A call to the help desk
A caller says: "I am from the head office. My laptop is locked and I am late for a meeting. Please reset my password now."
The voice is friendly and in a hurry. The help desk worker feels bad for them.
No computer was hacked. A person was tricked. Today you learn the many ways this is done.
By the end of this lesson
Note
I can name seven social engineering attacks, say how each tricks a person and give one defence for each.
Key words
| Word | What it means |
|---|---|
| Social engineering | Tricking a person into giving access or data. |
| Phishing | A fake email sent to many people to steal data or money. |
| Spear phishing | A fake email written for one chosen person or group. |
| Smishing | Phishing by text message (SMS). |
| Vishing | Phishing by phone call (voice). |
| Pharming | Sending you to a fake website even when you type the right address. |
| Watering hole attack | Infecting a website that a chosen group often visits. |
| USB baiting | Leaving an infected USB stick where someone will find it and plug it in. |
| Spoofing | Making a message or website look like it comes from someone you trust. |
| Network | Computers joined together so they can share data. |
| DNS | Domain name system: the service that turns a website name into a number a computer can find. |
| Malware | Harmful software. |
| Urgency | A feeling that you must act now. |
The cells students fill in are left blank in this preview.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: why tricking people works
It is often easier to fool a person than to break a system.
Social engineers use feelings: urgency ("act now"), fear ("your account is closed"), greed ("you won a prize") and helpfulness ("please help me").
They often spoof a trusted name, such as your bank, a boss or the college.
The phishing family
Phishing: a fake email sent to thousands. Most ignore it. A few click.
Spear phishing: the email is written for one person. It uses their name, job and real details. It is far more believable.
Smishing: the same trick in a text message. "Your parcel is held. Pay 1 pound here."
Vishing: the same trick on a phone call, like the help desk caller.
Three more tricks
Pharming: you type the right web address but land on a fake site, because the address was changed behind the scenes. The next lesson explains how.
Watering hole attack: the attacker infects a website that your group often uses, such as a college suppliers' site. Visitors catch the malware.
USB baiting: an infected USB stick is left in a car park with a label like "Salaries". Someone plugs it in.
Impact and defence
| Attack | Impact | Defence |
|---|---|---|
| Phishing | Stolen passwords or money | Check the sender and link. Report it. Staff training |
| Spear phishing | A targeted breach | Ask a second way, such as a call to a known number |
| Smishing | Stolen card or login | Never follow links in unexpected texts |
| Vishing | Passwords reset for a stranger | Check the caller's identity by a known number |
| Pharming | Logins stolen on a fake site | Look for the padlock, use MFA, protect the DNS |
| Watering hole | Malware on many computers | Updates, anti-malware, a web filter |
| USB baiting | Malware inside the network | Never plug in unknown USB sticks. Block USB ports |
The cells students fill in are left blank in this preview.