Social Engineering Attacks: Tricks That Hack Humans

“Congrats! You won the lottery”. In this digitally advanced era, we all must have received such calls, some of us might even have believed the same and lost our sensitive information to the hackers.

Social engineering is the art of manipulating and deceiving the victim to gain control over a computer system or gain access to sensitive information. This is a common practice these days. With advancing technology, hackers these days use several tactics to play with the emotions of common people by sending fake emails and generating false links and OTPs. This paves the way to gain access to your bank details and many other personal data. Social engineering is often referred to as ‘Hacking Humans’ because it is not just technical hacking, it is a psychological attack on the human brain to deceive them.

Techniques of Social Engineering

Hackers can invade your privacy just by making phone calls, sending an e-mail, an SMS, or stalking your social media accounts. Here are some common social engineering techniques:

1. Phishing: Sending fake emails or creating false websites to steal credentials. 
2. Vishing:  Hackers make fake calls to trap the victims. 
3. Smishing: Phishing using SMS. 
4. Pretexting: Impersonating your relative or creating a fake scenario to deceive people. 
5. Baiting: Offering something tempting to trick the targets. For example, Infected USBs for people to pick up. 
6. Tailgating: Following someone into a secure place without permission and for example, pretending to be a delivery worker to know your address. 

Case Study: The infamous Twitter 2020 attack

On 15 JULY 2020, a cyberattack shook the world when over $100,000 bitcoins were collected by scammers using social engineering. 

The Incident:

Accounts of high-profile people like (Elon Musk, Barack Obama, Apple, Bill Gates, and Uber) were hacked and used for fake Bitcoin giveaway messages.  

How it happened:

The hackers pretended to be from IT support through phone-based social engineering, gaining access to internal tools. After gaining employees’ trust, they tricked them into giving login credentials. In this way, they were able to reset passwords and hack their accounts to tweet publicly.  

The Consequences:

1. Over $100,000 bitcoins were collected by scammers. 
2. The trust in Twitter’s internal security was shattered. 
3. Several accounts were disabled. 

How Social Engineers trick you?

Hackers these days use social engineering to play with your mind by triggering various emotions like: 

1. FEAR: Hackers often create a panic or fearful situation for you through urgent messages. 
2. CURIOSITY: They create such situations like “You have won a prize!” and ask you to click on links to get them. 
3. AUTHORITY: Pretending to be HR or boss (the 2019 deepfake CEO scam). 
4. HELPFULNESS: They ask for your help so that they empathize with you. 

Warning signs for you

1. Any unusual or unknown sender or request.  
2. Request for your confidential data like bank details, account passwords, OTPs, etc. 
3. Urgent, panic, or emotional language. 
4. Unexpected winnings, prizes, and opportunities that seem unrealistic are a danger sign. 
5. Verify that the name, email address and phone number match the country of origin. (Many fraudulent calls are from phone numbers of different countries). 
6. Emails or messages with spelling mistakes or grammatical errors are clear warning. 
7. Any Request to install any app or software that seems unauthorized or from unverified sources. 
8. Social engineering ploys like posing as a government authority or a colleague asking for a Favor or confidential data.

Prevention is the best cure

1. Don’t click on any suspicious links. 
2. Always cross–verify requests from unknown sender. 
3. Always use strong and unique passwords. 
4. Use two–factor authentication.
5. Keep updating your devices and software regularly as it helps fix data vulnerabilities that are attacked by hackers. 
6. Use a VPN if you need to use Public Wi-Fi for accessing your personal or financial information. 
7. Report any suspicious activity immediately to the police, bank, or cybersecurity authorities. 
8. Never plug in unknown devices like a USB picked from a public place as it may contain malware.

Conclusion

Social engineering attacks are increasing these days because people are easier to trick than systems. Especially people who are less digitally aware are the soft targets of such hackers so awareness is the best defense against such cyberattacks.