Social engineering (security)
Social engineering is a captivating and increasingly critical aspect of information security, where the most sophisticated systems can be bypassed not by code, but by captivating human psychology. It's the art of influence, subtly guiding individuals to divulge secrets or perform actions they might otherwise avoid. As our world becomes more interconnected, understanding these human vulnerabilities is paramount—because the weakest link in any security chain is often not a firewall, but a person. Social engineering exploits inherent human psychological traits and cognitive biases, making it a powerful and pervasive threat in the digital age. A variety of sophisticated techniques, from simple baiting to elaborate pretexting, are used to manipulate individuals into compromising sensitive information or systems. Legal frameworks are continually evolving to combat social engineering, yet the sheer ingenuity of attackers means vigilance and education remain critical defenses.
AI Summary
Social engineering is a captivating and increasingly critical aspect of information security, where the most sophisticated systems can be bypassed not by code, but by captivating human psychology. It's the art of influence, subtly guiding individuals to divulge secrets or perform actions they might otherwise avoid. As our world becomes more interconnected, understanding these human vulnerabilities is paramount—because the weakest link in any security chain is often not a firewall, but a person.
- Social engineering exploits inherent human psychological traits and cognitive biases, making it a powerful and pervasive threat in the digital age.
- A variety of sophisticated techniques, from simple baiting to elaborate pretexting, are used to manipulate individuals into compromising sensitive information or systems.
- Legal frameworks are continually evolving to combat social engineering, yet the sheer ingenuity of attackers means vigilance and education remain critical defenses.
What is Social Engineering?
At its heart, social engineering in security is about using psychological influence to persuade people. It's not necessarily about breaking into computer systems with complex code, but rather about convincing someone to give you access—or to make a mistake that grants it.
This differs from simple psychological manipulation, which often implies a negative, controlling, or one-sided transaction. Social engineering, surprisingly, can sometimes appear mutually beneficial, or at least not immediately harmful to the victim, making it incredibly insidious. It's a modern twist on the classic confidence trick, but often a stepping stone in a much larger, more complex scheme.
The prevalence and intensity of social engineering attacks are rapidly escalating, making it one of the defining cybersecurity challenges of our time. Its impact stretches far beyond individual data breaches, influencing geopolitics and even raising questions about the trustworthiness of the information that shapes our decisions.
The Human Element – Cognitive Biases
Every social engineering technique, no matter how elaborate, targets fundamental weaknesses in human decision-making. These are known as cognitive biases—the mental shortcuts our brains take that can sometimes lead us astray. Attackers are experts at exploiting these predictable human tendencies.
Common Attack Methods
The Fake Help Desk
Imagine someone walking into an office building, posting a seemingly official notice about a new help desk number. Employees, needing assistance, call this number, only to be asked for their passwords and IDs by the imposter. In one swift move, company data is compromised—all without a single line of code being written by the attacker.
Building Trust Online
Another common tactic involves patiently building trust. An attacker might connect with a target on social media, striking up conversations and establishing rapport over weeks or even months. Once trust is established, the hacker can then subtly solicit sensitive information, like bank details or account passwords, making the victim a willing participant in their own compromise.
Pretexting
Pretexting, often called 'blagging' in the UK, involves crafting an entirely fabricated scenario to engage a victim. It's an elaborate lie, usually built on prior research to make it sound utterly convincing. The attacker might impersonate someone in authority, using personal details like a date of birth or last bill amount to establish credibility and trick the target into divulging information or taking specific actions.
Water Holing
Water holing is a cunning strategy that preys on a user's trust in familiar websites. Instead of sending malicious emails, the attacker compromises a legitimate website that their targets frequently visit. The victim, feeling safe on a trusted site, might click a link or download a file they'd otherwise avoid, falling right into the attacker's trap. This method has successfully breached even highly secure systems.
Baiting – The Digital Trojan Horse
Baiting leverages human curiosity or greed. Attackers leave malware-infected physical media—like USB drives, CDs, or even digital audio players—in public places. These 'road apples' are often labeled with tantalizing names like 'Employee Salaries' or 'Confidential,' knowing that someone's curiosity will lead them to plug the device into a computer, automatically compromising the system.
A 2016 study dramatically illustrated this, dropping 297 USB drives around the University of Illinois campus. An astonishing 98% of the drives were picked up, and 45% of them were plugged into computers, 'calling home' to the researchers. It's a stark reminder of how potent a simple, physical lure can be.
Quid Pro Quo
The 'quid pro quo' attack is straightforward: an attacker offers something in return for a favor. They might pose as an IT expert, offering free technical support, but 'require' login credentials to help. Or they might offer a small amount of money or sensitive information in exchange for a critical piece of data or action from the victim.
Scareware – Playing on Fear
Scareware bombards victims with alarming, fake messages, convincing them their system is infected with severe malware. Under pressure, victims are coerced into installing malicious remote login software, or even paying a ransom in cryptocurrency to supposedly 'fix' the non-existent problem. It's pure psychological warfare, exploiting fear and urgency.
Tailgating (Piggybacking)
Not all attacks are purely digital. Tailgating is a physical social engineering technique where an attacker, often pretending to be an employee, courier, or delivery person, slips into a restricted area by following an authorized individual. They might ask someone to 'hold the door' while their hands are 'full,' gaining unauthorized access to buildings or secure offices.
The Law Strikes Back – Legal Ramifications
In common law, pretexting—especially to gain private information—is recognized as an invasion of privacy. The legal system is constantly playing catch-up with the evolving methods of social engineering, but significant strides have been made to penalize these deceptive practices.
Protecting Personal Records
In the United States, obtaining telephone records through pretexting became a federal felony in 2007, carrying severe penalties. Similarly, the Gramm-Leach-Bliley Act of 1999 specifically targets pretexting of banking records, granting the Federal Trade Commission authority to prosecute unfair or deceptive business practices that exploit consumers' financial information.
The principle is clear: using false pretenses to acquire non-public information from a financial institution or directly from a consumer is illegal. However, a tricky loophole sometimes exists: while obtaining records through deception is outlawed, the sale of certain types of records, once obtained, can sometimes exist in a legal grey area, posing a continuous challenge for lawmakers.
Cracking Down on Record Brokers
The ease with which personal phone records could be bought online sparked outrage and legal action. States like Illinois led the charge, suing online record brokers, with other states quickly following suit. Wireless providers also filed their own lawsuits, and in 2006, Senator Charles Schumer introduced federal legislation to create felony criminal penalties for stealing and selling these records, aiming to close the existing loopholes.
The HP Scandal – Corporate Espionage
Even corporate giants aren't immune to the allure of social engineering. In 2006, Hewlett Packard Chairwoman Patricia Dunn admitted that the company hired private investigators who used pretexting to obtain the phone records of HP board members and journalists to uncover internal leaks. This incident highlighted the ethical and legal lines crossed, particularly under California law, which explicitly forbids such pretexting.
High-Profile Targets – Notable Incidents
Following the massive 2017 Equifax data breach, a legitimate help website was set up for victims. But within days, nearly 200 malicious look-alike domains popped up, ready to capitalize on people's fear and slight typing errors. This rapid deployment of fake sites showcased attackers' speed in exploiting public trust during a crisis.
Tech Giants Fall: Google and Facebook
In a remarkable case, two of the world's most technologically advanced companies, Google and Facebook, were defrauded of a staggering $100 million. A Lithuanian con artist impersonated a hardware supplier, sending false invoices over two years. Despite their vast resources, the companies initially paid the fraudulent bills, demonstrating that even the most sophisticated organizations can be tricked by clever social engineering.
Political Interference: The 2016 US Elections
During the 2016 U.S. Elections, Russian military intelligence launched a phishing campaign targeting Hillary Clinton's campaign staff. Disguised as Google security alerts, these emails tricked key members, including campaign chairman John Podesta, into revealing their passwords. This led to the leak of thousands of private emails and documents, profoundly impacting the political landscape.
Corporate Heists: Ubiquiti and Sony
Ubiquiti Networks, a Wi-Fi hardware maker, lost nearly $47 million in 2015 when attackers sent a phishing email to their accounting department, directing them to change payment account details. Similarly, in 2014, the 'Guardians of Peace' group used phishing to install malware at Sony Pictures Entertainment, leading to a massive leak of confidential emails and employee data.
Government Under Attack: DoL and RSA
Government agencies are also prime targets. In 2013, the U.S. Department of Labor's server was compromised in a watering hole attack, redirecting visitors to a site that installed malware designed to steal sensitive nuclear data. Another major incident in 2011 saw hackers infiltrate RSA, a cryptographic corporation, via phishing emails containing a zero-day exploit, ultimately compromising their SecurID two-factor authentication system.
The Minds Behind the Tricks – Notable Social Engineers
Behind every sophisticated social engineering attack, there's a human mind orchestrating the deception. Some individuals have become infamous for their mastery of this 'art,' shaping both the criminal landscape and our understanding of human vulnerability.
Pioneers and Innovators: Headley and Ridpath
Susan Headley, a figure in the early 'phreaking' scene with Kevin Mitnick, famously framed him after a falling out, showcasing the personal betrayals that can underpin these schemes. Mike Ridpath, a security consultant, became renowned for his cold-calling techniques, demonstrating live how he could extract passwords over the phone, revealing the power of persuasive conversation.
The Badir Brothers – A Unique Case
In the 1990s, Ramy, Muzher, and Shadde Badir—three brothers blind from birth—orchestrated an extensive phone and computer fraud scheme in Israel. Their remarkable ability to use social engineering, voice impersonation, and Braille-display computers to navigate and exploit systems demonstrates the diverse ways human ingenuity can be applied, for better or worse.
The Ethical Engineer: Chris Hadnagy
Not all social engineers operate on the dark side. Christopher J. Hadnagy is a prominent American social engineer and cybersecurity consultant who uses his knowledge for good. He's authored several books on the subject and founded the Innocent Lives Foundation, leveraging open-source intelligence and security expertise to help track and identify child traffickers, collaborating with law enforcement to make a positive impact.
Article
Social engineering (security)
In the context of information security, social engineering is the use of psychological pressure to influence people to perform actions or divulge confidential information. It has also been more broadly defined as "any act that influences a person to take an action that may or may not be in their best interests." A type of confidence trick for the purpose of information gathering, fraud, or system access, it differs from a traditional "con" in the sense that it is often one of many steps in a more complex fraud scheme.
Reports indicate through 2024, social engineering attacks have been increasing in intensity and numberprompting research into novel detection techniques and cybersecurity educational programs.
Research undertaken in 2020 has indicated that social engineering will be one of the most prominent challenges of the upcoming decade. The ability to thwart social engineering attacks will be increasingly important for organizations and countries. Social engineering raises the question of whether our decisions will be accurately informed if our primary information is engineered and biased.
Techniques and terms
Social engineering (security)
All social engineering techniques are based on exploitable weaknesses in human decision-making known as cognitive biases. Social engineering differs from psychological manipulation in that it doesn't need to be controlling, negative or a one-way transaction. Manipulation involves a zero-sum game where one party wins and the other loses while social engineering can be win-win for both parties.
An example of social engineering would be an attacker who walks into a building and posts an official-looking announcement to the company bulletin that says the telephone number for the help desk has changed. When employees call the false number for help, the individual asks them for their passwords and IDs, thereby gaining access to the company's private information. Another example of social engineering would be a hacker contacting the target on a social networking site and starting a conversation with them. Gradually, the hacker gains the trust of the target and then uses that trust to gain access to sensitive information like password or bank account details.
Pretexting
Pretexting (adj. pretextual), also known in the UK as blagging, is the act of creating and using an invented scenario (the pretext) to engage a targeted victim in a manner that increases the chance the victim will divulge information or perform actions that would be unlikely in ordinary circumstances. An elaborate lie, it most often involves some prior research or setup and the use of this information for impersonation (e.g., date of birth, Social Security number, last bill amount) to establish legitimacy in the mind of the target.
Water holing
Water holing is a targeted social engineering strategy that capitalizes on the trust users have in websites they regularly visit. The victim feels safe to do things they would not do in a different situation. A wary person might, for example, purposefully avoid clicking a link in an unsolicited email, but the same person would not hesitate to follow a link on a website they often visit. So, the attacker prepares a trap for the unwary prey at a favored watering hole. This strategy has been successfully used to gain access to some (supposedly) very secure systems.
Baiting
Baiting is a form of real-world Trojan horse that uses physical media and relies on the curiosity or greed of the victim. In this attack, attackers leave malware-infected floppy disks, CD-ROMs, or USB flash drives in locations people will find them (bathrooms, elevators, sidewalks, parking lots, etc.), give them legitimate and curiosity-piquing labels, and wait for victims.
Unless computer controls block infections, insertion compromises PCs "auto-running" media. Hostile devices can also be used. For instance, a "lucky winner" is sent a free digital audio player compromising any computer it is plugged to. A "road apple" (the colloquial term for horse manure, suggesting the device's undesirable nature) is any removable media with malicious software left in opportunistic or conspicuous places. It may be a CD, DVD, or USB flash drive, among other media. Curious people take it and plug it into a computer, infecting the host and any attached networks. Again, hackers may give them enticing labels, such as "Employee Salaries" or "Confidential".
One study published in 2016 had researchers drop 297 USB drives around the campus of the University of Illinois. The drives contained files on them that linked to webpages owned by the researchers. The researchers were able to see how many of the drives had files on them opened, but not how many were inserted into a computer without having a file opened. Of the 297 drives that were dropped, 290 (98%) of them were picked up and 135 (45%) of them "called home".
Ad phishing
Ad phishing is a social engineering technique in which malicious actors use online ads to deceive users into believing they are interacting with legitimate brands or services. According to Google, these deceptive ads often mimic trusted entities such as banks, software providers, or customer support pages, leading users to fraudulent sites that attempt to steal passwords, credit card information, or other sensitive data.
Quid Pro Quo
An attacker offers to provide sensitive information (e.g. login credentials) or pay some amount of money in exchange for a favor. The attacker may pose as an expert offering free IT help, whereby they need login credentials from the user.
Scareware
An example of a scareware popup
The victim is bombarded with multiple messages about fake threats and alerts, making them think that the system is infected with malware. Thus, attackers force them to install remote login software or other malicious software. Or directly extort a ransom, such as offering to send a certain amount of money in cryptocurrency in exchange for the safety of confidential videos that the criminal has, as he claims.
Tailgating (piggybacking)
An attacker pretends to be a company employee or other person with access rights in order to enter an office or other restricted area. Deception and social engineering tools are actively used. For example, the intruder pretends to be a courier or loader carrying something in his hands and asks an employee who is walking outside to hold the door, gaining access to the building.
Law (US)
Social engineering (security)
In common law, pretexting is an invasion of privacy tort of appropriation.
Pretexting of telephone records
In December 2006, United States Congress approved a Senate sponsored bill making the pretexting of telephone records a federal felony with fines of up to $250,000 and ten years in prison for individuals (or fines of up to $500,000 for companies). It was signed by President George W. Bush on 12 January 2007.
Federal legislation
The 1999 Gramm-Leach-Bliley Act (GLBA) is a U.S. Federal law that specifically addresses pretexting of banking records as an illegal act punishable under federal statutes. When a business entity such as a private investigator, SIU insurance investigator, or an adjuster conducts any type of deception, it falls under the authority of the Federal Trade Commission (FTC). This federal agency has the obligation and authority to ensure that consumers are not subjected to any unfair or deceptive business practices. US Federal Trade Commission Act, Section 5 of the FTCA states, in part: "Whenever the Commission shall have reason to believe that any such person, partnership, or corporation has been or is using any unfair method of competition or unfair or deceptive act or practice in or affecting commerce, and if it shall appear to the Commission that a proceeding by it in respect thereof would be to the interest of the public, it shall issue and serve upon such person, partnership, or corporation a complaint stating its charges in that respect."
The statute states that when someone obtains any personal, non-public information from a financial institution or the consumer, their action is subject to the statute. It relates to the consumer's relationship with the financial institution. For example, a pretexter using false pretenses either to get a consumer's address from the consumer's bank, or to get a consumer to disclose the name of their bank, would be covered. The determining principle is that pretexting only occurs when information is obtained through false pretenses.
While the sale of cell telephone records has gained significant media attention, and telecommunications records are the focus of the two bills currently before the United States Senate, many other types of private records are being bought and sold in the public market. Alongside many advertisements for cell phone records, wireline records and the records associated with calling cards are advertised. As individuals shift to VoIP telephones, it is safe to assume that those records will be offered for sale as well. Currently, it is legal to sell telephone records, but illegal to obtain them.
1st Source Information Specialists
U.S. Rep. Fred Upton (R-Kalamazoo, Michigan), chairman of the Energy and Commerce Subcommittee on Telecommunications and the Internet, expressed concern over the easy access to personal mobile phone records on the Internet during a House Energy & Commerce Committee hearing on "Phone Records For Sale: Why Aren't Phone Records Safe From Pretexting?" Illinois became the first state to sue an online records broker when Attorney General Lisa Madigan sued 1st Source Information Specialists, Inc. A spokeswoman for Madigan's office said. The Florida-based company operates several Web sites that sell mobile telephone records, according to a copy of the suit. The attorneys general of Florida and Missouri quickly followed Madigan's lead, filing suits respectively, against 1st Source Information Specialists and, in Missouri's case, one other records broker – First Data Solutions, Inc.
Several wireless providers, including T-Mobile, Verizon, and Cingular filed earlier lawsuits against records brokers, with Cingular winning an injunction against First Data Solutions and 1st Source Information Specialists. U.S. Senator Charles Schumer (D-New York) introduced legislation in February 2006 aimed at curbing the practice. The Consumer Telephone Records Protection Act of 2006 would create felony criminal penalties for stealing and selling the records of mobile phone, landline, and Voice over Internet Protocol (VoIP) subscribers.
Hewlett Packard
Patricia Dunn, former chairwoman of Hewlett Packard, reported that the HP board hired a private investigation company to look into who was responsible for leaks within the board. Dunn acknowledged that the company used the practice of pretexting to solicit the telephone records of board members and journalists. Chairman Dunn later apologized for this act and offered to step down from the board if it was desired by board members. Unlike Federal law, California law specifically forbids such pretexting. The four felony charges brought on Dunn were dismissed.
Notable social engineering incidents
2017 Equifax breach help websites
Following the 2017 Equifax data breach linked to China's People's Liberation Army in which over 150 million private records were leaked (including Social Security numbers, and drivers license numbers, birthdates, etc.), warnings were sent out regarding the dangers of impending security risks. In the day after the establishment of a legitimate help website (equifaxsecurity2017.com) dedicated to people potentially victimized by the breach, 194 malicious domains were reserved from small variations on the URL, capitalizing on the likelihood of people mistyping.
2017 Google and Facebook phishing emails
Two tech giants—Google and Facebook—were phished out of $100 million by a Lithuanian fraudster. He impersonated a hardware supplier to falsely invoice both companies over two years. Despite their technological sophistication, the companies lost the money, although they were later able to recoup the majority of the funds stolen.
2016 United States Elections leaks
During the 2016 United States Elections, hackers associated with Russian Military Intelligence (GRU) sent phishing emails directed to members of Hillary Clinton's campaign, disguised as a Google alert. Many members, including the chairman of the campaign, John Podesta, had entered their passwords thinking it would be reset, causing their personal information, and thousands of private emails and documents to be leaked. With this information, they hacked into other computers in the Democratic Congressional Campaign Committee, implanting malware in them, which caused their computer activities to be monitored and leaked.
2015 Ubiquiti Networks scam
In 2015, specialized Wi-Fi hardware and software maker Ubiquiti lost nearly $47 million to hackers. Attackers sent Ubiquiti's accounting department a phishing email from a Hong Kong branch with instructions to change payment account details. Upon discovering the theft, the company began cooperating with law enforcement, but was only able to recover $8 million of the stolen funds, although they had hoped for $15 million.
2014 Sony pictures leak
On 24 November 2014, the hacker group "Guardians of Peace" (probably linked to North Korea) leaked confidential data from the film studio Sony Pictures Entertainment. The data included emails, executive salaries, and employees' personal and family information. The phishers pretended to be high up employees to install malware on workers' computers.
2013 Department of Labor watering hole attack
In 2013, a U.S. Department of Labor server was hacked and used to host malware and redirect some visitors to a site using a zero-day Internet Explorer exploit to install a remote access trojan called Poison Ivy. Watering hole attacks were used, with the attackers creating pages related to toxic nuclear substances overseen by the Department of Energy. The targets were likely DoL and DOE employees with access to sensitive nuclear data.
2011 RSA SecurID phishing attack
In 2011, hackers broke into the сryptographic corporation RSA and obtained information about SecurID two-factor authentication fobs. Using this data, the hackers later tried to infiltrate the network of defense contractor Lockheed Martin. The hackers gained access to the key fob data by sending emails to four employees of the parent corporation from an alleged recruitment site. The emails contained an Excel attachment titled 2011 Recruitment Plan. The spreadsheet contained a zero-day Flash exploit that provided backdoor access to the work computers.
Notable social engineers
Susan Headley
Susan Headley became involved in phreaking with Kevin Mitnick in Los Angeles.
Mike Ridpath
Mike Ridpath is a security consultant, published author, speaker and previous member of w00w00. He is known for developing techniques and tactics for social engineering through cold calling. He became known for live demonstrations as well as playing recorded calls after talks where he explained his thought process on what he was doing to get passwords through the phone. As a child, Ridpath was connected with Badir Brothers and was known within the phreaking and hacking community for his articles with popular underground ezines, such as Phrack, B4B0 and 9x on modifying Oki 900s, blueboxing, satellite hacking and RCMAC.
Badir Brothers
Brothers Ramy, Muzher, and Shadde Badir—all of whom were blind from birth—set up an extensive phone and computer fraud scheme in Israel in the 1990s using social engineering, voice impersonation, and Braille-display computers.
Christopher J. Hadnagy
Christopher J. Hadnagy is an American social engineer and information technology security consultant. He has written several books on social engineering and cyber security.
Regulatory countermeasures
Social engineering (security)
Several regulatory frameworks address social engineering as a threat vector by mandating workforce training and technical controls.
The Health Insurance Portability and Accountability Act (HIPAA) Security Rule requires covered entities to implement a security awareness and training program for all members of their workforce, including training on procedures for guarding against, detecting, and reporting malicious software, as well as monitoring log-in attempts and reporting discrepancies (45 CFR 164.308(a)(5)). The U.S. Department of Health and Human Services has identified social engineering, particularly phishing, as the leading initial attack vector in healthcare data breaches reported under the HIPAA Breach Notification Rule. The December 2024 Notice of proposed rulemaking (NPRM) to overhaul the HIPAA Security Rule proposed strengthening anti-social-engineering defenses by requiring simulated phishing exercises, mandating multi-factor authentication for all access to electronic protected health information, and implementing technical controls to detect and block malicious communications.
The Payment Card Industry Data Security Standard (PCI DSS) requires organizations to implement a formal security awareness program that educates personnel about social engineering threats, including phishing and pretexting, upon hire and at least annually thereafter (Requirement 12.6).