In this lesson, we're going to cover
other social engineering attacks.
Now, some of these common social engineering attacks include
diversion theft,
hoaxes,
shoulder surfing,
dumpster diving,
eavesdropping,
baiting,
and piggybacking or tailgating.
First, we have diversion theft.
Diversion theft involves manipulating a situation
or creating a distraction
to steal valuable items or information.
In the physical world,
this can involve creating a scene to divert attention
while an accomplice commits theft.
In the data realm,
it could involve diverting internet traffic to fake websites
to steal victim's data.
One common example of diverting internet traffic
to fake websites to steal data
is to conduct a DNS spoofing attack.
In a DNS or domain name system spoofing attack,
the attacker manipulates the DNS server settings
so that when a user types in a legitimate website URL,
they are redirected to a fake website
created by the attacker.
This fake website usually relies on a brand impersonation
to closely resemble the legitimate site
and to trick users into believing
that they're on the correct page.
Once on the fake website,
the user might be prompted to enter sensitive information
such as usernames, passwords,
or credit card details.
If the users are unaware of the deception taking place,
they may provide this type of sensitive information
to the attacker
without thinking they're being targeted by an attack.
Second, we have hoaxes.
A hoax is a malicious deception
that is often spread through social media,
email, or other communication channels.
While hoaxes may seem harmless,
they can cause significant disruption and panic
and are sometimes used to spread malware
or phishing attacks.
Hoaxes are often paired with phishing attacks
and impersonation attacks.
For example, if you are using a Mac system
and you receive an alert through your browser
that your Windows has been affected with a virus,
and that will be a clear indication that that is a hoax,
since Windows malware cannot be used to affect a macOS
or Linux-based system.
To combat hoaxes,
it is important that users use good critical thinking skills
and conduct fact checking of any suspicious messages,
websites, or other forms of communication.
Your users must always verify
the information they receive is from a reliable source
before they take action on any request they receive.
Third, we have shoulder surfing.
Shoulder surfing involves looking over someone's shoulder
to gather personal information.
This could be done to steal PINs at ATMs,
passwords on public computers,
or sensitive information from their paperwork.
Also, it is important to remember
that targets do not have to be close to the victim
to perform shoulder surfing as the name suggests.
Because modern technology
like the use of high-powered cameras
or closed-circuit television cameras
can make it easy for attackers
to steal the victim's information
from across the room, across the building,
or across the city.
To prevent shoulder surfing,
users must be aware of their surroundings
when providing any sensitive information.
If you work in an open floor plan building
or a cubicle form,
you should require the use of privacy screens
in your organization's workstations
and provide shield to keypads
when asking someone to enter a PIN
or password into a system
to prevent shoulder surfing.
Fourth, we have dumpster diving.
Dumpster diving involves searching through trash
to find valuable information.
Dumpster diving is commonly used to find discarded documents
containing personal or corporate information.
And yes, I know it sounds disgusting,
but a good social engineer will not be deterred
from jumping into a dumpster
or searching through your trash cans
because it can be a gold mine of sensitive data
about the targeted organization.
To prevent dumpster diving from being an effective attack,
any sensitive or confidential documents
should be shredded before a disposal,
and your organization should implement a clean desk policy
where employees lock up their documents
or shred them at the end of the day.
In modern enterprise networks,
virtual or digital dumpster diving
is also becoming more popular.
Virtual or digital dumpster diving
is performed by an attacker
who is able to look through the recycling bin
or the deleted files on a given system.
This type of virtual or digital dumpster diving
can be prevented by properly deleting
and overriding old files on your store's volumes,
such as your hard disk drive,
solid state drives,
or cloud-based store system.
Fifth, we have eavesdropping.
Eavesdropping involves the process of secretly listening
to private conversations.
In a digital context,
it could involve intercepting network traffic to steal data
or conducting wire tapping
of the organization's phone system.
Eavesdropping can take the form of an attacker
listening to you while on the phone,
revealing some type of information
that they might be interested in,
or it could take the form of an adversary in the middle
or on-path attack.
In this type of attack,
the perpetrator intercepts the communication
between two parties without their knowledge
to effectively listen in on their conversations.
To prevent eavesdropping,
your organization must always use secure
and encrypted communication channels,
encrypt any data that will be transferred across the network
and readily update and patch through systems.
Sixth, we have baiting.
Baiting involves leaving a malware-infected physical device,
like a USB drive,
in a place where it will be found by a victim
who will then hopefully use the device
to unknowingly install malware
on the organization's computer system.
Most people tend to be curious
and some untrained users might be intrigued
to find out what's on that USB drive
that they found in the parking lot.
So they walk over to their desk
inside of the office building
and they choose to insert the newly found USB device
into their computer system
to see what is stored on the device.
Unfortunately, they didn't realize
that the USB device may contain malware
that gets installed on a computer
within just a few seconds of connecting that USB drive
to a computer system.
To prevent baiting,
your organization's user should be trained
to never use a USB device or other device
if they don't know exactly where it came from
and if it is safe to use.
Seven, we have piggybacking or tailgating.
Piggybacking and tailgating both involve
the unauthorized person
following an authorized person into a secure area.
However, there's a critical difference
between piggybacking and tailgating.
When it comes to tailgating,
the attacker attempts to follow an employee
through an access control vestibule
or access control point without their knowledge.
So let's imagine an office building
that has a secure interest
that requires an access card
to unlock the door and enter the facility.
An authorized employee, Jane,
swipes her card to enter the building.
Then unknown to her,
an unauthorized attacker
who doesn't have their own access badge
quietly follows Jane into the building
before the door closes behind her.
If this person was able to get inside the building
without Jane seeing them,
they will have successfully performed a tailgating attack
to gain unauthorized access into the facility.
Piggybacking, on the other hand,
involves an attacker convincing an authorized employee
to let them into the facility
by getting the authorized employee
to swipe their own access badge
and allow the attacker inside.
This time, let's pretend that, John, an authorized employee,
is about to enter the same secured building
that Jane just entered a few minutes ago.
As John is about to swipe his access card
to unlock the door,
an attacker who is dressed up as delivery person
walks up to the door carrying a large package.
The delivery person politely ask John
to hold the door open
since their hands are full
and they need to get this package to the receptionist
on the other side of the door.
John, wanting to be helpful,
swipes his access badge to unlock the door,
holds the door open for delivery person,
and then follows the delivery person through the door
and heads to his own office.
In this case,
the delivery person has piggybacked into the building
because unlike the tailgater
who followed Jane into the building without her knowledge,
John willingly allowed this supposed delivery person
to enter the building,
even though they were really an attacker
who didn't have authorized access to get into the building.
Insider threats often use piggybacking
to enter an office or data center
without recording their access badge
in the facility security log.
So remember, there are multiple different kinds
of social engineering attacks,
including diversion theft,
hoaxes,
shoulder surfing,
and dumpster diving,
to eavesdropping,
baiting,
and piggybacking or tailgating.
Diversion theft involves manipulating individuals
to redirect goods to a different location for theft.
Hoaxes spread false warnings or claims
to create unnecessary worry or actions.
Shoulder surfing involves direct observation
of confidential information like PINs or passwords
over someone's shoulder.
Dumpster diving refers to searching through trash
for valuable information
that hasn't been properly disposed of.
Eavesdropping entails secretly listening
to private conversations
usually without the participants being aware.
Baiting lures victims into downloading malicious software
or revealing confidential information
by promising something enticing.
And lastly, piggybacking or tailgating
involves unauthorized individuals
following authorized personnel
into secure areas without proper authentication.