Tenets of Social Engineering

Core Tenets

• Reciprocity
• Commitment
• Social Proof
• Authority
• Liking
• Scarcity

Behaviors Vulnerable to Attacks

Reciprocity

Reciprocity refers to the human tendency to feel obligated to return favors or respond positively when someone does something nice for them. Attackers exploit this by creating a sense of indebtedness.

Real-life Example: An attacker sends a small gift or helpful information to an employee (like a USB drive with "company training materials" or a coffee shop gift card) along with a note saying "Thanks for your hard work! Could you help me access the employee portal? I'm having trouble with my login." The recipient feels obligated to help because they received something first.

Commitment

Commitment leverages people's desire to be consistent with their previous statements or actions. Once someone commits to something, they're more likely to follow through to maintain consistency.

Real-life Example: An attacker calls an employee and says, "You mentioned in your LinkedIn post that you care about cybersecurity. I'm conducting a security audit for your company. Since you're clearly security-conscious, would you mind verifying your login credentials to ensure your account hasn't been compromised?" The victim feels compelled to help because they publicly committed to caring about security.

Authority

Authority implies the right to exercise power in an organization. Attackers take advantage of this by presenting themselves as a person of authority, such as a technician or an executive, in a target organization to steal important data. For example, an attacker can call a user on the phone and can claim to be working as a network administrator in the target organization. The attacker then informs the victim about a security incident in the network and asks them to provide their account credentials to protect their data against theft. After obtaining the victim's credentials, the attacker steals sensitive information from the victim's account.

Real-life Example: An attacker calls a company receptionist claiming to be the new IT director: "Hi, this is John Smith, the new IT Director. I'm calling from the corporate office and need immediate access to reset all user passwords due to a security breach. Can you please give me the admin portal login? The CEO is breathing down my neck on this." The receptionist complies because they believe they're speaking to a high-ranking authority figure.

Intimidation

Intimidation refers to an attempt to intimidate a victim into taking several actions by using bullying tactics. It is usually performed by impersonating some other person and manipulating users into disclosing sensitive information.

For example, an attacker might call the executive's receptionist with this request: "Mr. Tibiyani is about to give a big presentation to the customers, but he is unable to open his files; it seems they are corrupt. He told me to call you and ask you to send the files to me immediately so that he can start his talk."

Real-life Example: An attacker calls an employee and aggressively states: "This is the compliance department. We've detected unauthorized access from your computer. If you don't immediately provide your login credentials for verification, we'll have to report this security violation to HR and your manager. This could result in disciplinary action or termination. You have 5 minutes to comply." The threatening tone and consequences pressure the victim into complying.

Consensus or Social Proof

Consensus or social proof refers to the fact that people are usually willing to like things or do things that other people like or do.

Attackers take advantage of this by doing things like creating websites and posting fake testimonials from users about the benefits of certain products such as anti-malware (rogueware). Therefore, if users search the Internet to download the rogueware, they encounter these websites and believe the forged testimonials. Further, if users download the malicious product, attackers may install a trojan along with it.

Real-life Example: An attacker calls an employee and says: "Hi, I'm from the IT security team. We're implementing a new security protocol today. I've already updated the security settings for everyone in accounting, marketing, and most of your department. You're one of the last few who need this update. Can you please download this security patch from the link I'm sending you? Everyone else has already done it without any issues." The victim feels pressure to conform because "everyone else" has already complied.

Scarcity

Scarcity implies the state of being scarce. In the context of social engineering, scarcity often implies creating a feeling of urgency in a decision-making process. Due to this urgency, attackers can control the information provided to victims and manipulate the decision-making process. For example, when Apple releases a new iPhone product that sells out and goes out of stock, attackers can take advantage of this situation by sending a phishing email to the target users, encouraging them to click on a link provided in the email to buy the product. If the users click on this link, they get redirected to some malicious website controlled by the attacker. As a result, the user might end up revealing their account details or downloading some malicious programs such as trojans.

Real-life Example: An attacker sends an email to employees: "URGENT: Security Breach Detected! Only 50 emergency security tokens are available for immediate distribution. We can only protect the first 50 employees who respond within the next 2 hours. Click here to claim your security token before they run out. After 2 hours, unprotected accounts will be suspended." The artificial scarcity creates panic and rushed decision-making.

Urgency

Urgency implies encouraging people to take immediate action. Attackers can take advantage of this by tricking victims into performing unintended tasks.

For example, ransomware often uses the urgency principle, which makes the victim take urgent action under a time-limit. The victims see the countdown timer running on their infected systems and know that failure to make the required decision within the given time can result in the loss of important data.

Similarly, attackers can send phishing emails indicating that a certain product is available at a low price and that to buy it, the user should click on the "Buy Now" link. The user is tricked, and they click on the link to take immediate action. As a result, they are redirected to a malicious website and end up revealing their account details or downloading a virus file.

Real-life Example: An attacker calls an employee: "This is the bank's fraud department. We've detected suspicious activity on your corporate credit card linked to your company account. Someone is trying to make a $5,000 purchase right now. We need to verify your identity immediately to stop this transaction. Please provide your employee ID and the last 4 digits of your social security number within the next 60 seconds, or we'll have to freeze all company accounts." The time pressure prevents careful consideration.

Familiarity or Liking

Familiarity or liking implies that people are more likely to be persuaded to do something when they are asked by someone whom they like. This indicates that people are more likely to buy products if they are advertised by an admired celebrity.

For example, people are more likely to allow someone to look over their shoulder if they like that person or they are familiar with them. If people do not like the person, they immediately recognize the shoulder surfing attack and prevent it. Similarly, people often allow someone to tailgate them if they like that person or are familiar with them. In some cases, social engineers use a charming smile and sweet-talk to deceive the other person into liking them.

Real-life Example: An attacker researches an employee's social media and discovers they're a dog lover who recently got a new puppy. The attacker calls and says: "Hi Sarah! I saw your adorable Golden Retriever puppy photos on LinkedIn - so cute! I'm Jake from the marketing department. I have a Golden Retriever too! Listen, I'm working on a project and need access to the customer database. Since we're both dog people, I thought you might be able to help me out. Could you share your login credentials? I promise I'll only use it for this one project." The shared interest creates rapport and trust.