November 23, 2015
Social engineering is a non-technical method of attack in which the hacker attempts to convince users to break normal security practices. The type of information generally sought by hackers includes bank account information, password, credit card details etc. Certain social engineering attacks also involve sending malware-laden email attachments to gain control over the user’s computer.
Types Of Social Engineering Attacks
- Phishing: This is probably the most common form of social engineering attack. The hacker sends an e-mail, IM or text message that appears to be coming from a legitimate and credible institution, company, bank etc. A phishing scam is carried out to obtain a user’s personal information such as name, address, social security number, bank account details etc.
- Pretexting: In this, the attacker creates a plausible backstory to gain access to confidential information. For instance, the user may receive a call or email claiming to be from a bank and asking about his credit card details or account number to verify identity.
- Baiting: These attacks are often presented in the form of attractive offers and schemes to the users once they enter their login credentials. People who fall a prey to the bait may infect their computer system with malicious software, leak out the financial information stored on the computer and generate new malware exploits.
- Quid Pro Quo: This attack may involve an attacker who spam calls people and claims to be from an IT company. The user may be asked to disable his anti-virus program in exchange for a quick fix for his computer issue. Subsequently, the attacker may install a malware on the system in the guise of a software update.
- Tailgating: This involves an attacker getting access to a restricted area of an organization through an authorized employee. Tailgating may also be carried out by borrowing someone’s computer or laptop for some work but actually installing malicious software.
Tips To Prevent Social Engineering Attacks
- Beware of unsolicited IMs, emails or phone calls
- Keep your anti-virus software updated
- Do not give out your personal information, such as user name, password, credit card number, social security number etc. to anyone
- Ignore phone calls or emails asking for financial information or passwords
- Do not download attachments or open embedded links from unknown senders
- Check website URLs before opening
- Reject requests for online tech support
- Lock your laptop or computer while leaving your workstation
- Use two factor authentication to log in to all your online accounts
For more information on preventing social engineering attacks, contact Centex Technologies at (972) 375 – 9654.