Social engineering and phishing

The lecture's framing of phone-based social engineering as a 20th-century tactic and phishing as its 21st-century successor, the verified figures from the 1996 University of Sydney phishing study, and URL spoofing in bank-phishing emails.

Explain the lecture's 20th- versus 21st-century framing of social engineering and phishing.
Give the lecture's own examples of phone-based social engineering, with their figures.
State all four figures from the 1996 University of Sydney phishing study.
Explain URL spoofing and how it appears in bank-phishing emails.

11 min read

Intuition

“Only amateurs attack machines; professionals target people,” the lecture opens. A firewall does not have biases to exploit, but the person sitting behind it does. Social engineering and phishing are two names for the same underlying move — getting someone to hand over access voluntarily — separated mainly by channel and by which decade favoured them.

Mechanism

Social engineering means hacking a system through the people who use it: tricking someone into disclosing confidential information, granting access, or taking an action that compromises security, most often to steal credentials or an identity. Phishing is the same goal pursued through deceptive emails, messages or websites built to look like they come from a source the target already trusts.

The lecture places the two on a timeline: phone-based social engineering was the dominant tactic for hacking systems through people in the 20th century, and online phishing has taken over as the dominant tactic in the 21st. Neither technique disappeared — the phone scam still works, and a modern phishing campaign can borrow the same authority and urgency framing a phone caller would use — but the lecture’s own examples split cleanly along that line.

Compare

A stolen ATM card followed by a call posing as the bank, asking whether the card was stolen and implying the PIN is needed to cancel it. A 2007 internal audit phoned 102 IRS employees, asked for their user IDs, and told them to change their password to a value the caller supplied — 62 complied.

A 1996 email to 336 University of Sydney computer science students, asking for their password to “validate” the database after a suspected break-in. Modern bank-phishing emails reuse a real bank’s own content and branding, changing only the link destination to a fake login page.

Exam detail

The 1996 University of Sydney phishing study. 336 computer science students were emailed and asked to send in their password to “validate” the password database after a suspected break-in. 138 returned a valid password. 30 returned an invalid one. 200 never replied to the email at all, but changed their password anyway — reacting to something that felt wrong without being told exactly what it was. Very few of the students reported the email to anyone. Anderson’s Security Engineering (3rd ed., §3.3.3) independently confirms all four figures, citing T. Greening’s 1996 study “Ask and ye shall receive: a study in social engineering.”

Pitfall

Treat the three outcome groups from the 1996 study as three different reactions, not two. 138 fell for it outright; 30 sent back something that would not have worked but still engaged with the email; 200 neither replied nor fell for it, and instead changed their password unprompted. A question asking “how many reacted without being deceived” wants 200, not 336 minus 138.

Exam detail

The 2007 IRS audit. The Treasury Inspector General for Tax Administration tested the same weakness by phone. Audit staff contacted 102 IRS employees at various levels, requested their user IDs, and instructed them to change their passwords to a pre-determined value. 62 of the 102 complied — a majority, from a government agency, based on nothing but a phone call.

Threat

URL spoofing. Recent bank-phishing attacks reuse a genuine bank email’s own content and layout, changing only the link destination — a login button that reads correctly but points to a fake login page. The slides’ example is a domain like www.paypals.com/login, one character removed from paypal.com and easy to miss inside a plausible-looking email. This is a different mechanism from the typosquatting covered in 02-02: typosquatting depends on the user mistyping a URL themselves, while URL spoofing puts the fake link directly in front of them inside content that otherwise looks legitimate.

Control

The lecture does not give this section its own dedicated technical countermeasure. What it offers instead is spread across the rest of the module: recognising the persuasion techniques a caller or email is using (02-03), not trusting a message just because its logo and layout look right — the clustering illusion and confirmation bias covered in 02-02 — and limiting what a disclosed password can actually cost, covered in 02-05.

Recall

In the 1996 University of Sydney study, which group of students reacted safely without ever replying to the phishing email?

The 200 who changed their password without sending one back. They neither fell for the request (138 did) nor sent back a useless reply that still engaged with it (30 did) — they treated the email itself as the warning sign.

Source

Week 2 Notes PDF