[Kevin Mitnick] is probably the most famous computer hacker still alive today, however he was more of a social engineer than you would think. Kevin started young; at thirteen, he convinced a bus driver to tell him where to buy a ticket puncher for a school project, when in fact it would be used with dumpster dived tickets found in the bins of the bus company’s depot.

At sixteen, he hacked Digital Equipment Corporation’s computer systems, copying proprietary software and then going on to hack Pacific Bell’s voice mail computers along with dozens of other systems. He was on the run for a few years and was eventually imprisoned for his crimes. Out of jail, he has turned into a security consultant and does well for himself by staying on the correct side of the law.

[John Draper], AKA Captain Crunch, was a pioneer in the phone phreaking world. He gained his moniker because of free whistles given away in packages of Cap’n Crunch cereal. He realized that these whistles played 2,600 Hz which just happened to be the exact tone that AT&T long distance lines used to indicate that a trunk line was ready and available to route a new call. This inspired [John Draper] to experiment with and successfully build blue boxes. Those days are gone now, as the phone system switched from analog to digital.

Types Of Social Engineering Scams and How To Avoid Them

There are many different type of social engineering attacks — imagine counting up the number of ways that exist to trick people. Still, it’s worth understanding the most popular scams, because you do need to protect yourself.

Pretexting

This type of scam involves telling someone a lie in order to gain access to privileged areas or information. Pretexting is often done in the form of phone scams where a caller will claim to work for some big company and needs to confirm their targets identity. They then go on to gather information like social security numbers, mother’s maiden name, account details and dates of birth. Because the call or the situation is normally initiated by the social engineer, a good way to protect your self from this scam is to call back or confirm who they say they are — using information that you gathered about the company, and not given by them.

Baiting

Dropping malware-filled USB drives around parking lots, or giant wooden horses near your enemy’s walls, is classic baiting. This is a simple attack with a simple mitigation: remember that if something free and interesting just lying around looks too good to be true, then it probably is.

Phishing

Phishing is the practice of sending out e-mails, posing as a well-known web service or company, and aiming to get the recipient to open a compromised document, visit a poisoned website, or otherwise break your own security. A few weeks ago, Hackaday’s own [Pedro Umbelino] wrote about how easy it is to exploit even the most security conscious around us (it had me) with an IDN homograph attack.

Most phishing is done at a less sophisticated level — normally a clone of website is made and emails are sent out telling victims to change their password. High value targets may have a fully customized phishing experience, known as “spear phishing”, where the scammer will put more effort into a site clone or email text by including personal information to make it look more authentic. Phishing is normally easy to spot — check the address of any link before clicking on it. And if you’re asked to change a password through an e-mail, close the e-mail and log into the web site through normal means, bypassing the bad links entirely.

Ransomware

A lot of ransomware is delivered by phishing, but since there have been an increasing number of widespread cases, it gets its own topic. However the user is fooled into running the malware on their computer, it encrypts valuable data or locks the user out of their system and demands payment to restore things back to normal. Whether this happens or not, upon payment, is anyone’s guess.

There have been a number of very high profile ransomware attacks lately, including ransomware crippling UK’s NHS and then spreading globally. Will this ever end? The easiest mitigation strategy against ransomware, in addition to no clicking on suspicious links, applications or keeping your system up to date in the first place, is to keep frequent backups of your system so that if you do get ransomed, you won’t have to pay. Keeping backups has other benefits as well, of course.

Quid Pro Quo

The quid pro quo scam is really all “quid” and no “quo”. A service provider calls offering to fix a bug or remove malware (that doesn’t exist) for a fee. A quick search on YouTube will turn up thousands of videos of scammers trying their luck with wise-cracking teenagers. As with many cons, this scam can be avoided by simply not responding to out-of-the-blue offers. On the other hand, this scam seems successful enough that it’s still being run. Knowing about it is the best defense.

Tailgating

One way to get into a restricted area that’s protected by a closed door is to wait for an employee or someone with access and follow them in. These attacks are normally aimed at businesses or apartment buildings, and the solution is to simply not let anyone get in with you.

Dumpster Diving

To impersonate a legitimate contractor, it helps to know the names of the firms involved and even points of contact inside the firm. All of this data and more can be found on receipts in the dumpster behind the firm. Invest in a shredder, and don’t leave anything to chance.

Social Media

People share an amazing amount of personal information on social media, so it’s no surprise that it’s a new tool for social engineers. Looking through someone’s account is like looking at a snapshot of someones life. Why would you announce your home is going to be empty to for the next two weeks to literally the whole world? Your home is just asking to be burgled. Or think of the ammunition that you’re giving to a would-be spear phisher. Think about the trade-offs of sharing personal information about yourself publicly.

Notable Social engineering Case Studies

Now, let’s see a couple examples of these social engineering tricks in the wild.

News International Phone Hacking Scandal

Here in the UK, there was a huge public storm when News International, owned by media mogul [Rupert Murdoch], was found to be using social engineering to “hack” into the voicemail services of prominent celebrities, politicians, royals, and journalists. The phone hacking list is extremely long. They often hacked into the voicemail by spoofing the caller ID that granted access to the phone’s voicemail inbox. Some voicemails were password protected with four-digit codes that were easily guessed. On other occasions, they simply called the phone provider’s service hotline and said they forgot their pass code — plain-vanilla pretexting.

Celebgate iCloud Nude Pictures “Hack”

[Ryan Collins] used phishing techniques to gain access to the iCloud accounts of Jennifer Lawrence, Kate Upton, and Kim Kardashian. He created fake notifications from Google and Apple and sent them on to his targets’ email addresses. At the time, there was speculation that Apple’s iCloud had hacked into on a massive scale. Instead, Collins admitted in an interview that he used phishing techniques to gain access to his victims personal data.

Where do We Go From Here

If breaking the computer system is too difficult, you can be sure that criminals will try to break the human system. Whether you call this “social engineering”, “cons”, or “scams”, they’re likely to be on the rise. The best way to protect yourself is to teach anyone with access to your data or details about how the attacks work, and how to avoid them.

There are plenty of resources online that you would be useful for helping protect yourself from these attack vectors. Protect yourself from eight social engineering attacks is quite a good starting point, and the US Department of Homeland Security also provides great information on preventing social engineering hacks that you can point people to.

In the end, most of it boils down to recognizing the patterns and being skeptical when you see them. Verify information through other channels, don’t blindly click links, and be wary of what personal details you give out to solicitors.