Social Engineering
Definition
Social engineering is the manipulation of people (rather than systems) into revealing confidential information or performing actions that compromise security. Instead of hacking technology, the attacker exploits human psychology, trust, curiosity, fear and greed.
Why It’s Effective
Technical defences (firewalls, encryption) protect systems, but they cannot protect against a user who voluntarily hands over their password. Social engineering bypasses all technical security by targeting the weakest link: people.
The Four Main Techniques
1. Blagging (Pretexting)
- The attacker invents a false scenario (a pretext) to convince a target to share information
- Often conducted over the phone
- The attacker may research the victim beforehand to make the scenario more convincing
- Targets: Elderly people, new employees, receptionists
- Example: Calling a company pretending to be IT support: “We need your login credentials to fix an urgent problem with your account.”
- Defence: Train staff to verify identities before sharing any information
2. Phishing
- Sends fake emails that appear to come from a trusted organisation (banks, HMRC, Amazon)
- Emails contain links to fraudulent websites that look genuine
- Victim enters their login credentials or financial details on the fake site
- Warning signs: Vague greetings (“Dear Customer”), strange sender addresses, poor spelling/grammar, urgent language, suspicious URLs
| Real URL | Phishing URL |
|---|---|
www.barclays.co.uk | www.barclays-secure-login.com |
- Defence: Check email addresses and URLs carefully before clicking; use spam filters; anti-phishing browser extensions
3. Baiting
- Lures victims with the promise of something free or desirable (music, films, software downloads)
- Victim is tricked into entering login credentials to access the promised content
- Can also occur offline: infected USB drives or CDs left in public places, hoping curious people will plug them in
- Real example (2018): A campaign targeting US government agencies involved posting envelopes containing a letter and an infected CD loaded with malware
- Defence: Never load unknown physical media; be suspicious of offers that seem too good to be true
4. Quid Pro Quo
- Latin for “something for something”, the attacker offers a service in exchange for information
- Common example: A fake pop-up or phone call claiming “your computer is infected, let us fix it”
- The victim believes they are getting technical help but is actually handing over sensitive details or granting system access
- Defence: Only contact technical support through official channels; be suspicious of unsolicited offers of help
Comparison Table
| Technique | Method | Human Weakness Exploited | Medium |
|---|---|---|---|
| Blagging | Fake scenario / pretext | Trust | Phone / in-person |
| Phishing | Fake email + fake website | Trust / urgency | |
| Baiting | Fake free offer | Greed / curiosity | Online / physical |
| Quid pro quo | Fake service offer | Fear / trust | Phone / pop-up |
Defences Against Social Engineering
The best defence is awareness and training:
- Train staff to recognise warning signs
- Establish verification procedures before sharing any sensitive information
- Check URLs before entering credentials
- Be suspicious of unsolicited contact (phone, email, pop-ups)
- Never load unfamiliar physical media
Exam Questions
Q: Describe two differences between phishing and quid pro quo attacks.
Phishing uses fake emails with links to fraudulent websites to steal credentials, relying on the victim believing the website is genuine. Quid pro quo involves the attacker offering a service (like tech support) in exchange for information, the victim actively communicates believing they are receiving help.
Q: Explain how baiting can occur both online and offline.
Online: victims are offered free downloads (music/films) and tricked into entering credentials. Offline: infected physical media (CDs, USB drives) are left in public, and curious people plug them in, installing malware. Both exploit curiosity or greed.
Q: Why is social engineering difficult to defend against with technical measures alone?
Social engineering targets people rather than systems. Technical defences like firewalls cannot stop a person who willingly hands over their password, the only effective defence is user awareness and training.
Exam Tip
Questions often ask you to compare two techniques, focus on the method used and the human weakness exploited. Phishing = fake email + link; blagging = phone + fake story.