Beware of Being Played With

The previous topics are related to some of the most common password reset questions. When the particular answers to these questions are readily available on the Internet, they can be easily found by a social engineer targeting you. What happens next is that they will try to use phishing against you to deploy ransomware on your computer, among other possibilities. But you wouldn't notice until it's too late.

In this post, we will expand on a previous entry about how social engineering works. We'll see why it is effective and how to prevent being scammed.

Social engineering can be defined as "a technique that uses psychological manipulation […​] to force people to disclose private personal or corporate information, or take a particular action." As explained in a previous post, an attack, ethical or not, has to be planned first with an exploration mindset. As investigator and author Joe Gray says, "Rarely will an effective social engineering attack happen without an informed understanding of the target." Gray is an expert in gathering Open Source Intelligence (OSINT), which is information taken from publicly available sources and used in the intelligence context. Gray explains that intelligence means that each piece of information is gathered on the basis of how it furthers the investigation.

In one talk, Gray said that most OSINT operations start with a single piece of information: "A business, a name, an email address, physical address, phone number, meta data." This is further matched with social media accounts, blogs, websites even leaked information in password dumps. (Talking about dumps: They may even search your garbage! That is a thing called Dumpster Diving.) While gathering OSINT of a company, Gray likes to check the Securities and Exchange Commission (SEC) files. These files allow him to "find out how the business is doing, find out some of the things the business has been struggling with, or what the business is looking out for in the future."

Social engineers' techniques are often analyzed using the principles of influence proposed by psychologist Robert Cialdini in his book Influence: The Psychology of Persuasion. Here are some brief descriptions of social engineers' actions appealing to Cialdini's principles and the reasons why they make people talk:

You may think: "Certainly some people are more sensible than others? Not everyone is as easily influenced?" Well, there may be some people who are more vulnerable to some of the weapons mentioned above. A recent review article, published in the journal Cybersecurity, lists some traits that make some people easier to manipulate.

According to the review, people who are more agreeable, meaning they tend to cooperate more, are more vulnerable to the scammer's likability, use of authority and social proof, and demand for reciprocity. The authors argue that these people would be more susceptible to fall for phishing and to share passwords. Those who are more conscientious, meaning they are organized and hardworking, may also fall for the use of authority and reciprocity, and yield to the pressure to maintain consistency. Finally, those who are more extraverted would react more promptly to the scarcity of time.

But it is argued that some traits may protect against the influence of social engineers. The authors suggest that neuroticism, that is, higher proneness to experience situations as distressing, indicates lesser vulnerability to the weapons of influence. Furthermore, they suggest that people who are more open to new experiences, being also probably more tech-savvy, are not open to being manipulated by social engineers.

We already listed some tips on how to prevent social engineers' most favorite scams here and here. In short, look out for generic email subjects, awful spelling and grammar, and emails or calls prompting life or death decisions. They are all fishy.

Let's add to the list some of the tips provided by the United States Computer Emergency Readiness Team (US-CERT):