Social Engineering Attacks

While many cybersecurity professionals focus on implementing security appliances and solutions to prevent cyberattacks and threats, sometimes they lack focus on protecting the minds of employees. The human mind does not have cybersecurity solutions to protect it from psychological manipulation, and this creates the most vulnerable aspect within any organization. Threat actors and penetration testers often trick employees into performing an action or revealing confidential information that assists in performing a cyberattack and compromising an organization.

During this chapter, you will learn the fundamentals and key concepts that are used by ethical hackers and penetration testers during their offensive security exercises to trick and manipulate their targets into revealing sensitive information and even performing a task. You will also discover the characteristics of various types of social engineering attacks and how to develop an awareness of defending...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following software requirements:

• Kali Linux – https://www.kali.org/get-kali/
• An Alfa AWUS036NHA High Gain Wireless B/G/N USB adapter – https://www.alfa.com.tw/products/awus036nha

Fundamentals of social engineering

Organizations invest a lot into their cybersecurity solutions, from security appliances to applications, and developing cybersecurity teams of professionals to defend and safeguard the assets that are owned by the company. Threat actors have realized many organizations are already implementing the defense-in-depth approach, which provides a multi-layered approach to implementing security solutions to reduce the attack surface of the organization and its assets. With a defense-in-depth approach, organizations do not rely on a single layer of protection, whether it’s using a next-generation firewall (NGFW) to filter network traffic between their internal network and the internet or even using endpoint detection and response (EDR) to mitigate threats on host systems.

Using a multi-layered approach ensures an organization has security solutions to protect their wireless networks, web-based traffic, and email-based traffic, actively monitoring...

Types of social engineering

While social engineering focuses on psychologically hacking the human mind, there are various types of social engineering attacks, such as traditional human-based, computer-based, and even mobile-based attacks. During this section, you will discover the fundamentals and characteristics of each type of social engineering attack.

Human-based social engineering

In human-based social engineering, the threat actor or penetration tester usually pretends to be someone with authority, such as a person who is important within the organization. This means the threat actor can attempt to impersonate a director or senior member of staff and request a password change on the victim’s user account.

An easy form of impersonation that usually gets a user to trust you quickly is posing as technical support. Imagine calling an employee while you’re pretending to be an IT person from the organization’s helpdesk team and requesting the user...

Planning for each type of social engineering attack

The primary objective of a social engineering attack is to either obtain confidential information from the victim or manipulate them into performing an action to help you compromise the target system or organization. However, to get started with any type of attack, a lot of research through passive reconnaissance must be done to find out how the target functions; as an aspiring penetration tester, you need to find answers to questions, such as the following:

• Does the target organization outsource its IT services?
• Does the target have a help desk?
• Who are the high-profile employees?
• What is the email address format used by the organization?
• What are the email addresses of the employees?

In addition to conducting research, when performing social engineering, you must be able to strategize quickly and read the victim’s emotions regarding how they react to you.

As a penetration tester...

Defending against social engineering

Defending against a social engineering attack is really important to any organization. While many organizations implement cybersecurity awareness training, it’s not always performed frequently to ensure employees are aware of the latest cyberattacks and threats. Cybersecurity user awareness training should be done each month to ensure all employees develop a critical-thinking mindset to identify and flag various types of social engineering attacks.

The following are additional techniques to help defend against social engineering attacks:

• Threat actors use methods such as impersonation and tailgating (following someone into a secure area) to gain entry to an organization’s compound. To prevent such attacks, organizations should implement ID badges for all members of staff, token-based or biometric systems for authentication, and continuous employee and security guard training for security awareness.
• Sometimes,...

Exploring social engineering tools and techniques

In this section, you will explore how to perform various types of social engineering attacks using an open-source application known as the Social Engineering Toolkit (SET) within Kali Linux. You will learn how to create a phishing website to perform credential harvesting and generate a malicious payload that can be placed on a USB flash drive or an optical disk.

All the techniques used in the following sections are to demonstrate a proof of concept strictly for educational purposes only. Do not use such techniques and tools for illegal purposes.

Creating infectious media

A method for tricking a victim is creating infectious media, which is any pluggable media storage device that contains malware created by a threat actor to compromise the targeted system. For instance, a USB flash drive with an auto-executable payload will run automatically when the USB device is connected to a computer. Quite often, humans...

Summary

During the course of this chapter, you have learned the fundamentals and key concepts of social engineering and how penetration testers can hack the human mind to obtain sensitive information. Furthermore, you have discovered various types of social engineering attacks and have explored various techniques to mitigate such types of threats. Lastly, you have explored various features of the SET on Kali Linux to assist you in setting up various types of social engineering attacks and even using Wifiphisher to create a rogue wireless network to trick users into revealing their wireless network passwords.

I trust that the knowledge presented in this chapter has provided you with valuable insights, supporting your path toward becoming an ethical hacker and penetration tester in the dynamic field of cybersecurity. May this newfound understanding empower you in your journey, allowing you to navigate the industry with confidence and make a significant impact. In the next chapter...

Further reading

• MITRE Phishing for Information – https://attack.mitre.org/techniques/T1598/
• Social Engineering – https://www.imperva.com/learn/application-security/social-engineering-attack/
• Avoiding Social Engineering and Phishing Attacks – https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks

Join our community on Discord

Join our community’s Discord space for discussions with the author and other readers:

https://packt.link/SecNet