Social engineering and phishing

Social engineering and phishing both get the victim to hand over access

“Only amateurs attack machines; professionals target people,” the lecture opens. A firewall has no biases to exploit, but the person sitting behind it does. Social engineering means hacking a system through the people who use it: tricking someone into disclosing confidential information, granting access, or taking an action that compromises security, most often to steal credentials or an identity. Phishing is the same goal pursued through deceptive emails, messages or websites built to look like they come from a source the target already trusts.

The two are separated mainly by channel and decade. Phone-based social engineering was the dominant tactic in the 20th century, and online phishing has taken over in the 21st. Neither disappeared: the phone scam still works, and a modern phishing campaign can borrow the authority and urgency framing a phone caller would use.

Compare

Social engineering (the phone era)

A stolen ATM card followed by a call posing as the bank, asking whether the card was stolen and implying the PIN is needed to cancel it. A 2007 internal audit phoned 102 IRS employees, asked for their user IDs, and told them to change their password to a value the caller supplied. 62 complied.

Phishing (the email and web era)

A 1996 email to 336 University of Sydney computer science students, asking for their password to “validate” the database after a suspected break-in. Modern bank-phishing emails reuse a real bank’s own content and branding, changing only the link destination to a fake login page.

The numbers show how often it works

The 2007 IRS audit was run by the Treasury Inspector General for Tax Administration. Audit staff contacted 102 IRS employees at various levels, and 62 complied: a majority, from a government agency, on nothing but a phone call.

Exam detail

The 1996 University of Sydney phishing study. 336 computer science students were emailed and asked to send in their password to “validate” the password database after a suspected break-in. 138 returned a valid password. 30 returned an invalid one. 200 never replied to the email at all, but changed their password anyway, reacting to something that felt wrong without being told exactly what it was. Very few of the students reported the email to anyone. Anderson’s Security Engineering (3rd ed., §3.3.3) independently confirms all four figures, citing T. Greening’s 1996 study “Ask and ye shall receive: a study in social engineering.”

Pitfall

Treat the three outcome groups from the 1996 study as three different reactions, not two. 138 fell for it outright; 30 sent back something that would not have worked but still engaged with the email; 200 neither replied nor fell for it, and instead changed their password unprompted. A question asking “how many reacted without being deceived” wants 200, not 336 minus 138.

Recall

In the 1996 University of Sydney study, which group of students reacted safely without ever replying to the phishing email?

The 200 who changed their password without sending one back. They neither fell for the request (138 did) nor sent back a useless reply that still engaged with it (30 did). They treated the email itself as the warning sign.

URL spoofing puts the fake link inside content that looks legitimate

Recent bank-phishing attacks reuse a genuine bank email’s own content and layout, changing only the link destination: a login button that reads correctly but points to a fake login page. The slides’ example is a domain like www.paypals.com/login, one character removed from paypal.com and easy to miss inside a plausible-looking email. This differs from the typosquatting in 02-02: typosquatting depends on the user mistyping a URL themselves, while URL spoofing puts the fake link directly in front of them.

The lecture gives this no dedicated technical countermeasure. What it offers is spread across the module: recognising the persuasion techniques a caller or email is using (02-03), not trusting a message because its logo and layout look right (the clustering illusion and confirmation bias in 02-02), and limiting what a disclosed password can cost (02-05).