Social Engineering – An Art of Manipulation: Identify and Protect

Cyber criminals have many tools in their arsenal, but Social Engineering stands out as the most effective due to its simplicity and efficiency against an individual or an organization. In Social Engineering attack cybercriminal hardly uses any tools. It is an art of manipulation by cybercriminals that relies on exploiting human psychology rather than technical vulnerabilities. It is very difficult for people or employee to stop such attacks, but they can defend themselves and their organization by following some basic practices.

What is social engineering?

Social engineering is an art used by cyber criminals to exploit human inherent weaknesses like fear, greed, trust, love, need etc. Cybercriminals use psychological manipulation of such human weakness to trick victims to make mistake and give away sensitive information.

An example of social engineering attack against organization:

Uber breach happened in Sep 2022 using social engineering attack:

It was likely that one of an Uber contractors had his personal device infected with malware. Due the malware the credentials were extracted and sold on the dark web. One hacker was able to purchase the exposed credentials. By using those credentials, the hacker repeatedly tried to log into the contractor’s Uber account, which was triggering MFA approval request. Repeated MFA requests caused ‘MFA fatigue’ where the contractor became fed up with receiving notifications. When the contractor eventually accepted a request, the hacker gained access to the account and escalated the attack.