SECURE IT - September 2024

A monthly Information Security publication for the WPI community.

This month focuses on SOCIAL ENGINEERING, which is the use of customized deception methods to obtain personal or confidential information for illicit purposes.

Put simply, hackers recognize that it is easier to hack a human than it is to hack a machine.

In this issue: 

• Psychology of Social Engineering
• Attack Strategies, including AI
• Prevention
• Learning with Laughter
• From WPI's CISTO
  
• Secrets of Social Engineering Webinar
  
• Meet Jeff!
• Featured Videos
• Statistics and In the News
• Diversity in Cybersecurity
• WPI Resources

Psychology of Social Engineering 

Social Engineering is a type of psychological manipulation that aims to trick people into sharing sensitive information or performing actions that may not be in their best interest.

Psychological tactics may include:

• Using emotions: Attackers use emotions to persuade victims into taking action they normally wouldn't. The attackers' aim is to put the user in a situation where emotions override human intellect.
• Preying on trust: Attackers will try to establish trust with their victims. They will attempt to take advantage of people's tendency to trust others they perceive as likeable or authority figures.
  
• Exploiting smartphones: Attackers will attempt to trick people into reacting quickly to notifications.
  

More detailed explanations of social engineering are in the links below:

Social Engineering Strategies

Artificial Intelligence (AI)

According to SecureWorld, "The innovative and fast nature of AI enables attackers to automate, scale up, and fine tune social engineering attack methods and unknowingly expand the attack surface of organizations." 

AI hones in on details to customize phishing to the target by:

• Hyper-personalized phishing: Mine social media to create emails customized with familiar content.
• Natural language generation: Generate coherent, human-like writing and dialogue.
  
• Emotional manipulation: Analyze the target's digital footprint to identify communication styles, emotional triggers, and vulnerabilities. 
  
• Detection evasion: Refine social engineering techniques to avoid raising red flags in security tools.
• Automated reconnaissance: Quickly gather intelligence by scraping data sources like social media, marketing sites, and public records. 
  

How Do They Attack?

Social engineering attacks may involve any of the following strategies:

• Pretexting: pretending to be someone else
• Baiting & Quid Pro Quo: promising to give something valuable, often in exchange for requested info or action from the target
• Blackmail: threatening to reveal something if the demands are not met
  

False Assumptions About Cyber Criminals

The attackers rely on these common misbeliefs:

• Criminals won’t hold conversations with you.
• Major platforms, such as Microsoft and Google, are always secure.
  
• Replying to existing emails is safe.
  

Examples of Social Engineering  

PHISHING email tries to trick someone into revealing sensitive information or making a payment. Smishing uses similar tactics in short message service (SMS) texting.  Vishing is a vocal attempt to extract information via the phone.  Spear phishing targets specific individuals using any of these methods.

PHYSICAL TACTICS may be employed, such as Credential Harvesting which gathers valid credentials to gain unauthorized access. Hoaxes trick the user into performing undesired actions, such as deleting important files to remove a virus. Invoice Scams spoof the invoice details of a genuine supplier, but change the bank account number. Tailgating attackers follow someone, who is unaware of their presence, into a restricted area.

WEBSITES lure victims through pharming, which redirects a familiar website link to a similar, but fake, website to obtain sensitive information such as login credentials. Watering Hole Attacks use malware installed on website(s) regularly visited by an organization's members to infect their computers.

Can you spot the spoofed website in this article? Remember to log in to view it.

Prevention Strategies

Below are a few prevention strategies from the federal Cybersecurity Infrastructure & Security Agency (CISA).

• Be suspicious of unsolicited communications from individuals asking about employees or internal information.
• Keep internal information about your organization private unless you are certain the person is authorized to have that knowledge.
• Do not reveal personal or financial information in email.
• Check the website's security before sending sensitive information. The URL should start with https and there should be a closed padlock icon. You may need to click the URL line to see these.

The article below provides additional information about social engineering prevention.

How to Combat Social Engineering: Take 5 & MFA

An excellent way to combat social engineering whether it's done by a person or AI is to ensure you use best practices for good cyber hygiene to make it harder for either to send you tailored messages.

Take 5 Minutes

Modern scammers prey upon your anxiety and depend upon your instant reaction. You can outsmart them by taking five minutes to diffuse your reaction, take yourself out of “fight or flight” mode, and look at the message logically.

Does this method and individual match the usual way you would receive this type of request, perhaps job duties, course assignments, schedule changes, account updates?

Have you asked anyone else about this? Contact a co-worker or the supposed sender via a different channel - so if you received email, try chat, phone, or speaking in person.

Does an email appear to be from WPI, but [EXT] starts the Subject line? That indicates it originated outside of WPI.

Have you checked with WPI ITS? If you are not sure whether a communication is legitimate, please contact the IT Service Desk or report phishing.

Multi-Factor Authentication (MFA)

Are you using MFA?  It is used for WPI resources, but consider enabling it for personal resources, too. MFA helps prevent an attack because just one piece of information is not enough for the attacker to take over your account. The CISA link below includes a video with directions to enable MFA on a personal account.

Learning with Laughter