The term social engineering refers to the targeted manipulation of people with the aim of gaining access to certain computer systems. So-called phishing emails are a recurring social engineering attack. An attacker tries to trick a user into opening it by means of an email, often with malware as an attachment or a link to a fake website. If the attachment is opened, the attacker gains access to the affected system.

Social engineering is not limited to technical attacks, physical attacks are also possible. In the event of a physical attack, a social engineer tries to, for example, gain access to a building. For this purpose, he can appear as any person to overcome entry controls using psychological tricks. In this context, so-called tailgating (slipping through) is often used. An attacker waits until an authorized person opens a door and sneaks behind it. Access can take place via various entrances (garage, parking lot, rear exit, main entrance, etc.).

​

Whether technical, physical social engineering or a combination of both, you are in the right place with us. Benefit from the many years of experience of our technical experts (hackers) and our undercover agents (social engineers).

​

Technical social engineering

In technical social engineering, our experts use various technical means to infect one or more employees of the customer with modified malware (Trojans / Backdoor / RAT). As soon as the access attempts are successful, the attacker can spread further into the internal network, infect other systems and / or steal data.

Technical social engineering can be divided into two broad categories for the sake of simplicity:

​

Targeted attacks ("spear phishing")

• Targeted attack on people

• Target persons are written to directly

• The attacker selectively collects personal information about the target person

• The attack takes place on a digital level via social media, email, SMS and the like.

• The malware infection can take place via various vectors such as phishing websites, e-mail attachments, etc.

​

Untargeted attacks ("dynamite phishing")

• In this attack, a hacker is trying to attack as many targets as possible. In this approach quantity rules over quality.

• There is no direct salutation in the news.

• The content of the messages is arbitrary.

• The attack takes place on a digital level via social media, email, SMS and the like.

• The malware infection can take place via various vectors such as phishing websites, e-mail attachments, etc.

Physical social engineering

As mentioned above, the goal of a physical social engineering attack is to gain access to a building. A wide range of attacks is available to the social engineer to achieve this goal. A few examples can be found below.

Physical social engineering attacks

• Tailgating (slip through)

• Telephone attacks

• Disguise as a technician, supplier, person of authority, etc.

• Distribution of malware-infected USB sticks in parking lots, toilets, in front of the entrance, etc.

• Picking locks and safes (lock picking)

Your benefit

In practice, social engineering attacks are often rejected with the argument that an attacker would gain access using this type of attack anyway. A social engineering attack is therefore not worthwhile. This attitude is dangerous because it ignores one of the most common attack vectors and you cannot be sure how your employees and your IT security organization will react in an emergency. As everywhere, the motto - practice makes perfect - applies here too.

In short, you can get the following benefits from this service:

1. Promotion of employee awareness

Regularly carried out social engineering attacks with subsequent awareness trainings increase the resilience of your employees towards this frequently occurring form of attack.

2. Attack simulation for training purposes

By repeatedly playing through processes / procedures to defend against attacks, your employees and your IT security team know how to deal with the threat in an emergency. This not only increases the efficiency of your IT security organization, but also your resilience to real attacks.