Social engineering is a cunning attack method that exploits human psychology to trick people into revealing sensitive information, taking unwanted actions or installing malicious software.
When an Attacker Meets Psychology
The Psychology Behind Social Engineering
Social engineering is based on a deep understanding of human psychology and on exploiting emotions, behavioral tendencies and human cognition.
Here are some of the key psychological principles behind it:
- Confirmation bias: People tend to seek out information that supports their existing beliefs and filter out information that contradicts them.
- Anchoring bias: People tend to rely too heavily on the first piece of information they receive when making a decision.
- Availability bias: People tend to give more weight to things that are readily available to them.
- Herd bias: People tend to make decisions based on what others are doing.
- Fear and guilt: People are more likely to act when they feel fear or guilt.
Use of manipulative techniques:
Social engineering uses many manipulative techniques to trick people into doing what the attacker wants.
Here are some of the most common techniques:
- Building trust: Impersonating a legitimate party or creating a sense of connection.
- Creating urgency: Pressuring the victim to act immediately.
- Playing on emotions: Triggering emotions such as fear, guilt, compassion or curiosity.
- Presenting partial information: Hiding important information from the victim.
- Presenting a false choice: Offering two options, both of which serve the attacker.
Social engineering is very widespread because it is a highly effective way to obtain information and gain access to systems.
People who use social engineering can include:
- Cybercriminals: Thieves, hackers, spies.
- Fraudsters: Con artists, impersonators.
- Governments: Intelligence agencies and units.
- Private individuals: Jealous partners, business competitors.
What is the goal?
The goal is to steal personal information, payment details, passwords, access to computer systems and more.
Common types:
- Phishing: Impersonating a legitimate organization (such as a bank or credit card company) via email, text messages or phone calls, in order to get the victim to take a desired action (such as clicking a malicious link).
- Spoofed websites: Creating a fake website that resembles a legitimate one, in order to get the victim to enter their login credentials.
- Tech support scams: Impersonating a computer technician in order to get the victim to install malicious software.
- Scareware attacks: Creating a sense of urgency or pressure in the victim, exploiting emotions such as fear or guilt, so that they act without thinking first.
Where can it catch us?
- Anywhere: At home, at work, on social networks, even over the phone.
- Examples: Receiving a text message from "your mobile carrier" with a link "to pay your bill," or receiving an email from "the bank" asking you to update your identification details.
How do you protect yourself?
- Awareness: It is important to be aware of the danger and of the different types of social engineering.
- Skepticism: Don't automatically believe everything you see or hear.
- Verification: Confirm the sender's identity before taking any action.
- Technological protection: Use antivirus software and a firewall.
- Strong passwords: Use a different password for each account, and make sure they are not easy to guess.
- Reporting: Report suspicious incidents to the appropriate authorities.
Recommendations:
- Use common sense: Don't click suspicious links, don't give out personal details over the phone, and don't install software from unknown sources.
- Be careful on social networks: Don't share too much personal information, and don't accept friend requests from people you don't know.
- Keep up with security updates: Make sure your operating system and software are updated to the latest versions.
- Spread the word: Share this information with friends and family.
Social engineering is a constant threat, but awareness, skepticism and taking precautions can protect you from attacks.
Additional resources:
- Israel National Cyber Directorate: https://www.gov.il/he/departments/publications/reports/social_engineering
- Israel Police: https://www.gov.il/he/departments/guides/police_cybercrime_social_engineering