Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

3/17/2015
04:00 PM
Sara Peters
Sara Peters
Slideshows
Connect Directly
Twitter
RSS
E-Mail

The 7 Best Social Engineering Attacks Ever

Seven reminders of why technology alone isn't enough to keep you secure.
2 of 9

Trojan Horse

The classic example comes all the way from ancient Greece, during the mythological Trojan War (possibly, but probably not based on actual historical events). After an exhausting, unsuccessful 10-year siege of Troy, the Greek army appears to give up. They pack their things, set sail, and leave the Trojans an enormous wooden statue of a noble horse -- an impressive gift to say 'We lose. You win. Good game.'

The Trojans wheel the horse into the gates, congratulate themselves, eat, drink, and be merry themselves into a sound sleep. Little did they know that hidden inside the horse was a small force of Greek soldiers. The soldiers crept out of their equine hideaway during the night, opened the city gates, and let in the rest of the Greek army, which had quietly returned under dark of night while the Trojans were carousing. The Greeks entirely destroyed the city of Troy, and the Trojans who survived had to live with the knowledge that, after their security measures held strong for 10 years, they'd allowed their own undoing by foolishly inviting their destroyers to come right in. 

Mythical or not, if the Trojan Horse weren't such a genius example of a social engineering attack, we'd never have named an entire class of malware after it.

(Image: Mykonos vase (Archaeological Museum of Mykonos, Inv. 2240). Decorated pithos found at Mykonos, Greece depicting one of the earliest known renditions of the Trojan Horse.)

Trojan Horse

The classic example comes all the way from ancient Greece, during the mythological Trojan War (possibly, but probably not based on actual historical events). After an exhausting, unsuccessful 10-year siege of Troy, the Greek army appears to give up. They pack their things, set sail, and leave the Trojans an enormous wooden statue of a noble horse -- an impressive gift to say "We lose. You win. Good game."

The Trojans wheel the horse into the gates, congratulate themselves, eat, drink, and be merry themselves into a sound sleep. Little did they know that hidden inside the horse was a small force of Greek soldiers. The soldiers crept out of their equine hideaway during the night, opened the city gates, and let in the rest of the Greek army, which had quietly returned under dark of night while the Trojans were carousing. The Greeks entirely destroyed the city of Troy, and the Trojans who survived had to live with the knowledge that, after their security measures held strong for 10 years, they'd allowed their own undoing by foolishly inviting their destroyers to come right in.

Mythical or not, if the Trojan Horse weren't such a genius example of a social engineering attack, we'd never have named an entire class of malware after it.

(Image: Mykonos vase (Archaeological Museum of Mykonos, Inv. 2240). Decorated pithos found at Mykonos, Greece depicting one of the earliest known renditions of the Trojan Horse.)

2 of 9
Comment  | 
Print  | 
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
Thomas Claburn
0%
100%
Thomas Claburn,
User Rank: Ninja
3/18/2015 | 6:45:32 PM
name required
Can we all agree to ignore any email that isn't addressed by name?
xmarksthespot
50%
50%
xmarksthespot,
User Rank: Strategist
3/19/2015 | 4:24:22 AM
Good examples
Great article!  Periodic User awareness training to reduce social engineering is of paramount importance.  Some phishing emails are so good that high trained security people can fall for them.  The examples in the article effectively demonstrate the issue.


The rule I use for my own emails is not click links in emails, including unsubscribe, unless the email is expected, such as one as confirmation during new account setup. Of course, never click on attachments either unless they are expected.  I have within Spyshelter (anti-keylogger) where I can save an attachment, right click the file and on the pop-up menu click 'Spyshelter-> Check it on VirusTotal'; it uploads to virustotal.com .   It's then scanned by over 50 antivirus software products. 

I think this rule is probably the most important security measure I use for computers at my home.
delllphi
50%
50%
delllphi,
User Rank: Apprentice
3/24/2015 | 7:21:23 AM
Confidence Man
The name of the "confidence man" was "William Thompson" and not "Samuel Williams". The article "Arrest of the Confidence Man" (New-York Herald, July 8, 1849) can be found online.
mithoon
0%
100%
mithoon,
User Rank: Apprentice
3/28/2015 | 2:37:41 AM
Re: name required
great post
AnonymousC493
50%
50%
AnonymousC493,
User Rank: Apprentice
5/9/2015 | 9:41:21 AM
Social Engineering examples
Here's another example:

https://engineering.social/2015/05/02/sinkholing-script-kiddies/

It's not one of 'the best social engineering attacks' ever, but shows that anyone can be a target.

 

 
MichaelH91401
50%
50%
MichaelH91401,
User Rank: Apprentice
10/1/2015 | 3:18:11 PM
Re: name required
The post refers to "Ferrara" repeatedly, but never describes who he is or what he does. 
Sincee
50%
50%
Sincee,
User Rank: Strategist
10/2/2015 | 4:56:47 AM
thank's for post
system security in any country is the future !
baller188
100%
0%
baller188,
User Rank: Apprentice
3/14/2017 | 6:00:19 AM
Forex security and vulnerabilities
Great post as always. Technology advances every day, new vulnerabilities arise all the time. Security is everyones main priority and rightly so. For any site owner nowadays you need a dedicated security team to make sure you and your customers are safe. Its a scary world out there.
nickhudson
50%
50%
nickhudson,
User Rank: Apprentice
10/5/2017 | 8:03:33 AM
What is Social Engineering really?
I have been reading about the social engineering thing lately, I am getting lots of phishing emails lately and I wonder where I went wrong. May be someone has got a hold of my email. I have become more aware now and I literally check every link before even opening it.
Megan is Always Wright
50%
50%
Megan is Always Wright,
User Rank: Apprentice
10/9/2017 | 11:15:58 AM
Re: What is Social Engineering really?
Social engineering is basically a technique that has long been used by humans even before the birth of the Internet. By using these techniques, the evildoers among us are able to win our trust, or more like fool us into sharing stuff that we shouldn't.

I also didnt understand what it was until i read this article (https://www.purevpn.com/blog/social-engineering-attacks/) which explained what it was and how to protect against it
Page 1 / 2   >   >>
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .