[Day 3] 2. Types of SE Attacks

Human-Based Social Engineering Attacks

1. Eavesdropping

   • The attacker listens in on conversations where employees discuss confidential company or project information.
   • By overhearing these conversations, the attacker gathers details about the company, employees, and projects.

2. Shoulder Surfing

   • Attackers watch as someone enters confidential information, like passwords or ATM PINs.
   • Common locations: ATMs, shopping malls, or stores where people use debit/credit cards or UPI.
   • They observe the PINs being entered to use them later.

3. Dumpster Diving

   • Attackers search through discarded items, such as ATM transaction receipts, to find valuable information.
   • Example: Using the receipt to see the victim’s remaining balance and masking part of the account number, they may attempt reverse social engineering to get more details.

4. Reverse Social Engineering

   • The attacker pretends to be someone trustworthy, like a bank official, and uses partial information to extract more details.
   • Example: After finding an ATM receipt, they might call the victim and say, “We need your account number for verification,” while sharing the remaining balance to appear legitimate.

5. Piggybacking

   • Used to bypass physical security in an organization.
   • The attacker may create a fake ID card to gain entry or trick security into believing they are authorized.

6. Tailgating

   • The attacker follows an authorized person into a secure area right after they use their ID card.
   • Relies on the authorized individual not questioning their presence.

Computer-Based Social Engineering Attacks

1. Phishing

   • Definition: Pronounced as "fishing", it’s a scam designed to steal sensitive information such as:
     • Credit card details
     • Social Security Numbers
     • User IDs and passwords
   • Also Known As: Brand Spoofing
   • How It Works:
     • Attackers send official-looking emails pretending to be from legitimate organizations (e.g., ISPs, retail stores).
   • Prevention:
     • Never click on suspicious links if you suspect a phishing attack.

2. Publishing Malicious Apps

   • Attackers create and publish apps that appear useful but are designed to steal your data.
   • Example: Apps offering free access to premium services like Netflix or Amazon Prime often contain malicious code.

3. Repacking Legitimate Apps

   • Legitimate apps are repackaged with malicious code and made available on torrents or non-legitimate websites.
   • These apps may look identical to the original but can compromise your sensitive information by including additional harmful content.

4. Fake Security Apps

   • Attackers use pop-ups to claim that your device is not secure and prompt you to download a security app or antivirus.
   • These apps are often viruses themselves and should never be downloaded.

5. Using SMS

   • Attackers send SMS messages containing malicious links or requests for sensitive information.
   • These messages often appear to come from trusted sources to trick the victim.