- [Craig] In this video, we look at the concept of social engineering.
(uplifting piano jingle)
So social engineering is the art of manipulating people so they give up confidential information.
There are many, many forms of social engineering.
The four you need to know about for the exam
are blagging and pretexting, phishing, baiting and quid pro quo.
We'll go through each of those now.
So the first technique is called blagging, sometimes referred to as pretexting.
And this really is quite simple.
It's the act of creating and using an invented scenario to engage a targeted victim in a manner
that increases the chance the victim will divulge information or perform actions
which would be unlikely in ordinary circumstances.
This can be done really simply over the phone.
For example, you receive a phone call from someone supposing to be from your bank.
They may have managed to previously collect a certain amount of information about you.
Maybe they know some personal details, your name, your bank account number.
They know your address.
The phone call sounds very convincing.
As the phone call progresses,
you become more and more convinced
that you are actually speaking to a legitimate person from your bank.
During the phone call, they start to ask questions that get you to divulge information
which you shouldn't be giving over the phone.
It's a sad fact of life that a lot of elderly people are sometimes targeted
by this sort of social engineering threat.
Some of them are typically much less comfortable with technology and are more trusting.
There are several ways to help prevent blagging.
Methods used to obtain information can be very convincing.
We can train people on how to spot blagging attempts
and teach people what sort of questions they should be asking.
Quite often, people simply lack the appropriate knowledge.
The next technique is known as phishing, spelt with a P-H.
This is the concept of sending emails which are supposedly meant to be from reputable companies.
The emails are designed to induce people to reveal personal information,
much like blagging was over the concept of a phone call.
Again, people can often receive emails,
and you may have received some like this,
that tell you there's a mistake with your bank account,
that your bank account has been locked
and you must take immediate action to unlock it.
There'll often be a link provided to click here.
This can take you to a web page that looks like your bank's web page.
However, if you check carefully,
you often discover that the web address is not your bank's web address.
Without checking, you could start to log in to your bank account.
And of course, you are providing the hacker here with personal information.
There are some good ways of spotting phishing emails.
Quite typically, they are generic and they're not named personally.
The email address they come from can look unusual,
and sometimes the spelling and grammar is far from perfect.
So now let's look at baiting.
This is the promise of cash or goods that people with malicious intent use to entice victims.
For example, offering free music or movie downloads
to trick users into revealing their login credentials.
Baiting attacks are not restricted just to online scams.
Attackers also focus on exploiting our curiosity of physical media.
In July 2018, KrebsOnSecurity reported an attack campaign
targeting government agencies throughout the US.
The perpetrators sent out Chinese-postmarked envelopes containing a letter and a CD.
The aim was to pique recipients' curiosity so they would load the CD
and inadvertently infect their computers with malware.
The final social engineering threat is known as quid pro quo.
Now it's very similar to baiting,
except the benefit is usually in the form of a service as opposed to cash or goods.
Quid pro quo literally means offering you something for something.
And quid pro quo attacks promise a benefit in exchange for information.
For example, here we see a typical quid pro quo threat on the internet.
It's fake.
It's a message that's popped up and is claiming that your computer seems to be infected.
But don't worry, we can fix that for you right away.
You'd connect with someone, provide them with certain details,
and you believe you're getting a service in exchange.
On the screen is a summary of the social engineering threats we've covered.
Pause the video and take some notes.
(uplifting piano jingle)