Social Engineering Techniques Research Articles

Leveraging Social Engineering Techniques for Ethical Purposes: An Approach to Develop Fake Android App for Collecting Valuable Data Discreetly

Social engineering techniques are often viewed negatively due to their association with deceptive practices. However, these techniques can also be utilized ethically, as many cybersecurity professionals do, particularly when evaluating vulnerabilities and testing security defenses. This paper presents EDC (Ethical Data Collector), an Android application that utilizes social engineering techniques to discreetly collect valuable data from an Android device for ethical purposes. EDC employs deception through a simulated UI (fake) to engage the target for a period, while secretly collecting data such as device information, active phone number, and images in the background, then sending them to a designated server via the internet. The researcher argues that EDC could help identify inexperienced cybercriminals or extortionists without complex efforts or significant cost, provided that its capabilities are judiciously utilized and subject to proper controls and oversight. EDC's development methodology emphasizes understanding the target's personality, predilections, and preferences to tailor the app experience as required for attracting the target to install and run the application. The paper describes the core functions and workflows for collecting and sending data. Additionally, permissions handling has been addressed as being critical for enabling EDC to collect the required information. Testing on Android emulators demonstrated that the EDC's APK file size is 4 MB, and data collection and transmission processes functioned as intended across various Android versions. The minimum SDK version required to run EDC is level 16. The total estimated time to complete the fake UI process (cumulative user engagement time) is 57-60 seconds, where each activity takes 8 seconds based on the adopted development approach.

Análisis de la efectividad de phishing automático

The article examines the growing threat of automated phishing, a social engineering technique that has evolved with automation, complicating the protection of computer systems both in Ecuador and globally. The objective is to analyze the effectiveness of this technique and its impact on information security. The methodology used includes a systematic review of the literature on automated phishing, highlighting how automation has increased the sophistication and scope of these attacks. The results show that automated attacks, facilitated by artificial intelligence and machine learning, have surpassed traditional attacks in frequency globally. In Ecuador, although less common, automated attacks have had a notable impact, especially in sectors with limited security measures. The findings highlight the need to adopt robust security controls, such as multi-factor authentication and ongoing cybersecurity training, in addition to following international standards such as ISO/IEC 27001 to mitigate the risks of automated phishing. Awareness talks are also recommended to strengthen security against these threats.

On emergent mobile phone-based social engineering cyberattacks in developing countries: The case of the Zambian ICT sector

The number of registered SIM cards and active mobile phone subscribers in Zambia in 2020 surpassed the population of the country. This development and the integration of mobile phone systems with financial payment systems has not come without a cost. Cyberattackers, using various social engineering techniques have jumped onto the bandwagon to defraud unsuspecting users. Considering the aforesaid, this paper presents a high-order analytical approach towards mobile phone-based social engineering cyberattacks (phishing, SMishing, and vishing) in Zambia which seek to defraud benign victims. This paper presents a baseline study to reiterate the problem at hand. The research used a mixed-methods approach, combining quantitative and qualitative data, and adopted a hybrid descriptive research design. Furthermore, an attack model and an evaluation framework were devised to ascertain the most prevalent types of mobile phone-based cyberattacks. Based on logistic regression analysis, the findings indicate that the most prevalent type of mobile phone-based social engineering cyberattack in Zambia is SMishing. Based on the results and observed insights, recommendations to mitigate these emergent social engineering cyberattacks were suggested. This research serves as a valuable baseline for understanding and addressing the growing challenges posed by mobile phone-based cyberattacks in Zambia's evolving technological landscape.

Next-Gen Phishing Defense Enhancing Detection With Machine Learning and Expert Whitelisting/Blacklisting

Machine learning has become ubiquitous across industries for its ability to uncover in- sights from data. This research explores the application of machine learning for identifying phishing websites. The efficiency of different algorithms at classifying malicious sites is evaluated and contrasted. By exposing the risks of phishing, the study aims to develop reliable systems for fake website detection. The results showcase machine learning's capabilities for augmented cybersecurity through automated threat intelligence. Phishing employs social engineering techniques to disguise malicious links as trusted entities, tricking victims into revealing sensitive information. This work investigates phishing detection leveraging curated lists and machine learning for adaptive defense.

Uncovering phishing attacks using principles of persuasion analysis

With the rising of Internet in early ’90s, many fraudulent activities have migrated from physical to digital: one of them is phishing. Phishing is a deceptive practice focused on exploiting the human factor, which is the most vulnerable aspect of any security process. In this scam, social engineering techniques are extensively utilized, specifically focusing on the principles of persuasion, to deceive individuals into disclosing sensitive information or engaging in malicious actions. This research explores the use of message subjectivity for detecting phishing attacks. It does so by assessing the impact of various data representations and classifiers on automatically identifying principles of persuasion. Furthermore, it investigates how these detected principles of persuasion can be leveraged for identifying phishing attacks. The experiments conducted revealed that there is no universal solution for data representation and classifier selection to effectively detect all principles of persuasion. Instead, a tailored combination of data representation and classifiers is required for detecting each principle. The Machine Learning models created automatically detect principles of persuasion with confidence levels ranging from 0.7306 to 0.8191 for AUC-ROC. Next, principles of persuasion detected are used for phishing detection. This study also emphasizes the need for user-friendly and comprehensible models. To validate the proposal presented, several families of classifiers were tested, but among all of them, tree-based models (and Random Forest in particular) stand out as preferred option. These models achieve similar level of effectiveness as alternative methods while offering improved clarity and user-friendliness, with an AUC-ROC of 0.859842.

From Offer to Breach: The Empirical Study on Quid Pro Quo Cyber Attack

Quid pro quo attacks are a sophisticated form of insider threat where malicious individuals exploit the human element within an organization to gain sensitive information or unauthorized access. Unlike traditional cyberattacks that focus on technical system flaws, these attacks rely on social engineering techniques to deceive people. Attackers often use ransomware, encrypting a victim's data and demanding payment, typically in cryptocurrency, for the decryption key. The term "quid pro quo" highlights the exchange involved, indicating that the attacker seeks something in return for stopping their harmful actions. To effectively understand and defend against quid pro quo attacks, a comprehensive approach is necessary. The primary goal of this research is to examine how these attacks operate and to propose effective solutions and preventive measures. This will be achieved by studying incidents involving affected victims. The research aims to identify the specific methods used in these attacks, analyze the vulnerabilities that allow them to succeed, and offer practical recommendations for improving cybersecurity defenses. By learning from the experiences of past victims, this research seeks to provide valuable insights that can be used to develop proactive strategies and security protocols to prevent or mitigate the impact of quid pro quo attacks in the future.

Social Engineering Attacks and Counter Measures: A Comprehensive Analysis

Social engineering attacks represent a significant threat to individuals, organizations, and society at large. This research paper provides a comprehensive analysis of social engineering attacks, their methodologies, impacts, and countermeasures. By examining various case studies and real-world examples, this paper aims to enhance understanding of social engineering techniques and equip readers with effective strategies to mitigate such threats. Additionally, emerging trends and future directions in social engineering defense mechanisms are explored to anticipate and address evolving challenges

A Cybersecurity Awareness Model for the Protection of Saudi Students from Social Media Attacks

Social engineering addresses a broad category of techniques aiming to persuade someone to reveal data or perform actions for criminal purposes, such as disclosing personal information about a particular target. Cybersecurity awareness is required to raise people’s understanding of how these social engineering techniques are being used and so their capacity to exploit them. To accomplish this objective, primary focus is given to educating and training individuals on how to recognize such incidents and respond to them effectively. To protect people against social engineering threats, various cybersecurity models and approaches have been proposed. There are, however, a few differences between these models, since they are developed for specific purposes. Thus, the main objective of this study is to develop a cybersecurity awareness model specifically designed for Saudi students to protect them from social engineering attacks. The design science methodology was utilized in this study. The proposed model consists of four main stages: education and training, developing policies and guidelines, improving Saudi schools’ security, as well as monitoring and evaluation. The model introduced can ensure the safety and privacy of students, teachers, and staff across different social platforms.

Common Techniques, Success Attack Factors and Obstacles to Social Engineering: A Systematic Literature Review

Knowledge of Social Engineering is crucial to prevent potential attacks related to organizational Information Security. The objective of this paper aims to identify the most common social engineering techniques, success attack factors, and obstacles, as well as the good practices and frameworks that could be adopted concerning their mitigation. As an analysis methodology, a Systematic Literature Review was carried out. The findings revealed that the discussion about SE attacks has increased and that the most imminent threat is phishing. Exploiting human vulnerabilities is a growing threat when the attack is not carried out directly through technical means. There continue to be more technical attacks than non-technical attacks. Encouraging organizational security prevention, like training, education, technical controls, process development, defense in detail, and the development of security policies, should be considered mitigating factors for the negative impact of SE attacks. Most SE frameworks/models are focused on attack techniques and methods, mostly on technical components, decorating human factor. As a novelty, we found the opportunity to develop a new framework that could improve coverage of the gaps found, supported on security international standards, that could help and support researchers in developing their work, understanding open research topics, and providing a clearer understanding of this type of threat. Doi: 10.28991/ESJ-2024-08-02-025 Full Text: PDF

Cybersafe: Gamifying Cybersecurity Training with a Training App

The rapidly evolving digital landscape has triggered a surge in cybersecurity threats, particularly social engineering techniques which demand innovative and accessible countermeasures to combat them in an accessible and real-time format. We present "Cybersafe," a mobile application designed to empower users to identify and combat common social engineering exploits effectively. The transformative concept behind this initiative aims to reshape traditional cybersecurity training by introducing a gamified, user-friendly platform suitable for all age groups. Cybersafe’s application's functionality revolves around interactive quizzes that assess users' ability to identify threats. The findings from the research serve as a valuable resource for cybersecurity trainers, application developers, and organizations striving for a secure digital environment.

Telephone fraud as a complex social problem

The article studies telephone fraud as a new type of crime and an acute social problem. Attention is drawn to the complex nature of the problem, as it should be considered in the plane of different disciplines: general jurisprudence, criminology, social psychology, social engineering, information technology. The Bank of Russia estimates the scale of spread of this type of crime and the amount of stolen money. According to statistics, the majority of fraudulent schemes are based on social engineering techniques. The results of a sociological survey of the population conducted under the guidance of the authors of the article are indicated. It is stated that at present the coverage of the population by this type of crime is insignificant, but at the same time the majority of citizens admit that they can become a victim of telephone fraudsters. One tenth of people who receive calls from an unknown number do not interrupt the conversation, even if they realize that a fraudster is calling. Thus, they find themselves in a situation of the greatest risk. It is concluded that citizens do not take an active position in the fight against telephone fraud and very rarely report suspicious calls to the police. Based on the results of the study recommendations are given regarding the improvement of the system of prevention and fight against telephone fraud.

Countering Negative Social Engineering Techniques

The article reveals the issues of counteraction, prevention and suppression of destructive methods of social engineering in the sphere of information-telecommunication interaction. The techniques and methods of destructive social engineering that are currently widespread are considered . The available ways of counteraction and prevention of the negative influence of social engineering are analyzed, reasonable conclusions about the effectiveness of these methods are presented . The ways of solving the problems identified in the course of the study, namely, the methods of suppression (eradication) of negative methods of social engineering are proposed . The conclusions presented in the article have practical significance, which consists in the fact that the provisions and recommendations formulated in them can be used to justify proposals to improve the legislative framework in the field of suppression, prevention and prophylaxis of crimes committed with the use of information and telecommunication technologies .

Discovering the Correlation Between Phishing Susceptibility Causing Data Biases and Big Five Personality Traits Using C-GAN

Recently, on social media, various kinds of social engineering (SE) have made individuals more susceptible to attacks. A phishing attempt is a widely used SE technique that takes advantage of people’s vulnerabilities to acquire personal or confidential information. These attempts are growing at an astonishing speed, causing harm to both individuals and corporations. According to the latest studies, certain individuals are more vulnerable to such kinds of attacks than others. However, the relationship between psychological characteristics and phishing attacks has not been adequately investigated. This study empirically explores the connection between phishing vulnerability that causes data biases and the Big Five personality traits. Recognizing personality traits that make people more vulnerable to phishing attempts is a key step in developing protection and safeguarding individuals. The individuals who scored high in some traits are more probable to suffer from such assault. To the best of our knowledge, no prior quantitative study has attempted to find many genuine phishing victims and their personality behavior. This problem lacks the availability of publically accessible data. It is also challenging to estimate the probability distribution of rows in tabular data and generate realistic synthetic data to train/test the model on more data. This work employs a conditional generative adversarial network (C-GAN) for both data generation and classification to find the correlation between personality traits and phishing attacks.

Detecting Phishing Website Using Machine Learning

Abstract: The Internet has grown to be an essential aspect of our lives, but it has also given rise to instances of harmful activity, such as phishing, that may be carried out anonymously. Phishers attempt to trick their victims by using social engineering techniques or building dummy websites in order to get personal data from people and businesses, including usernames, account IDs, and passwords. Despite the fact that several techniques have been put out to identify phishing websites, scammers have developed ways to evade detection. Machine Learning is one of the best techniques for identifying these harmful actions. This is due to the fact that machine learning techniques can recognise some common traits shared by the majority of phishing assaults. In order to anticipate phishing websites, we compared the outcomes of many machine learning techniques in this article.

Security Risk Scale: A Case of Email Phishing Detection using Text Mining

The rise of cybersecurity defense has led to threat actors needing to deploy more resources to break into systems. However, the human factor remains the weakest link for system penetration through social engineering techniques, especially when phishing is used. While cybersecurity and risk management go hand in hand, a measure of the risk posed by the threats in our environment is a crucial control factor. In this study, an experimental test was conducted on 327 simulated phishing tests with probable responses of mail users. Our goal was to determine the emotion that triggers interaction when a false email is used to trick victims into unintentionally submitting data, providing unauthorized access to the mail server. Four major causes of successful phishing attacks where emotions are triggered were found to be the manipulation of curiosity, fear, authority, and empathy. For enhancing phishing detection, we proposed a framework that dynamically scales the security risks resulting from the social engineering attack through the content of the phishing email received in real time. Although the technical controls have proven to be far more effective in securing systems, the framework provides administrative techniques with risk scales that organizations with mail servers can use to train their staff and resolve the ever-growing security problem of social engineering attacks through phishing emails.

Social Engineering as a Tool for Warfare

In November, 2022, a blog went viral in Nigeria which claimed the United States of America was going to reject Dollar bills printed before the year 2021 as a means of curbing corruption in African countries where criminals and corrupt politician hoard the currency. It turned out to be a false tale, but had resulted in a brief reduction in the exchange rate of the United States Dollar to the Nigerian Naira. This illustrated how fake news could influence events and attitudes in a country, in this case, there was an economic impact (positive for the country); however, other social engineering techniques have been used to manipulate citizenry of countries in recent times, like suspected Russian interference in the United States Presidential elections in 2016 which swayed public opinion in favor Donald Trump and his emergence as president. Social engineering can be managed and controlled by way of awareness training and programs.

The use of semantic analysis in the identification of attacks based on social engineering techniques

The need to detect attacks based on social engineering techniques has put researchers in the position of building different tools, observation grids or even theories able to capture different behaviors specific to simulated behavior. Although phishing is the main attack vector used in most cybersecurity offensive playbooks, the most effective attacks involve dialogue between the attacker and the target. This paper explores threat detection using semantic analysis performed with "Tropes" software.

The analysis of development, typical objectives and mechanisms of phishing attacks

The work discusses the issues of phishing attacks, emphasizing the interconnection between the stages of information technology development and the periods of phishing evolution. Attention is drawn to the fact that any new communication resource or online technology significantly expands the range of possible social engineering techniques, a key element of modern phishing. Based on a review of known incidents, it is asserted that this type of attack will continue to proliferate. The main factors contributing to the further growth of phishing include: -active implementation of artificial intelligence and Internet of Things technologies; -proliferation of satellite Internet; -persistent increase in the number of network users; -technological rivalry among major actors in the post-industrial world. It is emphasized that the increased accessibility of the global Internet will lead to a rise in the number of users of new communication services and platforms. However, the widespread digitization of modern society, coupled with low levels of digital literacy in certain social strata, will result in potential vulnerabilities for large groups of technologically uninformed users. The simultaneous existence of these two trends will increase the number of potential phishing attack victims in the future. It is highlighted that integrating phishing with other types of cyberattacks increases the overall incidence of phishing. The significant prevalence of social networks is noted as a major means of phishing dissemination. The conclusion is drawn that phishing attacks in corporate and private segments of modern information systems, despite their external similarities, aim to obtain substantially different "bonuses" in terms of scale, consequences, and substantive actions. These implicit differences determine the variations in impact vectors and attacking scenarios. Special attention is given to the use of multi-factor authentication, which significantly complicates the impersonation of user identification data, making phishing less effective. It is noted that implementing comprehensive protection against phishing attacks involves continuous improvement of existing security technologies in conjunction with organizational measures. The organizational component should clearly regulate the levels of personal and collective responsibility for the current security status of the utilized systems and information resources.

A holistic qualitative exploration on the perception of scams, scam techniques and effectiveness of anti-scam campaigns in Malaysia

PurposeScams are indeed malicious attempts to influence people and can take many forms, including online scams. With the increasing availability of technology, scammers have more tools at their disposal to create convincing and sophisticated communications that appear to come from legitimate sources, such as emails, text messages or social media posts. These scams can be designed to trick individuals into clicking on malicious links, downloading malware or ransomware or providing sensitive information such as login information, financial information or personal details. Scammers often use social engineering techniques to persuade their targets to take specific actions, such as creating a sense of urgency, offering a reward or prize or posing as a trusted authority. These tactics can be highly effective, particularly if the target is unaware of the warning signs of a scam or is unfamiliar with how to protect themselves from online fraud. This paper aims to explore the extent and nature of this problem and evokes the concern that the general public is vulnerable and susceptible to scams if they are not resilient and aware. This paper also explores why victims fall for online scams and uncovers preventive measures to enable a direction in tacitly strategizing ways to create more impactful and effective awareness campaigns.Design/methodology/approachThis study explores these aspects through a holistic qualitative approach. Using in-depth interview techniques with six victims, six non-victims, four law enforcement officers, four scammers and seven stakeholders from various agencies such as banks, telecommunication agencies and the Malaysian Communications and Multimedia Commission involved in combating the issue of scams.FindingsThe findings generally revealed that participants who were victims of scams felt Malaysians were susceptible to scams, easily fooled and had a nonchalant attitude. Most participants also highlighted that public safety is important for ensuring a high quality of life for citizens that should work closely between the government and non-government agencies, including effective law enforcement and crime prevention strategies.Originality/valueThe uniqueness of this study is the feedback from scammers themselves and their input towards authority and victims. Overall, the respondents provide their views drawing strength from the ever-changing technological background as well as the susceptibility of security features and vulnerability of human engagement.

The Concept of a Subsystem to Support the Management of the Protection of Intangible Assets of Companies from a Behavioural Perspective

The human factor is the biggest challenge for enterprises in providing the expected level of security, whereas the lack of educated personnel is one of the key problems in building an effective system for protection against data and information threats. A human being is a non-programmable element of the system and it is difficult to predict his or her behavior in information management processes and in the face of a specific event. Humans cannot be programmed like some security applications or hardware solutions with predictable performance. Human actions very often have a stochastic effect on the operation of the system. They can be ill-considered, haphazard, affected by emotions, and taken without due attention and adequate knowledge and experience (Pham et al., 2019). All these imperfections are exploited by those whose goal is to destroy or obtain information. According to data published by several information security companies, attacks carried out by purpose-built bots and web applications that exploit a technical factor (e.g., system vulnerabilities) are becoming increasingly rare, and are being replaced by attacks in which human interaction is a key factor. The curiosity and trust, leading well-meaning individuals to click, install, open, and send information, are being exploited by cybercriminals who are increasingly adept at using social engineering techniques.
 The aim of the present paper is to discuss the theoretical basis of information security issues from the behavioral perspective and to present the concept of a subsystem that implements measures to minimize the impact of the human factor on the emergence of threats to the intangible resources of a business entity. The concept is to create an information and organizational space to support the operation of the traditional information security management system in small and medium-sized enterprises. The concept is presented using the object-oriented approach which focuses on the functional elements of the system, and the subject-oriented approach, which takes into account the relationships between the various individuals who affect the security of the information system. The author's models of each approach were presented along with a description of how they work.