Tactics

We are focusing on four main tactics used in Social Engineering: Phishing, Smishing, Vishing and Spoofing.

Phishing

In this tactic, a malicious agent (attacker) sends fraudulent emails claiming to be from a known source, be it a family member, a friend an online store or even your school with the intent of getting your personal information such as name, address, age, gender, login and passwords.

Phishing messages are crafted to make the recipients curious, worried or intrigued, to provoke a fast and not well-considered action, such as clicking on a link or answering the message.

Smishing

Smishing follows the same concepts as Phishing, but it is done solely via text messaging.

Some of the most common smishing attacks involve text messages that:

• Link to a fraudulent site.

• Include attachments containing malware to infect your device.

Vishing

In this case, the attacker is impersonating a trusted source via a phone call. Some examples of vishing are:

• They are impersonating one of your digital services (bank, store, video subscription) and are asking for your login and password to help resolve an incident with your account.

• You have won a prize and to claim it, you need to provide personal information or pay a fee.

• They claim to be from the tax collection agency and try to scare you by using threatening language and potential legal consequences.

• They claim to have detected an issue with your device (computer or phone) and need to install an application to solve it.

Quishing

It is also known as QR phishing and it belongs to the same family as vishing, smishing and phishing, but in this case, the attack is perpetrated via QR codes. When the QR code is scanned by the user the following malicious actions can be triggered:

• The user can be redirected to a fake site that resembles the expected page such as a social network, bank, music platform...

• The device will download malware to enable personal information transfer to the QR creator or monitor the user's activities.

• The process can initiate a process to authorize payments to the attacker's account.

Protect yourself by:

• Don't scan QR codes from non-trusted sources.

• Check before scanning. Make sure that the QR code is not a sticker added to the original ad.

• Use a security software to protect against quishing.

Spoofing

It is a method that allows someone to appear as someone else online. It involves impersonating or fabricating the identity of a person or site. There are different forms of spoofing:

• Website Spoofing. This technique involves creating a website that looks and feels legitimate. It can trick the user by collecting personal information such as passwords, login credentials, credit card information and more.

• Email Spoofing. Same as with website spoofing, but in this case it involves the manipulation of emails to make them seem as coming from a trusted source.

• IP Spoofing

• GPS Spoofing

• Caller ID Spoofing

Examples of spoofed URLs:

• Legitimate URL: www.paypal.com - Spoofed URL: www.p4ypal.com

• Legitimate URL: www.facebook.com - Spoofed URL: www.fac3book.com

• Legitimate URL: www.amazon.com - Spoofed URL: www.amaz0n.com

• Legitimate URL: www.microsoft.com - Spoofed URL: www.micr0soft.com

In the next sections, we will go over some examples to help us identify common elements used to try and trick us into giving our information.

🤿 Optional: Deep Dive - Tactics

Some other tactics are:

• Tailgating: Simplistic social engineering attack used to gain physical access to access to an unauthorized location. Tailgating is achieved by closely following an authorized user into the area without being noticed by the authorized user. An attacker may tailgate another individual by quickly sticking their foot or another object into the door right before the door is completely shut and locked.

• Piggybacking: Similar to tailgating; but in a piggybacking scenario, the authorized user is aware and allows the other individual to "piggyback" off their credentials. An authorized user may feel compelled by kindness to hold a secure door open for a woman holding what appears to be heavy boxes or for a person claiming to be a new employee who has forgotten his access badge.

• Baiting: Places something enticing or curious in front of the victim to lure them into the social engineering trap. A baiting scheme could offer a free music download or gift card in an attempt to trick the user into providing credentials.

• Pretexting: The attacker invents a fabricated scenario or pretext to gain a person's trust. They may impersonate a co-worker, customer, or service provider to extract information.

• Quid Pro Quo: Attackers offer a service, like tech support or software, in exchange for login credentials or personal information. They promise help but actually steal data.

• Impersonation: Attackers pretend to be someone else, such as a co-worker, boss, or trusted service provider, to manipulate individuals into taking certain actions.

• Reverse Social Engineering: In this tactic, the attacker convinces the target that they need help or that the target is providing assistance to the attacker, often leading to information disclosure or other concessions.

• Authority and Fear: Attackers pose as figures of authority, like police officers, and use fear tactics to create a sense of urgency, convincing people to comply with their demands.

• Appeal to Trust and Sympathy: Attackers may create a sad story or crisis, appealing to the target's emotions and empathy, hoping to get them to reveal information or provide assistance.

• and more.