If you have never heard of “social engineering,” or “social engineerism,” as today’s guest says we ought to call it, you are probably picturing a plot straight out of Frankenstein: the engineer builds himself a person… Or something from the conspiracy theories about mass mind control.
Whether you have heard of it or not, though, we need to talk about it more and more. Because this is the most dangerous and most effective attack in the digital world. One that targets not computers, networks, servers or programs, but the weakest link in the chain: the human being.
“Today cybersecurity breaches happen more and more often through social engineering, a method that uses manipulation and manipulative techniques so that people are deceived and access to sensitive information is gained,” says cybersecurity specialist Plamen Tsvetanov.
But what are the most important steps to protect ourselves? What are the biggest risks of underestimating the person on the other side? Why should trust online be a scarce commodity? The subject matters to everyone, even those who don’t realize it…
Social, Eng.
Our guest definitely knows what he is talking about; the subject has fascinated him for decades. More than 20 years ago Plamen Tsvetanov began publishing the cult magazine Hacker, which, as its cover put it, told stories “about the dark side of things.” The magazine itself has a fascinating history that deserves to be told separately. But it was there, back in the first years of the millennium, that Plamen wrote about social engineering—the cyberattack aimed not at technology but at the user. That is why the experience he is about to share matters…, experience that comes from both sides of the barricade.
“People are often the weak link in cybersecurity,” says today’s guest. “For example, they can be tricked into sharing passwords or personal information through fake emails, social networks or phone calls. To protect yourself from such attacks, it is important to be careful and always check and verify the identity of anyone who asks for sensitive information.”
“Social engineering is the form used in more than 80 percent of cyberattacks, according to statistics from the FBI and the European Union Agency for Cybersecurity. It is a beachhead for other, even more dangerous breaches, but it is also an attack of the purest and most frightening kind in its own right.”
Hack or Be Hacked
Naturally, I couldn’t resist asking Plamen whether he had ever fallen victim to something like this himself. It turns out he hadn’t, but… it happened to his father.
“He worked at the Ministry of Internal Affairs and for more than 30 years taught Operational Investigative Activity; he was one of the greatest criminologists and profilers. And… he lost a huge sum after an attack like this,” Plamen says. Here is a more than certain sign that nobody is immune and everyone would do well to stay on guard online.
In the case of our guest’s father, the method was pretexting. This type of social engineering requires thorough research and careful preparation. The attacker gets to know the victim, starts communicating with them and manages to persuade them to share information they should never share under any circumstances.
“It’s a variation on the phone scams that used to be so popular,” Plamen adds. “Most often it was a call from someone posing as a medical worker in an emergency room, who would convince people to ‘save’ a supposedly injured loved one in need of urgent surgery.”
So, if… a criminologist with 30 years of experience can fall for it, do you really think anyone can be safe?
Serves You Right
Social engineering can turn up in many unexpected forms and situations. Some of them include:
- Physical social engineering
For example, someone posing as a worker from a service provider or technical support in order to gain access to a building or a computer system.
- Exploiting public events
The attacker may play the role of a participant at a charity event or a conference in order to gather information from the people attending.
- Fake social media campaigns
Attackers can create fake profiles, sometimes copying real ones, to get close to their targets by posing as friends or colleagues.
- Physical gifts or baiting
They can use gifts such as flash drives or other devices loaded with malware.
- Fake customer support
Attackers can pose as company employees to collect information from users through phone calls or emails.
Of course, these examples are only illustrative, insofar as there are no boundaries. Today’s web offers so many opportunities for attacks of this kind, limited only by the imagination of the “social engineers.”
Likes for Everyone, Trust for No One
“Unfortunately, a huge number of people and businesses think that things like this can’t happen ‘to us’!” Plamen sums up.
And while we began with phone scams, whose potential victims were mostly older people, nobody is immune to social engineering and its countless forms:
- Ordinary users
Anyone who uses the internet and social networks can be a target of social engineering. For example, people can be tricked into clicking harmful links or sharing sensitive information as a result of fake emails or messages on social networks.
- Businesses and organizations
Corporations, small businesses and other organizations are vulnerable to social engineering too. Attacks such as phishing and business fraud can do serious damage, exposing sensitive information or causing direct financial losses.
- Public figures, celebrities, influencers
People with a significant public presence are an even more “valuable” victim of social engineering.
- Employees
Social engineering can be used to manipulate an organization’s employees into revealing sensitive information or taking actions that could harm their workplace.
Heroes of Our Time
And if technology is constantly changing, the same goes for the attacks. As mentioned, Plamen Tsvetanov has been following the subject for more than two decades, and here are some of the things that have changed over that time:
- The growth of the online social landscape
Social networks and online platforms are now an inseparable part of our daily lives. This opens up new opportunities for social engineering, such as fake news, disinformation and manipulation through social media.
- The development of artificial intelligence and deepfakes
With technological progress, it is easier than ever to create realistic fake video and audio to be used for manipulation and fraud.
- More targeted attacks and personalized manipulation
Social engineering attacks are often more personalized. Malicious actors use data about people’s behavior and preferences to craft manipulative messages that are more likely to hit their mark.
- Wider awareness, cybersecurity training and education
On the other hand, as social engineering evolves, there is also more attention paid to cybersecurity, more training and more awareness of the subject. Organizations and individuals increasingly recognize the risks and strive to understand them and protect themselves from potential attacks.
In the end, that is exactly why we are here: to help more people stop and think the next time they get an email, a message, or read a news story that looks completely genuine. At least at first glance…
Once Hacked, Twice Shy
So what matters most if we want to protect ourselves? Forgive me for repeating myself…, being cautious. Or, as Plamen puts it, better to blow on the porridge before we get burned, since after that, as the Bulgarian proverb about the scalded man goes, we will be blowing on it anyway.
As for companies, the only solution is a combination of many factors—awareness, security procedures, technological solutions. And since employees don’t always pay attention to rather dull videos or live training sessions, regular tests and simulations are a must. Because reading abstract reflections is one thing, and quite another is to be fooled into clicking a convincing-looking link in a work email…, only to find out it was sent by the cybersecurity specialists, who have just managed to show you that anyone can be fooled.
And while these aspects of social engineering get plenty of discussion, one point of view remains relatively sidelined: that social engineering is also… the way the social platforms themselves treat us. Their algorithms, which lock us inside filter bubbles, and their marketing approaches. Even the way they shape the public agenda today is, definitely and categorically, a form of social engineering too, the cybersecurity specialist agrees.
And all of this will only deepen, thanks in part to generative technologies. As the Digital Stories experiment showed, it now takes just minutes and minimal technical knowledge to generate an online “hero” invented entirely by algorithms. And from there, the road to that hero becoming a weapon of social engineering is a short one…
Keep It in Mind
“There is no way we can say that every form of social engineering has already been invented,” Plamen says. “These kinds of attacks and manipulation constantly evolve and adapt to new technologies, to the social and cultural context, to changes in people’s behavior. Advances in technology, especially in artificial intelligence and social networks, may open up new opportunities for manipulation and attacks.”
And one more thing: social engineering is not limited to the digital world. “It can also be carried out in real life, using psychological techniques and manipulation,” the specialist sums up. “It is important to realize that social engineering is a product of human creativity and manipulative skill. That is why we must stay constantly vigilant, develop critical thinking and stay informed about the potential threats we may encounter both online and offline.”
Before we part, Plamen says something he considers an unwritten law, and all I can do is sign up to it. “Trust should not exist on the internet! Better to be paranoid than to get burned.” (You can find more about our guest and his work here.
Well, I sincerely hope that with Digital Stories I have managed to earn your trust in my attempts to gather important pieces of information, stories that help us find our way through the bustle of the technological present. But if you ever happen to see me advertising casinos, cryptocurrencies or someone to vote for… yes, online originals can almost always be told apart from fakes. All it takes, though, is the most important and perhaps the scarcest quality of our day. Common sense…
