The Most Common Social Engineering Attacks [Updated 2019]

Many years ago, one of the world’s most popular hacker Kevin Mitnick explained in his book “The Art of Deception” the power of social engineering techniques, today we are aware that social engineering can be combined with hacking to power insidious attacks.

Let’s consider for example social media and mobile platforms; they are considered powerful attack vectors for various categories of threat actors because they allow hitting large audience instantaneously.

Most of the attacks exploiting both paradigms are effective because leverage the concept of “trust” on which social networks are built.

Let’s see in detail which are most common social engineering attacks used to targets users.

Phishing attacks are the most common type of attacks leveraging social engineering techniques. Attackers use emails, social media and instant messaging, and SMS to trick victims into providing sensitive information or visiting malicious URL in the attempt to compromise their systems.

Phishing attacks present the following common characteristics:

  • Messages are composed to attract the user’s attention, in many cases to stimulate his curiosity providing a few information on a specific topic and suggesting that the victims visit a specific website to gain further data.
  • Phishing messages aimed to gather user’s information presents a sense of urgency in the attempt to trick the victim into disclosing sensitive data to resolve a situation that could get worse without the victim’s interaction.
  • Attackers leverage shortened URL or embedded links to redirect victims to a malicious domain that could host exploit codes, or that could be a clone of legitimate websites with URLs that appear legitimate. In many cases the actual link and the visual link in the email are different, for example, the hyperlink in the email does not point to the same location as the apparent hyperlink displayed to the users.
  • Phishing email messages have a deceptive (Read more...)

*** This is a Security Bloggers Network syndicated blog from InfoSec Resources authored by Pierluigi Paganini. Read the original post at: