Social Engineering

tag: [Security Specialist, Operations & Strategy]

Social engineering is the use of deception to manipulate individuals into divulging confidential or personal information. This is one of the easiest and most effective ways to obtain access to your project.

Common Social Engineering Techniques

1. Phishing

• Email Phishing: Fraudulent emails that appear to be from reputable sources, often containing malicious links or attachments.
• Spear Phishing: Targeted phishing attacks tailored to specific individuals or organizations.

2. Pretexting

• False Pretenses: Attackers create a fabricated scenario to steal personal information.
• Impersonation: Pretending to be someone in authority or a trusted individual to gain access to sensitive information.

3. Baiting

• Physical Baiting: Leaving infected USB drives or other devices in public places to lure victims into using them.
• Online Baiting: Offering free downloads or deals that contain malware or is used to obtain access to accounts.

4. Tailgating

• Physical Security Breach: Following authorized personnel into restricted areas without proper credentials.

5. Shoulder Surfing

-Information Leakage: A threat actor could be monitoring your screen in a shared co-working space, to understand what you're working on and use the information to gain unauthorized access.

Users should be particularly vigilant in co-working spaces, as well as be aware of the presence of cameras or other recording devices that could capture sensitive information. Always position your screen away from prying eyes and use privacy screens if necessary.

Preventive Measures

1. Education and Awareness

It could prove valuable to conduct regular training sessions on recognizing and responding to social engineering attacks, and stay up to date on the current trends in web2 and web3. For example, right now it's getting increasingly common that threat actors are pretending to provide jobs, and ask applicants to run malicious projects that create backdoors on the applicant's computer.

2. Verification

• Double-Check Requests: Always verify the identity of individuals requesting sensitive information, especially if the request is unusual or urgent.
• Use Secure Channels: Communicate through official channels and avoid sharing sensitive information over unsecured methods.

3. Security

• Access Control: Implement strict access control measures, preferably requiring confirmations by multiple people before critical actions can be taken.
• Report Suspicious Activity: Encourage team members to report any suspicious behavior or requests immediately.