Welcome to the module devoted to social engineering and fake programs in this part we will analyze a
very interesting example of a massive scale social engineering attack which was actually conducted a
few years ago.
The attack used programs which seemed to do something other than they actually did.
Let's start by defining the term social engineering.
It describes a body of methods used to convince a person to do something they normally wouldn't do.
This is an attack aimed at the mass user most technological solutions don't provide protection against
social engineering attacks because they are targeted at users and not machines.
Whether the system is up did it or not doesn't matter here.
The end of the attack is to convince the user to reveal their password or to start a malicious program.
The program will work within the user's privileges.
And it will start processes and services.
No matter if the system is updated or not.
Why do we fall for social engineering attacks.
Please have a look at the picture you see in the slide.
What can you say about the person you see well he's definitely fit.
But as is his judgment of risk sound.
Can you properly assess the risk in an extreme situation.
Probably not in these situations we're not able to properly assess the risk.
This doesn't apply to operating systems only
if a person tries to wrangle some money out of an elderly lady by pretending to be her long lost grandson.
This is also a social engineering attack of sorts.
We fall prey to such attacks because we underestimate the risk connected with well-known situations
such as those that happen at home or at work.
Because we feel safe in that kind of environment.
We also feel safe about everything that is part of that environment even if it's new and a typical
people have a tendency to react conventionally even to unconventional situations.
If we don't know what to do we either ignore the threat or try to eliminate it at the lowest cost possible.
For example by giving in to the attacker so that he stopped nagging
we trust computer systems and computer applications too much.
If we recognize our superiors name in the email header We very rarely question the e-mails authenticity.
We have to be aware however the emails are sent by programs not people.
Whether or not a social engineering attack is successful depends largely on how much information about
the target the attacker manages to obtain.
Many people have changed their attitude towards security recently obtaining that information is no longer
a problem.
It can be done at low cost remotely and almost fully automatically.
That's why social engineering attacks are getting more and more widespread.
We'll have a chance to try out one of the methods for the attack in the practical part of this module
and social engineer dotcom will be able to track the operation from the perspective of the attacker
social engineering attacks are so effective for one more reason.
They are cheaper and easier to conduct than attacks targeted at operating systems
from the attackers perspective.
It's more efficient to attack users as the weakest point of the security.