What is Social Engineering? A Comprehensive Guide to Cyber Manipulation

Understanding Social Engineering

Social engineering is one of the oldest and most effective forms of cyber attacks in the history of the internet. It exploits human behavioral vulnerabilities, using various persuasion and deception techniques to obtain valuable information. In other words, it is a method of cyber attack that manipulates people psychologically, leading them to make poor decisions, make mistakes, and divulge sensitive information.

Cyber attackers can alter people’s decision-making processes through social engineering attacks. The life cycle of social engineering attacks can be divided into four stages: research, trap, exploitation, and exit. In the research stage, the attacker identifies the victim, gathers background information about the victim, and determines the attack method based on the obtained information. In the trap stage, the victim is lured into a trap, a story is fabricated to gain control over the victim, and the victim is captured. In the exploitation stage, the attacker can expand the scope of the attack and corrupt or destroy data. In the exit stage, traces of the attack are cleaned up, and everything is returned to its natural state.

Who Can Perform Social Engineering Attacks?

Social engineering attacks can be carried out by anyone. While a malicious hacker may use social engineering to harm an organization or an individual, a cybersecurity expert can test and report whether the organization or individual is resilient against social engineering attacks. Intelligence agents may carry out social engineering attacks for their country’s interests, and companies may use social engineering to gain a competitive advantage over other companies. Thus, it can be concluded that anyone can engage in social engineering for specific purposes.

Vulnerabilities Exploited in Social Engineering Attacks

Several factors can make organizations and individuals vulnerable to social engineering attacks:

Lack of or inadequate information security awareness
Insufficient security policies
Poor communication between departments within organizations
Perception of information as harmless and valueless
Failure to perform any verification
Unconditional loyalty
Incomplete information security components

Information Gathering in Social Engineering

If an organization is targeted in a social engineering attack, information about the organization can be easily obtained from social media platforms. Additionally, the organization’s publicly accessible web pages and external servers can be examined.

Organizations have domain names for their web pages. Online web tools available to everyone can be used to gather information about the target organization. The information gathering tool known as Whois can obtain information about the target organization without interacting with the target organization’s servers. This information may include the name, surname, phone number, email address, and home/business address of the person who registered the domain on behalf of the organization. Additionally, information about when the domain name was registered and when it will expire can be obtained.

Some social engineers monitor the expiration dates of domain addresses of prominent organizations. If the organization’s domain usage period expires and is not renewed, it can be purchased by social engineers and offered for sale at high prices. The organization may be forced to buy back the domain at a high price to avoid damaging its reputation. Thus, social engineers can gain financial benefits.

Information about the target organization can be obtained not only through the Whois tool but also by visiting online sites such as robtex.com, mxtoolbox.com, netcraft.com, ripe.net, and arin.net. These online information-gathering sites can provide more detailed information about the target organization. The servers used by the organization can be listed, and official email addresses of the organization’s employees can be identified.

DNS queries can be performed on the target organization’s domain address to obtain information about the servers running in the background. The server information, information about the services running on the servers, and service version information can be obtained. The dig tool can be used to perform DNS queries.

Documents shared by the organization, such as .docx, .xlsx, and .pdf files, can be examined to gather information about the people who edited the documents. Google dorks such as ext:docx, pdf, xlsx or filetype:docx, pdf, xlsx can be used to obtain documents shared by the target organization. Critical information about the target organization can be obtained using Google dorks.

Shodan is a search engine that locates internet-connected devices. Using Shodan, servers and camera systems used by the target organization can be identified. Shodan not only identifies devices but also provides information about open ports on the devices and the versions of services using the open ports. If there is a possibility of a security vulnerability in the services, Shodan provides information up to the CVE code of the security vulnerability.

Information can be obtained by examining snapshots of the target organization’s websites without interacting with them. The online site archive.org can be considered a digital library. The archive.org site takes snapshots of sites that are publicly accessible on the internet at certain time intervals and stores them chronologically. In addition to taking snapshots of websites, it stores copies of some videos, images, music, and documents shared on the internet. Social engineers who want to take over an organization can obtain critical historical information from the archive.org online digital library.

Targeting Individuals

If the target is an individual rather than an organization, the individual’s social media accounts are examined. The individual’s past posts are scanned. Everything the person likes and dislikes is identified. A personality analysis is performed through the individual’s social media accounts. Thus, information obtained from social media is important for identifying the weaknesses of the targeted individual. After identifying the individual’s weaknesses, social engineers can use one of the social engineering techniques that exploit the individual’s weaknesses to gain control over them.

Online sites such as knowem.com and checkusernames.com can be used to determine which social media platforms the targeted individual uses based on their social media username. Thus, the scope of information about the targeted individual can be expanded. In addition to using websites, open-source tools can be used. Similarly, Google dorks can be used to gather information about the individual.