Background: social engineering and impersonation

In the context of information security, social engineering is the use of psychological pressure to influence people to perform actions or divulge confidential information. It has also been more broadly defined as "any act that influences a person to take an action that may or may not be in their best interests." A type of confidence trick for the purpose of information gathering, fraud, or system access, it differs from a traditional "con" in the sense that it is often one of many steps in a more complex fraud scheme. Phishing is a type of social engineering.

Researchers have developed detection techniques and cybersecurity educational programs.

Researchers in 2019 and 2020 said that social engineering was an increasingly important challenge for organizations and countries. Reports indicated that through 2024, social engineering attacks had increased in intensity and number.^([vague])

Techniques and terms

Social engineering techniques are based on weaknesses in human decision-making known as cognitive biases. Social engineering is a form of psychological manipulation.

An example of social engineering would be an attacker who walks into a building and posts an official-looking announcement to the company bulletin that says the telephone number for the help desk has changed. When employees call the false number for help, the individual asks them for their passwords and IDs, thereby gaining access to the company's private information. Another example of social engineering would be a hacker contacting the target on a social networking site and starting a conversation with them.

Gradually, the hacker gains the trust of the target and then uses that trust to gain access to sensitive information like passwords or bank account details.

Pretexting

Pretexting, also known in the UK as blagging, is the act of creating and using an invented scenario (the pretext) to engage a targeted victim in a manner that increases the chance the victim will divulge information or perform actions that would be unlikely in ordinary circumstances. An elaborate lie, it most often involves some prior research or setup and the use of this information for impersonation (e.g., date of birth, Social Security number, last bill amount) to establish legitimacy in the mind of the target.

Water holing

Water holing is a targeted social engineering strategy that capitalizes on the trust users have in websites they regularly visit. The victim feels safe to do things they would not do in a different situation. A wary person might, for example, purposefully avoid clicking a link in an unsolicited email, but the same person would not hesitate to follow a link on a website they often visit. So, the attacker prepares a trap for the unwary prey at a favored watering hole. This strategy has been successfully used to gain access to some (supposedly) very secure systems.

Baiting

Baiting is a form of real-world Trojan horse that uses physical media and relies on the curiosity or greed of the victim. In this attack, attackers leave malware-infected floppy disks, CD-ROMs, or USB flash drives in locations people will find them (bathrooms, elevators, sidewalks, parking lots, etc.), give them legitimate and curiosity-piquing labels, and wait for victims.

Unless computer controls block infections, insertion compromises PCs "auto-running" media. Hostile devices can also be used. For instance, a "lucky winner" is sent a free digital audio player compromising any computer it is plugged to. A "road apple" (the colloquial term for horse manure, suggesting the device's undesirable nature) is any removable media with malicious software left in opportunistic or conspicuous places. It may be a CD, DVD, or USB flash drive, among other media. Curious people take it and plug it into a computer, infecting the host and any attached networks.

Again, hackers may give them enticing labels, such as "Employee Salaries" or "Confidential".

One study published in 2016 had researchers drop 297 USB drives around the campus of the University of Illinois. The drives contained files on them that linked to webpages owned by the researchers. The researchers were able to see how many of the drives had files on them opened, but not how many were inserted into a computer without having a file opened. Of the 297 drives that were dropped, 290 (98%) of them were picked up and 135 (45%) of them "called home".