A Look at Social Engineering

Social Engineering:
A Social Psychology Perspective

Social engineering in the context of information security is defined as:

"The use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes."

To cite some more familiar examples, social engineering can take the form of impersonation, dumpster diving, phishing attacks, corporate espionage, or any persuasive and mendacious act that results in the gaining of information or material goods. Although social engineering has historically been associated with fraud, grift, or common scams, social engineering attacks have evolved with modern technology to become much easier to conduct, and potentially harder to combat. 

We have seen from the Milgram studies, and subsequent replications, that the average person will perform an action in response to authority that they may not normally perform on their own. In the case of the Milgram studies, this involved issuing a potentially lethal shock, simply because the experimenter told them to. In that specific study, participants conformed to an authority figure they had only just met, and performed an action that would potentially haunt them later in life. One reason that social engineering attacks are so effective is due to the common use of impersonation as a tactic. To better illustrate the real-world dangers of social engineering, as well as how the social context plays a role in successful attacks, I will use a story from when I worked as a social engineering consultant for Seagate Technologies from 2014-2016, as well as a more entertaining example from Kevin Mitnick's social engineering attack on Motorola.

The Seagate Incident - Power

In 2016 Seagate Technologies had the misfortune of falling victim to a social engineering attack that resulted in the theft of all current and former employee W-2 forms. This was a massive security breach that affected several thousand employees and exposed sensitive information to whoever conducted the attack. How did this happen? 

A Seagate representative had issued the following statement as the theft unfolded in media and internal confusion:

"On March 1, Seagate Technology learned that the 2015 W-2 tax form information for current and former U.S.-based employees was [sic] sent to an unauthorized third party in response to the phishing email scam. [..] The information was sent by an employee who believed the phishing email was a legitimate internal company request."

As mentioned earlier, one of the common forms of social engineering involves phishing, which appears to be the mode this attack took. Phishing works by exploiting the trust an individual has toward a person or company, social engineers take advantage of that trust by impersonating the source. In this incident, an attacker impersonated an executive at Seagate and sent an email to an employee requesting all of the W-2s. The employee, in turn, bundled them all up and promptly sent them as requested. We can see the effectiveness of trust from the quote above, but furthermore, the dynamic of employee and executive came into play. In this example, the social context of the requester being someone (presumably) high up in Seagate, it is likely that the employee felt the power dynamic was compelling for them to carry out the request with minimal scrutiny. Oftentimes coercive power is at play in an employee/employer relationship, as the employer has the potential to dock pay, fire, or demote an employee for any transgression. The fear of a potential reprimanding would have increased the likelihood that the target of the phishing scam would comply.

Kevin Mitnick - Ingratiation

As seen in the Seagate example, impersonation can be used to elicit conformity in others by representing someone that has power. Power can come in many forms, three that are often cited are Legitimate, or someone voted/elected into a position, Coercive, such as the example of an employer, as well as Expert, or someone in a position viewed as a role of trusted authority, such as a doctor or lawyer.

Social engineering does not always play on the influences of power to create desirable outcomes, in some cases simply being nice can result in conformity, In the below video, Kevin Mitnick details his approach to steal Motorola cellphone schematics- simply by impersonating an employee,  gathering information, and politely talking to numerous people as his request was forwarded from person to person. This recollection provides an extremely good example of how easily social engineering attacks can be done, but more importantly, how hard they can be to thwart. At any point in the line of people Kevin spoke to, someone could have questioned him, asked for credentials, or flat out rejected the request.

As you can see in the video, his request did set off red flags. The company was not allowed to send files to an out-of-network device. Even with this - the employee he was speaking to went out of her way to get security clearance & comply with his request. Why did this happen? Unlike the Seagate example, Kevin did not pretend to be the CEO, there was likely no feeling of coercive pressure from the Motorola employee, yet she went above and beyond to help Kevin. The answer is likely a mix of trust and ingratiation. Kevin attempted to become friends with the employee. He was very polite during the conversation, he wove in details, such as knowing the project manager (and that she was on vacation), as well as using the story that she had told him that this request was already signed off on and she simply forgot to follow through before leaving. Here Kevin is building trust with the employee, and becoming more likable to her. Because she believes that he is trusted and knows her co-worker, she yields to his influence and complies to the seemingly normal request, without further asking questions or verifying his claims.

Awareness as Protection

Many people fall victim to social engineering without really realizing it, and often we don't notice an attack has occurred until something substantial happens, such as identify theft, account hacking, etc. One example of a case where we wouldn't think twice is holding the door for someone carrying a heavy look box. This example is often used to describe "tailgating" - and is considered a very effective approach to getting into a secured area. Because people don't want to break the normative conformity - or to be seen as "bad" or stick out, we often hold doors for others without even thinking about it. A good approach to help combat social engineering attacks is simply awareness - did the Verizon rep who called to verify your identity provide any proof of their authority? Did the email you just received asking you to reset your password come from a site you trust? Did the person you just let into the building actually have authorized access? Being aware of requests made of us, and social situations that may involve sensitive information is a great first step to noticing when things are suspicious. Additionally, being suspicious of digital/phone identities, as we can't easily confirm people are who they say they are, can do a lot to prevent social engineering attacks.

Sources & Additional Resources

Anonymous (2016, November 28). How to Avoid Falling Victim to Social Engineering. Retrieved from https://www.globalknowledge.com/blog/2015/04/07/how-to-avoid-falling-victim-to-social- engineering/

Granger, S. (n.d.). Social Engineering Fundamentals, Part I: Hacker Tactics. Retrieved from
https://www.symantec.com/connect/articles/social-engineering-fundamentals-part-i-hacker-tactics

Stangor, C. (2014, September 26). Principles of Social Psychology – 1st International Edition. Retrieved from https://opentextbc.ca/socialpsychology/chapter/obedience-power-and-leadership/

---

Shameless plug: if you're interested in the topic & would want to read a more technical article along with proposed solutions, check out my post on Medium.