In this episode, we're going to go through social engineering.
Now, you should already have the foundational knowledge of social engineering,
whether it's fishing, spearphishing, fishing or fishing.
And we're going to go over those at a very high level,
very quickly throughout this episode.
But cys A really wants you to understand the
idiosyncrasies associated with each type of social engineering attack,
meaning you should expect to see scenario based questions
and from those scenarios be able to identify
is this type of social engineering attack,
a
spear
phishing or a phishing email, maybe it's a phishing call or a smishing text message.
It really kind of defines on how you're going through that don't
expect to see some easy questions when it comes into this.
Some of these questions are actually quite frankly difficult
and you need to be able to identify. Is this a legitimate email or it is a
email
that really comes into play with the cys A and expect
to see examples of those specific emails throughout the exam.
Now, they're not gonna pause
you day for day on 50 different email types,
but I would expect to see at least one question in
your exam with a sample email that you need to identify?
Is it a legitimate email? Is it a phishing email?
Is it a spear phishing email or is it just a
regular social engineering attack be prepared for those types of questions?
Social engineering encompasses?
Well, phishing and phishing is just an email in direct attack,
meaning that it's broad in scope.
It's not really directed to an individual or a specific person.
It's more kind of based towards an entire company.
It's gonna use things like, hey, you or hi, it's gonna not call you by name or title.
It's not gonna have any defining characteristics
that pinpoint to a person specifically.
These are phishing emails
and very broad in scope.
A spear phishing email in contrast is very direct.
It's an email attack that's associated to
a specific person and should include titles,
your specific name, usually first and last name, but not always.
Uh it'll understand your title.
They may even pull out some specific information about you like your child's name
or your specific department and ask for something like normal to start off with,
which really doesn't seem that
uh imposing from malicious actor point of view.
However,
most spearphishing emails are in it for the long game and not the short attack,
meaning while it starts off soft,
it will eventually turn into a hard kill where they're going to try
to kick you on a lake or provide them with credit card information.
Remember spearphishing emails are very directed, they're gonna have your name,
they're gonna have maybe even your phone number,
they're gonna have attributes associated with your
position and maybe even your personal family members
with vishing or voice solicitation.
These types of attacks are over the voice line for obvious reasons,
but they can include robocalls.
They can also include direct calls where they understand
not only your name and your sensitive information,
just like a spear phishing email,
will they also encompass things that are very broad
inscoe like you might see on a phishing email.
To be honest, they're just phishing or,
or phishing emails and spear phishing emails rolled into a voice solicitation
where they're trying to get you to actually talk to them.
They usually encompass something where they're trying to
use authority to get you to provide them information
or they're enacting upon your empathy to get you to provide information
because you feel sorry for them,
whatever they route, it really is a phishing attack used over a voice line.
Now,
there's a great example that we provided in the
documentation alone for a youtube link by Chris Hagney
and he does a great job of showing how
vision could really work in a real world environment.
Phing can include impersonation where they provide you
a known relationship either through a coworker,
a spouse or even it, it's not uncommon with a company that I work for where
they would have uh these malicious actors call somebody at the company and say, hey,
I'm with it.
I'm trying to get your computer updated to the newest
whatever I need your IP address and they'd be like,
oh, ok.
Well, how do we IP address?
And the malicious actor would literally tell them to type in the C MD command
and then IP config in order to give them
the IP address where they can literally tag into it
and provide an RDP connection to it.
They just then have to get the user to
click on the OK for remote control their computer.
And meanwhile, the employee thinks that they're doing good,
they're helping out it.
The malicious actor is taking over their system.
Social engineering, especially vision can be
very dangerous as there is very much a call for people
that speak English very well to take advantage of employees.
Most people that are expecting a fishing call expect robocalls or they expect
somebody with an accent that doesn't really
sound United States or English in perspective
when they're confronted with somebody that speaks English very well and is easy
to talk to these phishing attacks become very dreadful for the organization.
There's something called baiting.
And while we haven't really covered baiting in the past,
uh baiting is a feature where we're providing a free device in public.
Usually this means I go out to a parking lot or an employee break
room and I just throw U SBS on the ground for a break room.
We once did a physical device where we took a box of USB drives,
we left them in the break room and then we put
a little slide that says free one Terabyte or I'm sorry,
26 gigabyte
uh USB drives take what?
You'd be surprised how many people pick those up at
the break room because they thought they were a,
they're in the break room,
what harm could come into play. It's important for
boning that you as a cybersecurity analyst, not only know what it is,
but you train your employees properly on the fact that we don't take three devices.
This is the reason that we normally shut off USB
ports on our computers inside of our offices and organizations.
But Baiting is literally giving something for free hoping that
somebody will pick it up with a normal USB drive.
There's nothing to be concerned but with a faulty or malicious USB drive,
uh malicious actors can put programming code on there that
happens behind the scenes that people will never see.
Uh Baiting is a very dangerous attack that we should be fully aware of.
Then there's something called pretexting. This is a fabricated scenario.
In order to obtain information.
This scenario could be in a numerous different ways.
You can also use pretexting in combination
with other factors of social engineering.
For instance,
I could pretend to be the it department which we
just talked about and give a fabricated scenario of.
I need to update your Windows system that combines phishing with pretexting.
You could also do that with phishing or even
spear phishing where we're providing a fabricated scenario of,
hey,
I'm with the HR department and I need to verify that your whole information is XY and Z
that information is probably made up.
And if we can spoof that hr email address,
we can get the potential victim to provide us
not only with their home address or telephone number,
but sometimes even the last four of the social security numbers.
Now, I want you to think about that from malicious point of view.
If I can get you to give me your home address, your telephone number,
your first last and middle name,
as well as the last four digits of your social security number.
I can pretty much open a credit card in your name or find
your banking institution and get them to open up the account to me.
This provides some serious problems within a personal perspective,
but also from an organizational perspective of how many times have you called it?
And they ask for specific
related information to you to reset your password.
So you can see from that perspective,
pretexting plays a valuable role inside of
cybersecurity from a social engineering perspective.
Finally, I want to talk about OSSP
links. These are obscured links where we don't provide the full link as an attacker.
We provide a short link,
you probably see these in bitly codes or a
short URL identifier that says something like click here.
Most people or most random users will just scroll over it
and click the link having no idea where it goes to.
For instance,
I could create a Amazon page that says you've just won $100 Amazon gift card.
Click here now
and it's just a block that says click here.
We get the user to click on the link and they
go to a offsite website for Amazon that looks perfectly legitimate.
But instead of amazon.com, it's
Amazon
or two
ends.com or A NN
oh you get the point, right?
So those different links provide a segment or an attack vector for the
user to short come the specific vulnerabilities of a potentially wary subscriber,
meaning
I'm going to try to get that wary subscriber to click on something. They shouldn't,
we can do URL encoders like bitly, we can do subdomain
moving where I spoof the subdomain. So it doesn't really look like it.
I can do a holograph attack where I'm
moving the information away from its primary information.
It goes somewhere else and I could do a script to redirect
track where we're redirecting traffic from one website over to another.
I can use those different attack vectors to hide a link within
a box or even another subset of text just because it says
HTTP and it provides that link doesn't mean that I can't make
those letters or that link go to a completely different website,
these all part of that attack methodology or that attack Metro attack
where I'm fooling the user into doing something they normally would do.
Uh offering $100 to a low minimum wage worker isn't out of the question.
And I never actually have to provide them the gift card.
They'll still click on the link.
Now, we talked about social engineering in this episode,
we talked about obscure links.
We talked about the basic foundations of
the different social engineering attack vectors that you
should already be aware of and we refresh your memory on those different attacks.
Remember for cys A,
you should expect questions that are scenario based
that lead you towards a specific attack vector,
it's not uncommon to see one of your
answers being social engineering and social engineering,
it could be the proper answer in those exams if the right example isn't there.
For instance, if you see an attack methodology for spearphishing,
but spearphishing isn't an answer.
Don't be afraid to click on that social engineering attack because phishing,
phishing and smishing don't make sense.
It would still fall under that social engineering attack answer.
And
CT is notorious for pulling those types of studs within their exam.
Remember as ac Ys a analyst,
you need to not only know the concepts of social engineering but how they're
implemented within an attack vector or an
attack methodology on a whole another level.
It's not enough just to be able to identify
it from the different scenarios or the theoretical concept,
you need to be able to look at the email and identify.
Is this a spear phishing email attack and why?