Social Engineering: Common Methods, Examples, and Preventative Measures

Social engineering is a strategy that has invaded much of our world today. Around 98% of cyber-attacks rely on social engineering to get them their information. So how does social engineering work? Thieves and criminals attempt to use manipulation to trick individuals out of information, because it is easier to exploit a human’s ability to trust another than teaching themselves how to hack software. Knowing the techniques they use, how they use them, and how to prevent these attacks can come in handy.

Keep on reading to learn more about this sneaky strategy that many manipulators use. By the end, you should be much more prepared to take on one of these attacks if it should happen to you. With any luck, you will be able to avoid the many ways that a hacker may attempt to push themselves into your system.

Those who use the social engineering tactic have a lot of methods that they can choose from. The way they try to get information from people spans across all platforms, from text messages to websites. Practically every industry on the market has been breached in some way by social engineering.

There are six main methods that social engineers will use to pry information from people. Knowing these could help you from falling victim to an elaborate plan. You should become familiar with them as best as you can.

1. The Whaling Attack

The whaling attack centers its target on a very specific group of people. It’s a sophisticated attack that works against those who have special access to systems that tend to be at a higher level than others. Someone who might experience a whaling attack would have a large sum of money hidden behind an intricate system.

When conducting a whaling attack, the criminal will typically do the following things:

• Find a messaging platform that is often accessed by the user, such as an email
• Craft a compelling message that entices the viewer to click it
• Draw the user in and grab their information

Once the link or mail is clicked, that’s all that it takes. Most often, the message will seem urgent, and the user might want to respond immediately. It is critical to check where the item is coming from before following through.

2. The Watering Hole

The watering hole attack takes inspiration from the drinking spots where animals go to get hydrated for the day. Like this spot, the hacker will place harmful code on a popular website, targeting the types of people that they assume will visit that site. This leaves them vulnerable whenever they go to that particular site.

The attacker using this method will likely:

• Wait until a particular moment to use this attack
• Launch on a website or a software
• Be quick and efficient

The watering hole technique is used when these attackers want access to a specific group of people. It could be anyone, from entrepreneurs to financial advisors. This one is a little harder to prevent since you cannot see it coming.

3. The Pretexting Method

The pretexting method targets those who fall victim to others telling them that they need assistance. The attacker might message the victim to let them know that they need their personal information to fix a problem on one of their accounts. This can be done through messaging or calling.

Often, someone using the pretexting method will:

• Text without further notice, asking right away for information
• Use that information, should they get it, to access the victim’s accounts

The damage is done when the victim gives up all of their passwords and usernames to these attackers. If you do not give it to them, it is harder for them to get it. They rely on human nature to provide a helpful response in a time of uncertainly.

4. The Baiting Attack

The baiting attack is perhaps one of the most common forms of attack. Through this, a link disguised as being helpful is sent out to a victim to manipulate them. However, it often contains malicious and aggressive software that will do them harm.

Often, these attackers will send out the link through:

• Text messages
• A messaging platform on social media
• An email

These links are usually pretty obvious. However, some can be trickier than others. Any random link in an unexpected email should not be clicked for safety purposes. You could risk the entire security system of your computer or phone.

5. The Quid Pro Quo Attack

The quid pro quo attack is a lot like the baiting attack. However, there are a few things that set them apart from each other. This attack involves the baiter giving tasks to the victim, often pretending to be someone to help them with their device. These instructions will leave the device vulnerable for the attacker to swoop in.

This one is particularly tricky because the victim must perform the steps themselves. It is critical to avoid any instructions or advice that come from a source you are not anticipating. Being cautious can prevent your private information from slipping into the wrong hands.

6. The Phishing Attack

The phishing attack is seen most often. The phishing attack uses a variety of items to try to get a person’s attention. These often have emotional ties and pretend to be trustworthy individuals that the victim could trust. They also use companies and sources that seem legitimate to anyone who glances at them.

The individual using the phishing attack will:

• Take on an identity tied to the victim
• Send a message to get the victim’s attention with urgency
• Wait for the victim to click
• Gather their information

It’s all too easy for someone to fall victim to this trick. The phishing attack is especially dangerous because it targets people’s emotions. Emotions are a powerful thing, something that could take anyone down in an instant.

These malicious messages make up most cases of social engineering cyberattacks. Around 65% of these attacks utilize a form of phishing as the way that they gain access. The phishing attack is a simple way for hackers to claw their way into a system.

Examples of Social Engineering in Action

For many, it can be hard to understand this concept without putting it into action. We’ll dive into a few examples of social engineering, showing examples of attacks in specific locations where they might happen.

Not all attacks are created equal. Knowing what a few might look like can help you pick one out, no matter how different it looks from others that we have shown.

1. Examples of Whaling Attacks in Social Engineering

As the whaling attack is intended to target one particular type of person, there are very specific situations in which an act is carried out. We will go over a few examples to fully understand how this method of social engineering works.

The attacker essentially goes for the “whale” of a company, organization, or network. They will wait patiently and then will strike someone such as:

• A prominent hedge fund founder over a network like Zoom
• A small business owner through email
• A firm CEO over a cyberattack

All of these are examples of whaling attacks in action. The hacker will wait until the moment is right. Then, they spring on the leader and attempt to pull as much money and access as possible from the person they have attacked.

2. Examples of Watering Hole Attacks in Social Engineering

As we have discussed, a watering hole attack targets a group of people involved in the same kind of industry or profession. The attacker will probe the website for a weakness that could allow them to infiltrate the website and those that make use of it.

Some examples of watering hole attacks include:

• A hack of Forbes’s “Thought of the Day” bubble
• A malicious code entry into the U.S. Department of Labor

All these items targeted a website and those that visited it regularly. The attacks occurred once they had infiltrated the site and gained access to the hundreds of thousands of people who visited it every day.

3. Examples of the Pretexting Method in Social Engineering

Pretexting is the method of attack in which an attacker will contact an individual with an informational request. The individual will then respond with their personal information that the attacker can then use to gain access to more private information.

Pretexting can occur in a variety of formats. Some of them include:

• An attacker posing as the CEO of a company and requesting personal information from employees
• A social engineer acting as the leader of a bank and requesting personal information to assist a customer with an account
• Someone working as a customer assistance rep and requesting access to a certain account to help

The pretexting method can sneak up on people rather unexpectedly. If you receive a message requesting any personal information, it is critical to double-check the source. Pretexting can happen to anyone who is not paying attention.

Never give out your personal information through a text message or email. This is a rare way to exchange this kind of critical information about your life. Unless you have had a verbal, in-person agreement, you should not be handing yourself out on the internet. It doesn’t matter how trustworthy they seem to be in the space.

4. Examples of the Baiting Attack in Social Engineering

Often, a baiting attack happens in the real world. A criminal might leave a hard drive or a link that, when clicked or entered, will lead the victim straight to harmful malware. From there, the attacker can get what they want.

Baiting can also involve advertisement online. These can be tempting for a user to click, with enticing images and headlines. When the victim clicks, they download the malware onto their computer or phone.

Malware can take many forms, such as viruses, ransomware, spyware, spam, and more. The first step to avoid all types of malware is staying educated on how they happen, where they come from, and what they can change into. Read the blog post below to discover 6 ransomware trends you should watch for in 2021.

5. Examples of the Quid Pro Quo Attack in Social Engineering

A quid pro quo is a high-level format of attack. The hacker asks for access to a company or a large organization in a method that sounds simple, easy, and harmless. From there, they can take control and finish whatever they have set out to do.

A quid pro quo attack might involve:

• Someone offering assistance if an individual disables their security
• A free fix for the cost of some personal information

Both of these offer to give something away, but for the victim to receive that thing, they must also give something in return. It sounds too good to be true, and often that’s because it is.

6. Examples of the Phishing Attack in Social Engineering

The phishing attack is a format of aggressive baiting. There are many different subcategories of the act, but the main point of it is to get ahold of personal information that the victim hands out.

A phishing attack can happen:

• On a fake website
• Through a faulty link
• In an email or a mass text message

The phishing attack is the simplest, and yet it is also the most powerful. There is a large group of people who fall for this trick every single day.

Ways to Prevent Social Engineering

Standing up against social engineering is a critical part of existing in our society today. Everywhere, hackers make use of social engineering in an attempt to gain valuable information that could win them all of your money. How do you take a stand against such an aggressive and dangerous type of individual?

There are quite a few things that you can consider when trying to prevent social engineering from happening to you. Some of the best include:

• Staying cautious at all times, no matter how trustworthy the coerce seems to be
• Never giving out personal information unless you are confident of the situation that you are in
• Using services to keep track of who is calling you and double-checking phone numbers or emails that you are suspicious of
• Deleting requests for personal information before you can get involved
• Giving a second thought to everything before you click on it
• Ignoring offers and prizes, which are oftentimes fake when sent to you in a mailbox on the internet or in your physical mailbox

By staying on top of the game, you can prevent yourself and your assets from being corrupted by criminals using social engineering.

Are you concerned about the cybersecurity of your business? Edge Networks can help! Take our free, self-guided IT Security Risk Assessment, or contact us today for a free, 30-minute consultation.