1
00:00:00,120 --> 00:00:01,650
In this lesson, we're going to cover

2
00:00:01,650 --> 00:00:03,360
other social engineering attacks.

3
00:00:03,360 --> 00:00:06,240
Now, some of these common social engineering attacks include

4
00:00:06,240 --> 00:00:07,260
diversion theft,

5
00:00:07,260 --> 00:00:08,100
hoaxes,

6
00:00:08,100 --> 00:00:09,240
shoulder surfing,

7
00:00:09,240 --> 00:00:10,380
dumpster diving,

8
00:00:10,380 --> 00:00:11,460
eavesdropping,

9
00:00:11,460 --> 00:00:12,293
baiting,

10
00:00:12,293 --> 00:00:14,520
and piggybacking or tailgating.

11
00:00:14,520 --> 00:00:17,220
First, we have diversion theft.

12
00:00:17,220 --> 00:00:20,490
Diversion theft involves manipulating a situation

13
00:00:20,490 --> 00:00:21,840
or creating a distraction

14
00:00:21,840 --> 00:00:24,300
to steal valuable items or information.

15
00:00:24,300 --> 00:00:25,290
In the physical world,

16
00:00:25,290 --> 00:00:28,020
this can involve creating a scene to divert attention

17
00:00:28,020 --> 00:00:30,063
while an accomplice commits theft.

18
00:00:30,900 --> 00:00:32,070
In the data realm,

19
00:00:32,070 --> 00:00:35,070
it could involve diverting internet traffic to fake websites

20
00:00:35,070 --> 00:00:37,470
to steal victim's data.

21
00:00:37,470 --> 00:00:40,290
One common example of diverting internet traffic

22
00:00:40,290 --> 00:00:42,450
to fake websites to steal data

23
00:00:42,450 --> 00:00:45,390
is to conduct a DNS spoofing attack.

24
00:00:45,390 --> 00:00:49,200
In a DNS or domain name system spoofing attack,

25
00:00:49,200 --> 00:00:51,870
the attacker manipulates the DNS server settings

26
00:00:51,870 --> 00:00:55,290
so that when a user types in a legitimate website URL,

27
00:00:55,290 --> 00:00:57,300
they are redirected to a fake website

28
00:00:57,300 --> 00:00:58,980
created by the attacker.

29
00:00:58,980 --> 00:01:02,400
This fake website usually relies on a brand impersonation

30
00:01:02,400 --> 00:01:04,950
to closely resemble the legitimate site

31
00:01:04,950 --> 00:01:06,510
and to trick users into believing

32
00:01:06,510 --> 00:01:08,340
that they're on the correct page.

33
00:01:08,340 --> 00:01:10,020
Once on the fake website,

34
00:01:10,020 --> 00:01:12,960
the user might be prompted to enter sensitive information

35
00:01:12,960 --> 00:01:14,670
such as usernames, passwords,

36
00:01:14,670 --> 00:01:16,170
or credit card details.

37
00:01:16,170 --> 00:01:18,810
If the users are unaware of the deception taking place,

38
00:01:18,810 --> 00:01:21,180
they may provide this type of sensitive information

39
00:01:21,180 --> 00:01:22,013
to the attacker

40
00:01:22,013 --> 00:01:25,290
without thinking they're being targeted by an attack.

41
00:01:25,290 --> 00:01:27,090
Second, we have hoaxes.

42
00:01:27,090 --> 00:01:29,400
A hoax is a malicious deception

43
00:01:29,400 --> 00:01:31,710
that is often spread through social media,

44
00:01:31,710 --> 00:01:34,020
email, or other communication channels.

45
00:01:34,020 --> 00:01:35,850
While hoaxes may seem harmless,

46
00:01:35,850 --> 00:01:38,430
they can cause significant disruption and panic

47
00:01:38,430 --> 00:01:41,280
and are sometimes used to spread malware

48
00:01:41,280 --> 00:01:42,690
or phishing attacks.

49
00:01:42,690 --> 00:01:45,630
Hoaxes are often paired with phishing attacks

50
00:01:45,630 --> 00:01:47,370
and impersonation attacks.

51
00:01:47,370 --> 00:01:49,860
For example, if you are using a Mac system

52
00:01:49,860 --> 00:01:52,350
and you receive an alert through your browser

53
00:01:52,350 --> 00:01:54,840
that your Windows has been affected with a virus,

54
00:01:54,840 --> 00:01:57,930
and that will be a clear indication that that is a hoax,

55
00:01:57,930 --> 00:02:01,770
since Windows malware cannot be used to affect a macOS

56
00:02:01,770 --> 00:02:03,510
or Linux-based system.

57
00:02:03,510 --> 00:02:04,890
To combat hoaxes,

58
00:02:04,890 --> 00:02:08,430
it is important that users use good critical thinking skills

59
00:02:08,430 --> 00:02:11,760
and conduct fact checking of any suspicious messages,

60
00:02:11,760 --> 00:02:15,150
websites, or other forms of communication.

61
00:02:15,150 --> 00:02:17,070
Your users must always verify

62
00:02:17,070 --> 00:02:19,680
the information they receive is from a reliable source

63
00:02:19,680 --> 00:02:23,130
before they take action on any request they receive.

64
00:02:23,130 --> 00:02:25,830
Third, we have shoulder surfing.

65
00:02:25,830 --> 00:02:28,560
Shoulder surfing involves looking over someone's shoulder

66
00:02:28,560 --> 00:02:30,510
to gather personal information.

67
00:02:30,510 --> 00:02:33,330
This could be done to steal PINs at ATMs,

68
00:02:33,330 --> 00:02:35,040
passwords on public computers,

69
00:02:35,040 --> 00:02:37,920
or sensitive information from their paperwork.

70
00:02:37,920 --> 00:02:39,660
Also, it is important to remember

71
00:02:39,660 --> 00:02:42,030
that targets do not have to be close to the victim

72
00:02:42,030 --> 00:02:45,300
to perform shoulder surfing as the name suggests.

73
00:02:45,300 --> 00:02:46,590
Because modern technology

74
00:02:46,590 --> 00:02:48,450
like the use of high-powered cameras

75
00:02:48,450 --> 00:02:51,000
or closed-circuit television cameras

76
00:02:51,000 --> 00:02:52,530
can make it easy for attackers

77
00:02:52,530 --> 00:02:54,150
to steal the victim's information

78
00:02:54,150 --> 00:02:56,640
from across the room, across the building,

79
00:02:56,640 --> 00:02:58,620
or across the city.

80
00:02:58,620 --> 00:03:00,300
To prevent shoulder surfing,

81
00:03:00,300 --> 00:03:02,670
users must be aware of their surroundings

82
00:03:02,670 --> 00:03:05,040
when providing any sensitive information.

83
00:03:05,040 --> 00:03:07,950
If you work in an open floor plan building

84
00:03:07,950 --> 00:03:09,660
or a cubicle form,

85
00:03:09,660 --> 00:03:12,180
you should require the use of privacy screens

86
00:03:12,180 --> 00:03:14,400
in your organization's workstations

87
00:03:14,400 --> 00:03:16,170
and provide shield to keypads

88
00:03:16,170 --> 00:03:18,630
when asking someone to enter a PIN

89
00:03:18,630 --> 00:03:20,130
or password into a system

90
00:03:20,130 --> 00:03:22,140
to prevent shoulder surfing.

91
00:03:22,140 --> 00:03:24,750
Fourth, we have dumpster diving.

92
00:03:24,750 --> 00:03:27,360
Dumpster diving involves searching through trash

93
00:03:27,360 --> 00:03:29,430
to find valuable information.

94
00:03:29,430 --> 00:03:32,430
Dumpster diving is commonly used to find discarded documents

95
00:03:32,430 --> 00:03:34,950
containing personal or corporate information.

96
00:03:34,950 --> 00:03:37,050
And yes, I know it sounds disgusting,

97
00:03:37,050 --> 00:03:38,880
but a good social engineer will not be deterred

98
00:03:38,880 --> 00:03:40,350
from jumping into a dumpster

99
00:03:40,350 --> 00:03:41,790
or searching through your trash cans

100
00:03:41,790 --> 00:03:44,550
because it can be a gold mine of sensitive data

101
00:03:44,550 --> 00:03:46,590
about the targeted organization.

102
00:03:46,590 --> 00:03:49,650
To prevent dumpster diving from being an effective attack,

103
00:03:49,650 --> 00:03:51,720
any sensitive or confidential documents

104
00:03:51,720 --> 00:03:54,120
should be shredded before a disposal,

105
00:03:54,120 --> 00:03:57,330
and your organization should implement a clean desk policy

106
00:03:57,330 --> 00:03:59,910
where employees lock up their documents

107
00:03:59,910 --> 00:04:02,220
or shred them at the end of the day.

108
00:04:02,220 --> 00:04:04,230
In modern enterprise networks,

109
00:04:04,230 --> 00:04:06,210
virtual or digital dumpster diving

110
00:04:06,210 --> 00:04:08,280
is also becoming more popular.

111
00:04:08,280 --> 00:04:10,140
Virtual or digital dumpster diving

112
00:04:10,140 --> 00:04:11,580
is performed by an attacker

113
00:04:11,580 --> 00:04:14,130
who is able to look through the recycling bin

114
00:04:14,130 --> 00:04:16,800
or the deleted files on a given system.

115
00:04:16,800 --> 00:04:19,950
This type of virtual or digital dumpster diving

116
00:04:19,950 --> 00:04:22,140
can be prevented by properly deleting

117
00:04:22,140 --> 00:04:25,290
and overriding old files on your store's volumes,

118
00:04:25,290 --> 00:04:27,120
such as your hard disk drive,

119
00:04:27,120 --> 00:04:28,080
solid state drives,

120
00:04:28,080 --> 00:04:29,883
or cloud-based store system.

121
00:04:30,810 --> 00:04:33,000
Fifth, we have eavesdropping.

122
00:04:33,000 --> 00:04:35,880
Eavesdropping involves the process of secretly listening

123
00:04:35,880 --> 00:04:37,710
to private conversations.

124
00:04:37,710 --> 00:04:38,970
In a digital context,

125
00:04:38,970 --> 00:04:41,880
it could involve intercepting network traffic to steal data

126
00:04:41,880 --> 00:04:43,260
or conducting wire tapping

127
00:04:43,260 --> 00:04:45,210
of the organization's phone system.

128
00:04:45,210 --> 00:04:47,220
Eavesdropping can take the form of an attacker

129
00:04:47,220 --> 00:04:49,200
listening to you while on the phone,

130
00:04:49,200 --> 00:04:51,300
revealing some type of information

131
00:04:51,300 --> 00:04:53,250
that they might be interested in,

132
00:04:53,250 --> 00:04:56,490
or it could take the form of an adversary in the middle

133
00:04:56,490 --> 00:04:58,530
or on-path attack.

134
00:04:58,530 --> 00:04:59,760
In this type of attack,

135
00:04:59,760 --> 00:05:01,920
the perpetrator intercepts the communication

136
00:05:01,920 --> 00:05:04,170
between two parties without their knowledge

137
00:05:04,170 --> 00:05:07,530
to effectively listen in on their conversations.

138
00:05:07,530 --> 00:05:08,940
To prevent eavesdropping,

139
00:05:08,940 --> 00:05:10,830
your organization must always use secure

140
00:05:10,830 --> 00:05:12,660
and encrypted communication channels,

141
00:05:12,660 --> 00:05:15,330
encrypt any data that will be transferred across the network

142
00:05:15,330 --> 00:05:19,140
and readily update and patch through systems.

143
00:05:19,140 --> 00:05:20,673
Sixth, we have baiting.

144
00:05:21,570 --> 00:05:24,390
Baiting involves leaving a malware-infected physical device,

145
00:05:24,390 --> 00:05:25,730
like a USB drive,

146
00:05:25,730 --> 00:05:28,230
in a place where it will be found by a victim

147
00:05:28,230 --> 00:05:30,180
who will then hopefully use the device

148
00:05:30,180 --> 00:05:32,250
to unknowingly install malware

149
00:05:32,250 --> 00:05:34,320
on the organization's computer system.

150
00:05:34,320 --> 00:05:36,300
Most people tend to be curious

151
00:05:36,300 --> 00:05:38,550
and some untrained users might be intrigued

152
00:05:38,550 --> 00:05:40,560
to find out what's on that USB drive

153
00:05:40,560 --> 00:05:42,060
that they found in the parking lot.

154
00:05:42,060 --> 00:05:43,920
So they walk over to their desk

155
00:05:43,920 --> 00:05:45,300
inside of the office building

156
00:05:45,300 --> 00:05:48,540
and they choose to insert the newly found USB device

157
00:05:48,540 --> 00:05:49,650
into their computer system

158
00:05:49,650 --> 00:05:52,080
to see what is stored on the device.

159
00:05:52,080 --> 00:05:53,640
Unfortunately, they didn't realize

160
00:05:53,640 --> 00:05:55,890
that the USB device may contain malware

161
00:05:55,890 --> 00:05:57,540
that gets installed on a computer

162
00:05:57,540 --> 00:06:00,540
within just a few seconds of connecting that USB drive

163
00:06:00,540 --> 00:06:02,010
to a computer system.

164
00:06:02,010 --> 00:06:03,120
To prevent baiting,

165
00:06:03,120 --> 00:06:05,130
your organization's user should be trained

166
00:06:05,130 --> 00:06:08,580
to never use a USB device or other device

167
00:06:08,580 --> 00:06:10,680
if they don't know exactly where it came from

168
00:06:10,680 --> 00:06:12,630
and if it is safe to use.

169
00:06:12,630 --> 00:06:15,690
Seven, we have piggybacking or tailgating.

170
00:06:15,690 --> 00:06:17,940
Piggybacking and tailgating both involve

171
00:06:17,940 --> 00:06:19,500
the unauthorized person

172
00:06:19,500 --> 00:06:22,410
following an authorized person into a secure area.

173
00:06:22,410 --> 00:06:23,910
However, there's a critical difference

174
00:06:23,910 --> 00:06:26,340
between piggybacking and tailgating.

175
00:06:26,340 --> 00:06:27,840
When it comes to tailgating,

176
00:06:27,840 --> 00:06:30,240
the attacker attempts to follow an employee

177
00:06:30,240 --> 00:06:32,190
through an access control vestibule

178
00:06:32,190 --> 00:06:35,880
or access control point without their knowledge.

179
00:06:35,880 --> 00:06:38,040
So let's imagine an office building

180
00:06:38,040 --> 00:06:39,390
that has a secure interest

181
00:06:39,390 --> 00:06:41,190
that requires an access card

182
00:06:41,190 --> 00:06:43,980
to unlock the door and enter the facility.

183
00:06:43,980 --> 00:06:46,080
An authorized employee, Jane,

184
00:06:46,080 --> 00:06:48,180
swipes her card to enter the building.

185
00:06:48,180 --> 00:06:49,890
Then unknown to her,

186
00:06:49,890 --> 00:06:51,360
an unauthorized attacker

187
00:06:51,360 --> 00:06:53,940
who doesn't have their own access badge

188
00:06:53,940 --> 00:06:56,430
quietly follows Jane into the building

189
00:06:56,430 --> 00:06:58,860
before the door closes behind her.

190
00:06:58,860 --> 00:07:01,230
If this person was able to get inside the building

191
00:07:01,230 --> 00:07:02,820
without Jane seeing them,

192
00:07:02,820 --> 00:07:05,790
they will have successfully performed a tailgating attack

193
00:07:05,790 --> 00:07:09,030
to gain unauthorized access into the facility.

194
00:07:09,030 --> 00:07:10,500
Piggybacking, on the other hand,

195
00:07:10,500 --> 00:07:13,980
involves an attacker convincing an authorized employee

196
00:07:13,980 --> 00:07:15,870
to let them into the facility

197
00:07:15,870 --> 00:07:17,820
by getting the authorized employee

198
00:07:17,820 --> 00:07:19,380
to swipe their own access badge

199
00:07:19,380 --> 00:07:21,600
and allow the attacker inside.

200
00:07:21,600 --> 00:07:25,410
This time, let's pretend that, John, an authorized employee,

201
00:07:25,410 --> 00:07:28,080
is about to enter the same secured building

202
00:07:28,080 --> 00:07:30,630
that Jane just entered a few minutes ago.

203
00:07:30,630 --> 00:07:32,970
As John is about to swipe his access card

204
00:07:32,970 --> 00:07:34,230
to unlock the door,

205
00:07:34,230 --> 00:07:37,110
an attacker who is dressed up as delivery person

206
00:07:37,110 --> 00:07:40,200
walks up to the door carrying a large package.

207
00:07:40,200 --> 00:07:42,240
The delivery person politely ask John

208
00:07:42,240 --> 00:07:43,680
to hold the door open

209
00:07:43,680 --> 00:07:45,000
since their hands are full

210
00:07:45,000 --> 00:07:47,220
and they need to get this package to the receptionist

211
00:07:47,220 --> 00:07:49,170
on the other side of the door.

212
00:07:49,170 --> 00:07:50,910
John, wanting to be helpful,

213
00:07:50,910 --> 00:07:53,520
swipes his access badge to unlock the door,

214
00:07:53,520 --> 00:07:55,500
holds the door open for delivery person,

215
00:07:55,500 --> 00:07:58,170
and then follows the delivery person through the door

216
00:07:58,170 --> 00:08:00,630
and heads to his own office.

217
00:08:00,630 --> 00:08:01,590
In this case,

218
00:08:01,590 --> 00:08:04,380
the delivery person has piggybacked into the building

219
00:08:04,380 --> 00:08:05,790
because unlike the tailgater

220
00:08:05,790 --> 00:08:08,940
who followed Jane into the building without her knowledge,

221
00:08:08,940 --> 00:08:12,780
John willingly allowed this supposed delivery person

222
00:08:12,780 --> 00:08:14,100
to enter the building,

223
00:08:14,100 --> 00:08:16,290
even though they were really an attacker

224
00:08:16,290 --> 00:08:19,740
who didn't have authorized access to get into the building.

225
00:08:19,740 --> 00:08:22,020
Insider threats often use piggybacking

226
00:08:22,020 --> 00:08:24,030
to enter an office or data center

227
00:08:24,030 --> 00:08:26,070
without recording their access badge

228
00:08:26,070 --> 00:08:28,230
in the facility security log.

229
00:08:28,230 --> 00:08:31,560
So remember, there are multiple different kinds

230
00:08:31,560 --> 00:08:33,030
of social engineering attacks,

231
00:08:33,030 --> 00:08:34,799
including diversion theft,

232
00:08:34,799 --> 00:08:35,789
hoaxes,

233
00:08:35,789 --> 00:08:36,690
shoulder surfing,

234
00:08:36,690 --> 00:08:37,850
and dumpster diving,

235
00:08:37,850 --> 00:08:38,970
to eavesdropping,

236
00:08:38,970 --> 00:08:39,803
baiting,

237
00:08:39,803 --> 00:08:42,210
and piggybacking or tailgating.

238
00:08:42,210 --> 00:08:44,520
Diversion theft involves manipulating individuals

239
00:08:44,520 --> 00:08:47,730
to redirect goods to a different location for theft.

240
00:08:47,730 --> 00:08:50,370
Hoaxes spread false warnings or claims

241
00:08:50,370 --> 00:08:53,100
to create unnecessary worry or actions.

242
00:08:53,100 --> 00:08:55,560
Shoulder surfing involves direct observation

243
00:08:55,560 --> 00:08:57,990
of confidential information like PINs or passwords

244
00:08:57,990 --> 00:08:59,640
over someone's shoulder.

245
00:08:59,640 --> 00:09:02,160
Dumpster diving refers to searching through trash

246
00:09:02,160 --> 00:09:03,450
for valuable information

247
00:09:03,450 --> 00:09:05,880
that hasn't been properly disposed of.

248
00:09:05,880 --> 00:09:08,010
Eavesdropping entails secretly listening

249
00:09:08,010 --> 00:09:09,540
to private conversations

250
00:09:09,540 --> 00:09:12,420
usually without the participants being aware.

251
00:09:12,420 --> 00:09:15,270
Baiting lures victims into downloading malicious software

252
00:09:15,270 --> 00:09:17,280
or revealing confidential information

253
00:09:17,280 --> 00:09:19,350
by promising something enticing.

254
00:09:19,350 --> 00:09:21,720
And lastly, piggybacking or tailgating

255
00:09:21,720 --> 00:09:23,910
involves unauthorized individuals

256
00:09:23,910 --> 00:09:25,950
following authorized personnel

257
00:09:25,950 --> 00:09:28,683
into secure areas without proper authentication.