Network and Perimeter Hacking · Topic 3 of 9
Social Engineering and Insider Threats
Social engineering concepts, human, computer and mobile techniques such as phishing and tailgating, and how insider threats differ from outside attackers.
- 4 min
- Four phases: research, select victim, develop relationship, exploit.
- Piggybacking has the authorized person's consent. Tailgating does not.
- Vishing is voice, smishing is SMS, whaling targets executives, pharming redirects through DNS or hosts changes.
What it is
Social engineering manipulates people into giving up information or access. It targets trust, helpfulness, fear and urgency, not software. It works because people are often the weakest link in a security design.
An insider threat is a risk from someone who already has legitimate access: an employee, contractor or partner. Insiders skip the perimeter, so the controls differ from those used against outsiders.
How it works
Concepts
Social engineering usually follows four phases: research the target, select a victim, develop a relationship, and exploit that relationship to get the goal. Common weaknesses it exploits are authority, urgency, scarcity, social proof, liking and fear of consequences. Targets include receptionists, help desk staff, executives and new employees.
The three families of technique are human based (face to face or by voice), computer based (technology carries the trick) and mobile based (apps and messages on phones).
Human based techniques
| Technique | Description |
|---|---|
| Impersonation | Pretending to be a trusted person such as IT support, a courier or an executive |
| Eavesdropping | Listening to conversations or reading messages without permission |
| Shoulder surfing | Watching someone type a password or read a screen |
| Dumpster diving | Searching discarded material for useful data |
| Piggybacking | Entering a secure area with the permission of an authorized person who holds the door |
| Tailgating | Following an authorized person in without their knowledge |
| Reverse social engineering | The attacker creates a problem, then offers to fix it, so the victim asks for help |
| Elicitation | Steering normal conversation to draw out information |
| Quid pro quo | Offering a service or favor in exchange for information |
| Honey trap | Using a romantic or personal relationship to obtain data |
Computer based techniques
| Technique | Description |
|---|---|
| Phishing | Mass emails that look genuine and lead to a fake site or malicious attachment |
| Spear phishing | Phishing aimed at one person or group with personal detail |
| Whaling | Spear phishing aimed at senior executives |
| Pharming | Redirecting users from a real site to a fake one, for example through DNS poisoning |
| Spimming | Spam delivered through instant messaging |
| Pop up and scareware windows | Fake alerts that push the user to install or call |
| Baiting | Leaving something tempting, such as an infected USB drive, for the victim to use |
Mobile based techniques
Vishing is phishing by voice call. Smishing is phishing by SMS. Other mobile tricks include malicious or repackaged apps, fake security apps and publishing a look alike of a popular app. Tools such as the Social-Engineer Toolkit (SET) and the Gophish framework are used for authorized phishing simulations.
Insider threats
| Type | Meaning |
|---|---|
| Malicious insider | A trusted person who deliberately steals data or causes harm, often for money or revenge |
| Negligent insider | Careless or untrained staff who cause an incident by mistake |
| Compromised insider | An account or device that an outsider has taken over |
| Professional (collaborator) insider | An insider working with an outside group, such as a competitor or criminal gang |
Warning signs include unusual hours, large downloads, access to data outside the job role, use of removable media, and resentment after a dispute or notice of leaving.
Controls for insiders: least privilege and separation of duties, data loss prevention (DLP), user and entity behavior analytics (UEBA), logging and review of privileged access, a prompt access removal process for leavers, and background checks.
A worked example
An email appears to come from the finance director and asks an accounts clerk to make an urgent payment to a new account, with no usual approval. It names real projects the clerk is working on. This is spear phishing or business email compromise by impersonation. The defense is a mandatory call back to a known number and a two person approval for payment detail changes.
How the exam asks about this
- "An attacker follows an employee through a secure door without being noticed. Which technique is this?" -> Tailgating.
- "A phishing message sent only to a company's chief executive and board is called what?" -> Whaling.
- "An employee unhappy after a demotion copies customer files before resigning. Which insider type?" -> Malicious insider.
What to remember for the exam
- Four phases: research, select victim, develop relationship, exploit.
- Piggybacking has the authorized person's consent. Tailgating does not.
- Vishing is voice, smishing is SMS, whaling targets executives, pharming redirects through DNS or hosts changes.
- Reverse social engineering makes the victim ask the attacker for help.
- Insider controls are least privilege, separation of duties, monitoring and DLP.
Phishing, spear phishing and whaling differ by targeting, not by technology. Pick the answer that matches how narrow the target is.
Common mistakes
Mixing up tailgating and piggybacking. Consent decides the difference.
Assuming insiders are always malicious. Negligent and compromised insiders cause many incidents.
Treating pharming as phishing. Pharming redirects the user even when they type the right address, while phishing relies on a lure.
Check yourself
What is the difference between phishing and spear phishing?
Phishing is sent widely, while spear phishing targets a person or group with tailored detail.
Which insider is an outsider using a stolen account?
A compromised insider.
Which control reduces the damage one insider can do?
Least privilege together with separation of duties.
Topic 3 of 9 in Network and Perimeter Hacking
Test yourself on Network and Perimeter Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.