Biggest Threats on the Cyberspace #6: Social Engineering

Social Engineering

Social engineering plays an important part in a significant number of cyberattacks. Hackers are generally not trying to exploit technical vulnerabilities in your (or your kid's) computer. They are going after your kid instead. According to security reports, only about 3% of the malware that hackers run into the target computer, tries to exploit a technical weakness. The other 97% is trying to trick the user through some sort of social engineering technique, so at the end of the day, it does not matter if your device is a PC, a Mac, an iOS or an Android.

In this article, you will learn:

- What is social engineering?
- How does social engineering hacks get done?
- What are the types of social engineering?
- How to protect my kid against social engineering hacks?

What is Social Engineering?

Social engineering is the art of Hacking Mind, that means getting people to do things you want them to do. For example, when you tell your kid that if he/she does not stay in bed and take nap, the monster under the bed would eat his/her toes! That is social engineering. Or, one time your kid wanted candy, so she hugged her mom and made a cute face and got it. That was social engineering!

In the context of cybercrime, social engineering is widely described as being a non-technical tactic used by hackers to gather information, conduct fraud or gain illegitimate access to your (or your kid’s) computers. Social engineering involves tricking people into breaking the security procedures that they would usually follow.

How does social engineering hacks get done?

Social engineering attacks that target individuals specially kids are most easily and successfully launched through email. Social engineering can also extend to business and friend requests on social media like LinkedIn and Facebook respectively, with criminals using social networks to gain trust and secure data. More often than not, the end result is either extortion or theft. In the following, we discuss two most Common social engineering attacks including phishing and ransomware.

Phishing

The most common social engineering attacks come from phishing, which is an attempt to get access to user's data via faked WWW-addresses. Since about 91% of data breaches come from phishing, this has become one of the most exploited forms of social engineering. Phishing emails are emails that appear to come from an entity your kid trusts. Social engineers go to great lengths to make these emails look real by obtaining company logos and sound real by using professional proofreaders. Phishing emails can be very difficult to spot for adults because of their seeming authenticity, but they are especially difficult for inexperienced kids and teens to spot.

A Real Social Engineering Hack:
Fourteen-year-old Alice loves to shop online at Forever21. She likes to look elegant and fashionable. She shares pictures of herself in new dresses with everyone on Instagram and Facebook under AliceStylish page. A criminal Bob does a little research about Alice, and writes her an email that looks like Forever21 ads (phishing email). It states that an unknown charge was made on her account, and directs her to download a summary of her charges. She clicks the download, infecting her parent’s computer with a malware that collects her and her parent’s information including credit card numbers, email addresses, mailing addresses of her family and friends, and even social security numbers.

Ransomware

In the recent years, we’ve seen a dramatic increase in the use of ransomware being delivered alongside phishing emails. Ransomware attack persuades your kid to open a malicious executable or website. Hackers usually send an attachment such as “URGENT ACCOUNT INFO” with a file extension of “.PDF.zip” or “.PDF.rar,” which slips by the unsuspecting victim and delivers the payload. This attack often encrypts the entire hard disk, or the documents and requires a bitcoin payment to unlock. Luckily, these groups actually do unlock the data - this way future victims are more likely to pay.

How to protect my kid against Social Engineering hacks?

Hackers may easily crack technical protections (like strong passwords) and get the information they want just by talking to a person. People specially Kids, are the weakest link in any security system's chain. What can you do to minimize the chances of your kid to fall a victim to these dirty hacks? We can enhance our kid's security through education. Teaching different types of social engineering hacks and following essential security precautions can be very effective to minimize the risk. Join Kids' Shield's program, and protect your kid's mind to be hacked.