Social engineering methods and means for obtaining information have been around for ages.
They seem like simple requests or benign coordinated events, but the truth is that social engineering often exploits your most valuable asset. Your users. A compromised user can then be used to wreak havoc or throw deeper hooks into the targeted network. Most network hacks are incremental in nature with an attack vector that often times leads to a compromised user, admin, or super user.
The easiest way to penetrate, hack, or otherwise take-over a network is to start with the company directory.
The simple example of a social engineering attack might be… ring ring, “hello, this is Joe with the helpdesk. I am working on xyz what is your password?” Social engineering methods are still the most prolific way for attackers to get deep within a network and allow attackers to simply go under the radar while they wreak havoc or steal sensitive data.
A recent spear fishing attack on a US aerospace company leveraged the company directory and intricate email spoofing. The attacker started a conversation from an email that looked like aerospacecompany.com’s email domain. In other words the attacker had the name of a person in the organization with a valid email address and job title, and then registered aerospacecompanyUS.com, a similar looking email domain, to send users targeted malware. They used the company directory and email domain to go deep and got a susceptible IT staff member to open a link and unknowingly involved in the attack. Ultimately the attacker was able to get admin access to critical systems on the network.
It is important to maintain a user awareness and training posture for your organization. Users and stakeholders need to be constantly reminded of internet and email etiquette as well as not to click on un-trusted links. Your network cannot rely solely on technical measures to keep bad people out. Even with anti-virus, anti-malware, updated browsers, and pop-up blockers a social engineering attack takes people and awareness to thwart.
