Types of Social Engineering Attacks - Institute of Technology and Management Lucknow

These are the types of Social Engineering Attacks

 1. phishing

Phishing is a social engineering technique in which an attacker sends fraudulent emails that pretend to come from a reputable and trusted source. For example, a social engineer might send an email that appears to be from a customer service representative at your bank. He claims to have important information about your account, but asks you to first provide your full name, date of birth, Social Security number, and account number so he can verify your identity. In the end, the person who sends you an email is not a bank employee, but a person who tries to steal private data. 

Spear phishing is a form of targeted email phishing. In a spear phishing attack, the social engineer has done his research and targeted a specific user. By scouring the target's public social media profiles and using Google to search for information about them, the attacker can launch a convincing, targeted attack. Imagine a person regularly posts on social media that they are a member of a particular gym. In this case, the attacker could create a spear phishing email that appears to be from their local gym. The victim is more likely to fall for the scam because they recognize their gym as the supposed sender.

2. vishing and smishing

While phishing describes fraudulent email practices, similar manipulative techniques are also used in other communication methods such as phone calls and text messages. 

Vishing (short for voice phishing) occurs when a fraudster attempts to trick a victim into revealing sensitive information or granting access to the victim's computer over the phone. A popular vishing scam involves the attacker calling victims and pretending to be from IRS. The caller often tries to threaten or intimidate victims into giving him personal information or compensation. Vishing scams like this often target the elderly, but anyone can fall for a vishing scam if they are not properly trained. 

3. pretexting

Pretexting is a type of social engineering technique in which the attacker creates a scenario in which the victim feels compelled to act under false pretenses. Usually, the attacker pretends to be someone in a position of influence to persuade the victim to follow his instructions. 

In this type of social engineering attack, an attacker may pose as a police officer, a higher-level employee in the company, an auditor, an investigator, or any other person he believes will help him get the information he wants. 

4. bait

Baiting involves putting something enticing or curious in front of the victim to lure them into the social engineering trap. A baiter might offer a free music download or a gift certificate to trick the user into entering their credentials. 

A social engineer might give away free USB drives to users at a conference. The user might think they are just getting a free storage device, but the attacker might have loaded it with remote access malware that infects the computer as soon as it is plugged in. 

5. tailgating and piggybacking traffic 

Tailgating is a simple social engineering attack used to gain physical access to an unauthorized location. Tailgating is achieved by following an authorized user into the area without being noticed by the user. An attacker can chase after another person by quickly sticking their foot or another object into the door before it is fully closed and locked. 

Piggybacking is very similar to tailgating. The main difference between the two is that in the piggybacking scenario, the authorized user knows that the other person is allowed to "piggyback" his credentials. An authorized user may feel compelled to hold open a security door as a courtesy to a woman who appears to be carrying heavy boxes, or to a person posing as a new employee who has forgotten her access credentials.