3.6.2, 3.6.2.1 - Social engineering and protection

Manipulating people for information

A convincing request can persuade a person to reveal information that the computer system would otherwise protect.

A password-protected system can still be compromised if a user tells an attacker the password. The attacker might claim authority, create urgency or offer a reward. “I am from technical support; tell me your password now or your account will be closed” combines an apparent trusted role with pressure to act quickly. The weakness being exploited is the person's response to the claim.

This does not mean the victim is unintelligent. A request may be designed around a believable situation and arrive during busy work. Good protection gives people a clear verification process and enough time to use it. It should be easy to report a suspicious request without blame.

Blagging, phishing and shouldering

Identify a technique by how information is obtained, rather than by whether the attacker uses a computer.

Blagging, also called pretexting, invents a plausible situation to persuade someone to disclose information or perform an action they would not normally agree to. A caller might pretend to be a supplier whose payment details need updating, or a support worker fixing an account. The invented scenario is the central mechanism.

Phishing fraudulently obtains private information, often through email or SMS. A message pretending to come from a delivery company might link to a copied payment page and ask for card details. The message can use familiar logos and an urgent deadline. It may reach many people or be tailored to one person; a realistic appearance does not prove authenticity.

Shouldering, or shoulder surfing, observes private information as the user enters or views it. An attacker may watch a PIN being typed, read a visible screen or use a nearby camera. No password has to be requested, and no fake website is necessary.