Hi, and welcome back to Section 10 social Engineering Attacks.
In this video,
you'll learn the principles or social engineering and various types of
attacks that a threat actor will perform on your target,
so I hope you're excited.
Let's siphon in what exactly is meant by social
engineering. To put simply,
social engineering is a type of cyber attack that is designed to
actually manipulate a person or tricky person into performing some type of
action or even revealing sensitive information, such as,
let's say, their passwords or additional user credentials.
This type of attack focuses on hacking the human mind,
but simply the human mind has no firewalls or no antiviruses by
traditional computers. It is simply based on intelligence.
With social engineering,
the idea is to gain some type of unauthorized access into a system
or a physical location,
and sometime we may require the victim to perform an action for us.
Let's say we send an email to someone,
then we will need to trick this person into in the malicious link or
even open the malicious file that is attached or the email message. Hence,
we need social engineering to trick our victims for social engineering to
be effective. These are the essential core factors. Authority,
intimidation, consensus scarcity, familiarity, trust,
and urgency with authority.
The threat actor or the ethical hacker pretends to have some sort of authority
during the conversation or perhaps express authority in an email message.
The factor is the attacker,
or let's say the ethical hacker needs to demonstrate or exhibit
intimidation. This is way the attack may say,
if you are not willing to help or participate in a situation,
there may be some type of repercussion or discipline remeasure.
In addition,
we can use consensus to simply tell the victim that other persons are doing
the same thing and it's quite normal.
If there's a lot of persons who's doing the same thing,
then we can leverage consensus to persuade a victim
into performing the action or even revealing the information.
Another factor is scarcity.
This is simply why informing the victim that this action is only available for
a short period of time and it has to be completed before this time as pass.
Another factor is to invoke some type of familiarity.
This is simply by trying to make the victim like that attacker or to like
you. A common example is sharing some type of mutual experience.
Usually when people are familiar with others,
they tend to trust a little more easily. Hence, the next factor is trust.
Once trusses established,
the ethical hacker needs to take advantage of that trust.
And last but not least, there's urgency.
Whenever you inject urgency into a situation,
it makes things seem to be more important and critical than others.
To be great at social engineering, you need to be a people person. In addition,
you need to invoke all of these factors simultaneously to increase the
chances or the likelihood that your social engineering attack will be
successful. There are different types of social engineering attacks.
Most social engineering attacks uses computers,
some of which are physical and some of which simply requires a conversation.
One type is called phishing. This is usually in the form of an email message,
which may seem to be originating from a legitimate sender such as an e-commerce
company or even your bank. Within the email message,
it may contain some type of obfuscated link or perhaps a
malicious attachment, which is indicated to the user.
Click the link to reset your password or perhaps open the attachment to view the
invoice.
Phish emails are usually seen as spa email as it is targeted towards
a general audience are not a particular group of persons.
Another type of social engineering is called spearfishing. With spearfishing,
this type of attack is targeted towards a specific group of audience. Hence,
it is designed to be focus based. For this attack to be successful,
it needs to be much more believable and a lot more work needs to be put in
simply because we are targeted a specific group of audience who perhaps belong
to a specific organization or does transactions with a particular company.
There's a type of social engineering attack,
which is focused on targeted towards a high profile employees of an organization
such as a C, this type of attack or this type of social engineering attack.
It's called wheeling, but wheeling.
It is designed to trick the high profile employees of an organization.
These employees usually has a lot of authority and their user accounts usually
has a lot of high level privileges,
and sometimes these high profile employees may not understand the importance of
security and security awareness. Therefore,
if our attacker is able to compromise, let's say the CEO's account,
then their targeter can simply impersonate this user and perform authoritative
and administrative actions. Uneven execute different types of attacks.
On the internal network is another type of social engineering attack,
which uses a traditional telephone.
This is where the attacker will simply pretend to be from, let's say,
trusted organization and calls a victim,
and this conversation happens over a telephone system.
The intention is to trick the person into revealing,
let's say their credit card details, their usernames or even their passwords.
Perhaps it is to even trick the victim into performing an action into
downloading a malicious software are installing it on their server. Furthermore,
their social engineering, which takes place over SMS messages,
this is called machine. In this scenario,
the victim usually receives an S M SM message from Theta who's pretending to be
from Illegit organization. Hence,
it's really important to always verify who the caller actually is.
Lastly,
there are different type of physical social engineering techniques and attacks
based thumb surviving, where the attacker goes through someone else's trash,
looking for sensitive information such as those printed on documents that can be
used for impersonation or even gaining access into the victim's account.
There's also shoulder surfing.
This is the technique of looking over someone else's shoulder while they're
entering sensitive data or details on your screen. There's steel,
which is following a person through a secure area within a building,
you can use mantra traps to actually prevent this type of attack from occurring.
The last one not least, is pre-texting.
This technique simply allows our attacker to create a fake story and attempt to
trick the victim into performing an action. During a course of this video,
you have learned the principles and the fundamentals of social engineering
attacks. Additionally, you uploaded different types of attacks.
In the next video,
you'll learn how to perform social engineering using Carly Lenox.
I hope this video has been informative for you and thank you for.