Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

3/17/2015
04:00 PM
Sara Peters
Sara Peters
Slideshows
Connect Directly
Twitter
RSS
E-Mail

The 7 Best Social Engineering Attacks Ever

Seven reminders of why technology alone isn't enough to keep you secure.
2 of 9

Trojan Horse

The classic example comes all the way from ancient Greece, during the mythological Trojan War (possibly, but probably not based on actual historical events). After an exhausting, unsuccessful 10-year siege of Troy, the Greek army appears to give up. They pack their things, set sail, and leave the Trojans an enormous wooden statue of a noble horse -- an impressive gift to say 'We lose. You win. Good game.'

The Trojans wheel the horse into the gates, congratulate themselves, eat, drink, and be merry themselves into a sound sleep. Little did they know that hidden inside the horse was a small force of Greek soldiers. The soldiers crept out of their equine hideaway during the night, opened the city gates, and let in the rest of the Greek army, which had quietly returned under dark of night while the Trojans were carousing. The Greeks entirely destroyed the city of Troy, and the Trojans who survived had to live with the knowledge that, after their security measures held strong for 10 years, they'd allowed their own undoing by foolishly inviting their destroyers to come right in. 

Mythical or not, if the Trojan Horse weren't such a genius example of a social engineering attack, we'd never have named an entire class of malware after it.

(Image: Mykonos vase (Archaeological Museum of Mykonos, Inv. 2240). Decorated pithos found at Mykonos, Greece depicting one of the earliest known renditions of the Trojan Horse.)

Trojan Horse

The classic example comes all the way from ancient Greece, during the mythological Trojan War (possibly, but probably not based on actual historical events). After an exhausting, unsuccessful 10-year siege of Troy, the Greek army appears to give up. They pack their things, set sail, and leave the Trojans an enormous wooden statue of a noble horse -- an impressive gift to say "We lose. You win. Good game."

The Trojans wheel the horse into the gates, congratulate themselves, eat, drink, and be merry themselves into a sound sleep. Little did they know that hidden inside the horse was a small force of Greek soldiers. The soldiers crept out of their equine hideaway during the night, opened the city gates, and let in the rest of the Greek army, which had quietly returned under dark of night while the Trojans were carousing. The Greeks entirely destroyed the city of Troy, and the Trojans who survived had to live with the knowledge that, after their security measures held strong for 10 years, they'd allowed their own undoing by foolishly inviting their destroyers to come right in.

Mythical or not, if the Trojan Horse weren't such a genius example of a social engineering attack, we'd never have named an entire class of malware after it.

(Image: Mykonos vase (Archaeological Museum of Mykonos, Inv. 2240). Decorated pithos found at Mykonos, Greece depicting one of the earliest known renditions of the Trojan Horse.)

2 of 9
Comment  | 
Print  | 
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
Thomas Claburn
0%
100%
Thomas Claburn,
User Rank: Ninja
3/18/2015 | 6:45:32 PM
name required
Can we all agree to ignore any email that isn't addressed by name?
xmarksthespot
50%
50%
xmarksthespot,
User Rank: Strategist
3/19/2015 | 4:24:22 AM
Good examples
Great article!  Periodic User awareness training to reduce social engineering is of paramount importance.  Some phishing emails are so good that high trained security people can fall for them.  The examples in the article effectively demonstrate the issue.


The rule I use for my own emails is not click links in emails, including unsubscribe, unless the email is expected, such as one as confirmation during new account setup. Of course, never click on attachments either unless they are expected.  I have within Spyshelter (anti-keylogger) where I can save an attachment, right click the file and on the pop-up menu click 'Spyshelter-> Check it on VirusTotal'; it uploads to virustotal.com .   It's then scanned by over 50 antivirus software products. 

I think this rule is probably the most important security measure I use for computers at my home.
delllphi
50%
50%
delllphi,
User Rank: Apprentice
3/24/2015 | 7:21:23 AM
Confidence Man
The name of the "confidence man" was "William Thompson" and not "Samuel Williams". The article "Arrest of the Confidence Man" (New-York Herald, July 8, 1849) can be found online.
mithoon
0%
100%
mithoon,
User Rank: Apprentice
3/28/2015 | 2:37:41 AM
Re: name required
great post
AnonymousC493
50%
50%
AnonymousC493,
User Rank: Apprentice
5/9/2015 | 9:41:21 AM
Social Engineering examples
Here's another example:

https://engineering.social/2015/05/02/sinkholing-script-kiddies/

It's not one of 'the best social engineering attacks' ever, but shows that anyone can be a target.

 

 
MichaelH91401
50%
50%
MichaelH91401,
User Rank: Apprentice
10/1/2015 | 3:18:11 PM
Re: name required
The post refers to "Ferrara" repeatedly, but never describes who he is or what he does. 
Sincee
50%
50%
Sincee,
User Rank: Strategist
10/2/2015 | 4:56:47 AM
thank's for post
system security in any country is the future !
baller188
100%
0%
baller188,
User Rank: Apprentice
3/14/2017 | 6:00:19 AM
Forex security and vulnerabilities
Great post as always. Technology advances every day, new vulnerabilities arise all the time. Security is everyones main priority and rightly so. For any site owner nowadays you need a dedicated security team to make sure you and your customers are safe. Its a scary world out there.
nickhudson
50%
50%
nickhudson,
User Rank: Apprentice
10/5/2017 | 8:03:33 AM
What is Social Engineering really?
I have been reading about the social engineering thing lately, I am getting lots of phishing emails lately and I wonder where I went wrong. May be someone has got a hold of my email. I have become more aware now and I literally check every link before even opening it.
Megan is Always Wright
50%
50%
Megan is Always Wright,
User Rank: Apprentice
10/9/2017 | 11:15:58 AM
Re: What is Social Engineering really?
Social engineering is basically a technique that has long been used by humans even before the birth of the Internet. By using these techniques, the evildoers among us are able to win our trust, or more like fool us into sharing stuff that we shouldn't.

I also didnt understand what it was until i read this article (https://www.purevpn.com/blog/social-engineering-attacks/) which explained what it was and how to protect against it
Page 1 / 2   >   >>
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16317
PUBLISHED: 2019-09-14
In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerabi...
CVE-2019-16318
PUBLISHED: 2019-09-14
In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
CVE-2019-16307
PUBLISHED: 2019-09-14
A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter (webExMeetingLogin.jsp) and meetingKe...
CVE-2019-16294
PUBLISHED: 2019-09-14
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.
CVE-2019-16309
PUBLISHED: 2019-09-14
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.