious site or download if a user does click yes.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In addition training to remind users to slow down and check what the push notification is asking for will also reduce the success of these scams.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Tactic 6: Targeted professional user forums<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">A <\/span><a href=\"https:\/\/blog.google\/threat-analysis-group\/new-campaign-targeting-security-researchers\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">new form of social engineering<\/span><\/a><span style=\"font-weight: 400;\"> uncovered by Google is targeting the security research community, potentially with the aim of getting insights from the actual people working on vulnerability research and development at different companies. This targeted form of social engineering uses a fake research blog claiming to have successfully identified several exploits, and multiple Twitter profiles to attract their target audience.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">After establishing initial communications they then ask the researcher to collaborate on vulnerability research. If the researcher agrees, the attackers send malware through a Visual Studio Project and accompanying DLL.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The research blog itself also contains malicious links within articles.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">This targeted form of social engineering is new, but could impact on any group of professionals with any form of target in future.<\/span><\/p>\n<p><b>Avoid getting caught out in a user forum<\/b><\/p>\n<p><span style=\"font-weight: 400;\">The case study from Google demonstrates that even people in the field can be caught out. However once again training and knowledge are your friend.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Never provide professional or company information in an open forum. If you do decide to collaborate with another person, verify their identity before accepting any downloads from them or sending them any personal or corporate information. In the Google example above, the suspects are from North Korea, so a simple phone call could help verify their authenticity.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Social engineering tactics are here to stay<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Wherever there are humans with money, information, or access to provide, there are social engineering tactics. The enduring nature of phishing emails, and the evolution of social engineering using new technologies demonstrates just how profitable these scams are for the scammers.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">While <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">technological solutions<\/span><\/a><span style=\"font-weight: 400;\"> can be used to mitigate against some of these methods, at the end of the day, the greatest tool against social engineering is training and education. Supporting people to recognise the signs and avoid falling into the traps, is the best way to prevent the exposure of networks and organisations to scammers.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>It\u2019s long been acknowledged that human beings are the weakest link in any organisation\u2019s cybersecurity.&nbsp;Education and training campaigns by employers, government agencies, and other professionals have raised awareness of social engineering tactics, and regularly remind users to be alert, but as with any form of cyber attack, the methods used by cyber criminals to lure&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7337,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7330"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7330"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7330\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7337"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7330"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}