Social Engineering
Social Engineering is an attack to impart the sensitive information by manipulating other individuals. This attack is only possible cause of human errors which means an attacker will try to manipulate or trick the victim into sharing confidential information. The culprit will try to gather all the required information of victim’s background for a successful attack.
The attacker will discover and select the victim to get all the relevant background information which will help the culprit to attack by manipulating the sufferer. Then the attacker will try to gain the trust of victim by making up imaginary story and try to play with victim’s intellect. After all these efforts, the attacker will finally implement a relevant method for an attack and gain all the confidential information to hack someone’s or victim’s personal credentials such as personal account information, bank details and so on. The final and equally essential step for an attacker is not to reveal any trace for victim. It is hard for an attacker to hack any machine or operating system without involving human (victim or user).
https://resources.infosecinstitute.com/common-social-engineering-attacks/#gref
Phishing
Phishing attack is most common and effective way of hacking to access someone’s intimate information. In this attack, an attacker will use different ways or methods such as electronic mails (Emails), short message service (SMS), and so on to influence user or victim to visit malicious website or click on malicious links.
The initial step for an attacker is to attract the visitors to visit any specific malicious website or bogus website which should look legitimate for the user or victim. It can be done by phishing messages which will convince the user which is a trap for victim to enter sensitive data or information. For instance, victim received a text message from bank in which bank is asking to enter account details or else the account will be closed permanently. However, victim clicked on the link and start entering all the bank account details urgently without knowing that it could be a malicious text message. Through all these details, the cybercriminal can access victim’s bank account and withdraw all the money from the account. This is all possible because of victim’s involvement which can also be called as human error.
Solutions
The user or victim should be aware of uninvited text massages, emails and phone calls especially asking for sensitive information such as bank account details, personal credentials and so on. The victim should attempt to substantiate or confirm the identification of that individual by approaching or notifying the company without any intermediary. The events should be organized which are related to awareness training of companies’ employees or end users, will be helpful to reduce the security risks and vulnerabilities for companies or any other individuals.
Spear Phishing/Whaling Attack
https://digitalguardian.com/blog/what-whaling-attack-defining-and-identifying-whaling-attacks
In whaling attack, a cybercriminal will attack on those victims who are well known employees of the company or employees who hold the higher position in the company such as CEO (Chief Executive Officer), CFO (Chief Finance Officer) and so on. But in Spear Phishing attack, the attacker can select any other individual to get access to sensitive data. Whaling attack is possible by manipulating victim to visit bogus websites which will look licit for the visitor. This attack can also be done by sending bogus emails which look real to the victim and attacker can ask for intimate information such as personal credentials, company’s confidential information and so on. This attack is hard to discern because it is used to attack selected targets only who has access to the sensitive information of the company and this attack is also thoroughly customized for the victims. The attacker tries to spoof using domain which really look alike the original domain name, for instance, sInghcab.com is the original and s1nghcab.com is the bogus website to fool a victim.
Solutions
Each employee of the company should aware of whaling attack or spear phishing attack to avoid risk of disclosing sensitive information to the cybercriminal. All the executives of the company should be educated enough to avoid whaling attacks and they should train other employees of the company. The test should be conducted for the employees frequently which will help the employees to learn that how to avoid this attack. The senior management employees or other individuals should not share personal information on social media platforms which can be used to gather enough personal information by the attacker to implement cyberattack. The verification process is another method to avoid whaling attack, for instance, if an employee of the company gets the email to transfer funds or share sensitive information then the employee should substantiate that the sender is genuine or not.
https://www.digicert.com/blog/how-to-avoid-whaling-attacks/
Watering Hole
Watering hole is used to attack group of victims by injecting malicious code into websites’ pages. This attack installs the malware or trojan into the ender user’s system when user visits the infectious web page which is created by cyber criminals. Watering hole attack is not uncommon among cyber criminals because sometimes it is difficult for attackers to target specific website because cyber criminals investigate and examine the vulnerabilities of a certain website. The attacker(s) may compromise a website for days or even months to finalize the target for an attack, but it is robust enough to infect different websites in single hit which maintains the value of zero-day exploitation or the day when a weakness is uncovered in software. The attackers can examine or investigate the logs of the website which help them to spot any victim or user. This is the proficiency of watering hole attack that offers a confirmation of hacking maximum sensitive data of victim(s) on zero-day exploitation.
In an appropriate implementation of watering hole attack, a cybercriminal must compromise a website and then the attacker will gather all the relevant information about the victims such as personal interests, which contains remarkable endeavor to access the desired data.
Solutions
https://business.sprint.com/blog/watering-holes-5-ways/
There are some solutions to avoid watering hole attack but still no system is fully secured because of human error. Software should be updated consistently to mitigate the risk of watering hole attack and patches should also be updated reduce security vulnerabilities. Keep track of company’s employees’ activities like an employee is sharing company’s sensitive information in unofficial working hours which ca be avoided. If company’s employees are visiting a bunch of websites regularly then employees from IT department should compile those most visited websites and examine those websites for any malicious or trojan activity. By examining most visited websites, the malicious activity can be detected, and the internet traffic should be blocked on that specific malicious website to reduce the risk of losing company’s confidential information. The employees of the company and clients or users should be informed about watering hole attack and education of cyber security attacks is a key to reduce the risk of losing personal or company’s intimate information on the internet.
Pretexting
Pretexting is an attack to gain information which an opposite person does not want to share such as personal details, company’s confidential data and so on. In this attack, a cybercriminal will pretend as someone else to manipulate victim to gain access to all the sensitive information such as user credentials. Pretexting is an effective attack because of human error or unawareness of cyber-attacks among users and companies’ professional employees. Sometimes, companies hire cybercriminals to test the organizations’ employee’s knowledge and loyalty using pretexting attack. Pretexting is an art to manipulate anyone to gather privileged information from the victim which can be used for illegal purposes.
Solutions
https://www.observeit.com/blog/4-ways-defend-against-pretexting-phishing-scams/
The best method to help companies’ employees in avoiding scam of pretexting or social engineering attack is awareness training programs. Training programs will help employees to stay alert and follow company’s policy to avoid sharing any sensitive information with an unknown person. Employees should know about dissimilar risk assessment tools to figure out different scams. If an employee of the company has been trapped in pretexting scam, then the company should have a policy to handle these kinds of situations which will be controlled or handled by legal teams of an organization or a company. Human error can only be reduced by educating each employee and stakeholders of the company which is essential to avoid pretexting social engineering attack.