Beyond Phishing: Social Engineering Revisited

Phishing has been around for so long that it’s hard to remember the first time one arrived in the email in box. In fact, it began even before email with advance fee scams such as the Spanish Prisoner scenario, which warped into the Nigerian Prince scam we all know and love today. For most who do remember their first phishing email, it was probably the infamous “I Love You” email message. All that was in the message itself were those words with an attachment. If that was clicked, you knew quickly that the sender really didn’t love you.

Phishing is the most common and probably the most well-known flavor of social engineering these days. Most often, phishing scams after some type of financial account information, login credentials, or other sensitive information. However, as we’ve seen numerous times, they are capable of much more; specifically for delivering ransomware and other types of malware.

However, this isn’t the only type of social engineering and it’s worth a bit of time to go over some of the other types.

2

It’s safe to assume that if someone has an email account, some type of phishing attempt has landed in said person’s inbox at some point. Often, it appears to be from a financial institution, PayPal, Apple, FedEx, or any other number of companies. The problem is that because employees get so many email messages in a day, it is sometimes difficult for them to differentiate between the good, the bad, and the ugly. And who doesn’t get an email from a delivery service, PayPal, or Amazon every now and again? Likely, very few fit into this category.

Because of this, the cybercriminals are able to use employees against the organization. They pretend to send invoices in hopes that a payment gets sent. Sometimes, they pretend to be an executive within the company and request a wire transfer or request that W-2 information of employees be emailed. This is social engineering and phishing that’s often referred to as business email compromise (BEC).  This type and phishing in general is a very effective tool for hackers. A study released recently by BakerHostetler found that phishing is indeed the leading cause of security incidents today. The FBI repeatedly warns against BEC and in 2017, they released data that between “January 2015 and December 2016, there was a 2,370% increase in identified exposed losses.” It’s been seen in all 50 states and in more than 130 countries.

Using Their Voices

Social engineering via phishing isn’t only done in email these days. It now comes in many forms. It can be in a text message or other short messages, called smishing. It can also arrive by voice by way of the telephone (vishing). These are also social engineering and often the sender or caller will pretend to be law enforcement, another government agency such as the IRS, or technical support from somewhere. A common scam that continues to make the rounds is the tech support scam. Someone will call on the phone claiming that the target’s computer needs some type of support. Well, that’s not so far-fetched and can be very believable. However, they are often scams. Smishing is also on the rise. These messages don’t only trick people out of information, but can now lock a smartphone in an instant without the user doing a single thing.

2

Social engineering isn’t only in digital form. Yes, that’s what we see and hear about most often, but it can also show up in the reception area of the office. It’s still not uncommon for cybercriminals to show up at the office and pretend to be someone with a legitimate reason to be there. It could be a consultant, a delivery driver, or a HVAC repairperson. There is no way to profile these people anymore, just as it’s becoming more difficult to rely on a template for a phishing email message.

Maintaining the expectation that employees, whenever possible, are required to secure “Confidential” and “Restricted” documents is not over the top. By keeping their desk areas cleared of items that may be considered a risk for theft by an information thief, they may prevent someone from walking away with important documents, information, or hardware.

This sounds simple, but it can actually be something that is taken for granted in an office environment. Our days can get pretty routine or rushed. We forget that there may be people who don’t work there roaming about from time to time. These people may be able to view or take papers off a desk or hear information being discussed in the open that can cause damage to the organization. In fact, Jim Stickley of Stickley on Security installed malware on a locked laptop in less than one minute.

Just Using Technology Is Insufficient

Technology is necessary to mitigate cyber risk these days. Unfortunately, it’s still lagging when it comes to detecting phishing and other social engineering attacks. There are many products to help filter out the spam and malicious email messages, but the bad actors who are creating the phishing messages are getting better and better. Often, they get past the spam filters and other tools. Email scanning tools are great and they do work to filter out about 90% of the bad stuff. That means there is still about 10% that makes it to a human’s email inbox. Even in a small business, that can be a lot of email and a single click on a malicious link can sink the whole ship. Often these email messages are very targeted and can fool even the most eagle-eyed of us.

People are in and out of the office all the time. Most do have reason to be there, but some don’t. Those are the ones to be on alert about. Humans still need to be another firewall between the hacker community and your network.

Your Tips For Defense

• Train the staff, the vendors who connect to your network, and your contractors to recognize not only phishing, but also all types of social engineering.

• Don’t just perform training once a year and forget it. Threats change all the time. Phishing attacks become more sophisticated daily. Ongoing awareness training is the key to lowering your risk.

• Stay on top of current cybersecurity trends. Malware changes constantly. Keep up as much as possible.

• Test your employees. Once you train them, make sure to follow up to find out how well they understand. Follow through with those who don’t seem to grasp it.

Social engineering is alive and well in many forms. It’s like a shape shifter and is constantly being reinvented, revised, and reused. Regardless of the form, it can only be fought by working with the employees and helping them identify potential attacks and letting them know what to do should they find one.