# data[].attributes.attachment_link.title
Watch a hacker trick these two companies | Social Engineering

# data[].attributes.attachment_link.title
social engineering Attack Demo  - setoolKit - cyber security - #kali #linux

# data[].attributes.attachment_link.description
So, where do we research what the top attack vectors are? Who defines that? I started by grabbing one of the many, many sources:

# data[].attributes.attachment_link.readable_text
Blagging is when someone makes up a story to gain a person's interest and uses this to encourage them to give away information about themselves, or even send money.

For example, a person may receive an email that appears to be from a friend telling them that they're in trouble and asking them to send money.

Similar to blagging, a phishing email will ask a person to send personal details, but pretends to be from a business. They can often look convincing, but may contain spelling errors or that do not match the business's website.

When a person clicks on these links and logs in, it sends their username and password to someone who will use it to access their real accounts. This information might be used to steal a person's money or identity, or the email may contain .

Banks will never send emails asking for personal information or usernames and passwords. If someone receives an email that they think might be phishing, they should report it to the business the sender is claiming to be.

Pharming is a type of cyberattack that redirects a user from a genuine website to a fake one. The fake website will often look like the genuine one. When a person logs in, it sends their username and password to someone who will use it to access their real accounts.

There are several ways that a pharming cyberattack can redirect traffic from a genuine website to a fake one. One example is if the Domain Name Servers ( ) of the website, which match the website address with the of the webserver, are and the IP address is changed to become the address of the pharming site.

Shouldering

This is the simplest form of taking personal details. Shouldering is looking at someone's information over their shoulder, for example looking at someone enter their PIN in a shop or at a cashpoint.

A person can prevent this by using their hand to cover the keypad as they type their PIN, or being aware of people around them when typing in PINs. helps protect against shouldering by masking what is typed, showing an asterisk on the screen instead of the symbol that was entered.

# data[].attributes.attachment_link.title
Social engineering techniques - Fundamentals of cyber security - AQA - GCSE Computer Science Revision - AQA - BBC Bitesize

# data[].attributes.attachment_link.description
Blagging is when someone makes up a story to gain a person's interest and uses this to encourage them to give away information about themselves, or even send money. For example, a person may receive an email that appears to be from a friend telling them that they're in trouble and asking them to send money.

# data[].attributes.attachment_link.readable_text
A former colleague of mine recently shared an email she received from a purported hacker:

The picture is a bit grainy, so here's what it says (censored for obvious reasons; poor grammar left intact for hilarity):

Hello!

I'm a hacker who cracked your email and device a few months ago. You entered a password on one of the sites you visited, and I intercepted it.

This is your password from XXXXX@XXXXX.com on the moment of hack: XXXXXXXXXX

Of course you can will change it, or already changed it. But it doesn't matter, my malware updated it every time.

Do not try to contact me or find me, it is impossible, since I sent you an email from your account.

Through your email, I uploaded malicious code to your Operation System. I saved all of your contacts with friends, colleagues, relatives, and a complete history of visits to the internet resources. Also I installed a Trojan on your device and long tome spying for you.

You are not my only victim, I usually lock computers and ask for a ransom. But I was struck by the sites of intimate content that you often visit.

I am in shock of your fantasies! I've never seen anything like this!

So, when you had fun on piquant sites (you know what I mean) I made screenshot with using my program from your camera of yours device. After that, I combined them to the content of the currently viewed site.

There will be laughter when I send these photos to your contacts! BUT I'm sure you don't want it.

Therefore, I expect payment from you for my silence. I think $833 is an acceptable price for it!

Pay with Bitcoin.

There's a lot to unpack in this message, but the important takeaway is that my friend wasn't actually hacked. Poor grammar aside, the attacker has executed a believable social engineering campaign that sadly many people may fall for.

Let's take a few minutes to dissect this attack and discuss some strategies to keep yourself protected.
Legitimate "From" Email Address
Although I cropped this part out of the original picture, this message was, in fact, "sent" from my friend's email address. The message would have you believe that her computer and email account have been compromised - and that's why she's receiving the message.

In reality, it's really easy to send an email using any "from address". It's just as easy as sending mail via the USPS and using a spoofed "return address" in the upper-left corner of the envelope.
Legitimate "Hacked" Password
Next, the email contained a password that my friend had indeed used at some point in the past. The fact that it's a real password that the recipient would recognize makes this attack very believable.

In reality, my friend had an account involved in an unrelated cyber breach - meaning some other company was hacked, and the password she used on that company's website is what is seen here in the email.
Effective Social Engineering
Ransomware is a thing that many people fall victim to, and it's constantly in the news. People know about it, which is another reason this attack sounds believable. Other cybersecurity buzz words also lend credibility to the message: "cracked", "malicious code", "Trojan", and "malware".

Moreover, the real attack vector in this message is blackmail.

Many, many people love their porn - and as the author of this message would have you believe, my friend allegedly visited some "piquant sites" with "intimate content". She didn't actually, which is why she knew this message was fake, but enough people do that social engineering attacks like this are highly successful.

Simply being aware that social engineering attacks are common is a good first step to protecting yourself. Messages like the one above can be very convincing, but you should always be suspicious whenever you receive a message like this.

The number of data breaches every year ( 4.5B in the first half of 2018 alone!) makes it difficult to keep your personal data from being used in a social engineering attack. Limiting the amount of personal data you put online is always a good idea, but sadly this problem is only going to get worse - being aware of the tactics is ultimately the best way to keep yourself safe.

Another security best practice (and perhaps the most important thing you can do to protect yourself against attacks like this) is to practice good password hygiene. Never use the same password on multiple websites - either you'll actually get hacked, or you'll fall victim to a social engineering attack like the message above.

You should also keep your antivirus software up-to-date, your computer's firewall (or other defensive software) turned on, and take advantage of your email provider's anti-phishing features.

Social engineering attacks can be incredibly convincing and difficult to defend against. The message above tried to convince my friend she was being blackmailed as a result of being hacked - would you fall for a similar message?

# data[].attributes.attachment_link.title
Password Breaches and Social Engineering Attacks

# data[].attributes.attachment_link.description
Social engineering is one of the main ways hackers can gain access to your systems and accounts. Today we discuss how to subvert and thwart those efforts.

# data[].attributes.attachment_caption
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.attachment_caption
Ways to protect from Social engineering attacks.

# data[].attributes.attachment_caption
Social Engineering and It's connection to technical aspect of Cyber security