CCT: Social Engineering Attacks

Social engineering is the art of convincing people to reveal confidential information or perform actions that compromise security. It succeeds because people are often unaware of the value of the information they hold and are careless about protecting it.

Unlike technical attacks that exploit software vulnerabilities, social engineering exploits the most unpredictable element in any security system: human behavior.

The attacker does not break through the wall — they convince someone to open the door.

Social engineers exploit fundamental human traits:

Human Weaknesses Exploited
├── Trust         --> "I'm from IT, I need your password to fix the issue"
├── Authority     --> "This is the CEO, I need this done immediately"
├── Fear          --> "Your account will be suspended unless you verify now"
├── Urgency       --> "We need this resolved in the next 10 minutes"
├── Curiosity     --> "You have a pending package, click here to track it"
└── Reciprocity   --> "I helped you last week, now I need a small favor"

Phishing

Phishing involves sending illegitimate emails that appear to come from a legitimate source, in an attempt to acquire user credentials, personal information, or deploy malware.

Phishing is one of the most scalable and effective attack methods because it requires no technical vulnerability — only a convincing message.

Phishing variants:

Variant	Description
Spear Phishing	Targets a specific user or group; email appears to originate from a trusted source
Whaling	Targets company executives specifically to gain access to high-value sensitive data
Vishing	Voice-based phishing using telephone systems or VoIP to extract sensitive information
Smishing	SMS-based phishing that tricks users via text messages
Business Email Compromise (BEC)	Impersonates a known source (often a CEO or vendor) to make seemingly legitimate financial requests

Credential Harvesting

Credential harvesting combines multiple techniques to steal authentication credentials at scale. Attackers use phishing campaigns, password dumping tools, and MITM attacks to perform credential stuffing — using stolen credentials across multiple platforms.

Stolen credentials are also sold on dark web marketplaces, enabling other attackers to purchase and reuse them.

Typosquatting

Typosquatting involves registering domain names with intentional misspellings of well-known websites (e.g., g00gle.com, faceb00k.com). When a victim types a misspelled URL, the browser loads the attacker's malicious website, where the victim may enter sensitive information.

Vishing

Vishing (voice phishing) uses telephone systems, VoIP services, or automated calls to impersonate legitimate organizations — banks, government agencies, or IT support — to extract sensitive information from victims.

Eavesdropping

Eavesdropping is the unauthorized interception of private communications including:

Audio conversations
Video calls
Written messages and emails
Network traffic

Unlike active attacks, eavesdropping is passive and difficult to detect.

Shoulder Surfing

Shoulder surfing is the direct observation technique of looking over someone's shoulder to obtain sensitive information such as:

Passwords and PINs
Account numbers
Confidential data displayed on screens

This attack is especially effective in public places like cafes, airports, and open offices.

Dumpster Diving

Dumpster diving involves searching through an organization's discarded materials — printed documents, storage media, sticky notes, and other physical trash — to find information useful for an attack.

Organizations that fail to shred sensitive documents before disposal create significant exposure through this low-tech technique.

In reverse social engineering, the attacker presents themselves as an authority figure. Instead of the attacker extracting information directly, the target is manipulated into seeking the attacker's help — and willingly offering the information the attacker needs in the process.

Piggybacking

Piggybacking occurs when an authorized person intentionally or unintentionally allows an unauthorized person to pass through a secured access point. Example: "I forgot my ID badge at home — could you let me in?"

Tailgating

Tailgating is similar to piggybacking but without the authorized person's cooperation. The attacker follows closely behind an authorized person through a door that requires key access — often wearing a fake ID badge or carrying items that make them appear to belong.

Legitimate Employee                Attacker
       |                              |
  Badged in -->                       |
  [Door unlocks]                      |
       |                              |
  Walks through <-- Follows closely --+

Hoax Emails

Hoax letters are emails that issue warnings about new viruses, Trojans, or worms that may harm the user's system. They create panic and may cause users to take harmful actions (like disabling security software) based on false information.

Spam Emails

Spam consists of irrelevant, unwanted, and unsolicited emails designed to collect:

Financial information
Social security numbers
Network credentials

Spam is both a delivery mechanism for phishing and a way to directly elicit sensitive information.

Attackers use chat platforms to gather personal information through seemingly casual conversations. Common targets: birth dates, maiden names, employer details, and security question answers.

Elicitation

Elicitation is a technique of extracting information from a victim by drawing them into normal and disarming conversations. The victim does not realize they are being pumped for intelligence because the conversation appears harmless.

Identity Theft

Identity theft is the use of stolen personal information (name, social security number, financial data, credentials) to impersonate a victim for financial gain, fraudulent access, or further attacks.

Social engineering is one of the primary collection methods for identity theft.

Social engineering is one of the hardest attacks to defend against technically because it targets people, not systems. Effective defenses include:

Security awareness training for all staff
Clear procedures for verifying identity before granting access
Multi-factor authentication to limit the value of stolen credentials
Physical access controls including badge verification and visitor management
Policies for destroying sensitive documents before disposal
Incident reporting culture so employees feel safe reporting suspicious interactions

The goal is to make employees the strongest link in the security chain — not the weakest.

What is Social Engineering?

Why Social Engineering Works