Many years ago, when Social engineering started via mails, you could appreciate and easily identify, if careful, that this is a phishing mail. You could find mistakes in the emails which were sent - different font sizes in different lines, absurd mail ids etc. With time everyone improves and so have the social engineers. It’s a new world and the rules of the game have changed completely. Welcome to the new age of social engineering.
Warrior Alone
For most users, the experience of dealing with a phishing mail is a solitary one. When you receive a mail in your inbox, you are the one who decides whether to open it or discard it, reply to or flag it etc. If you take a wrong step, you can get the organization in grave danger. Occasionally, everyone has an inkling to either Respond to or click on a link which is provided in a mail.
Today’s social engineering schemes are a step ahead. Let’s consider some of them:
- 1.Let’s Reply Back -
In earlier times when phishing mailers were sent, no one bothered to answer those emails in case you had a query. However, in today’s world, the players of this game spend both time and energy by responding to each and every query to sound genuine.
Consider this mail chain: The mail is responded back and has a trickery when first sent out. The link is deliberately made not to work in the first mail sent. You may find it strange, but it’s a strategy. In this manner, people who respond back will definitely fall in the trap of the malicious person. Since you receive a response back, you consider it to be genuine.
2.Let’s be Vague
Well, you may find it funny, but we have a tendency to respond to vague e-mails. We need to find more about the mail sent to us. Consider this mail communication in which a fake mail comes. Since it is vague in nature and questions my work, I may respond to it like I did in this example below. The attachment containing the malware is now sent. Look at the note which is deliberately put to make me angry so that I should open it. Even though the attachment may not be applicable to me, the work of the malicious person is done, the moment I open it.
3. I did my homework
When malicious people want to target the top management, they do a lot of homework before sending such mailers. Consider the mail chain below: Jack is the CEO of IloveITSolutions and is on a visit to a client location at California, Hotel Five Seasons. ( How do I know – Well he checked in Facebook , tweeted about the client name , posted a photo with the client on Insta). Maya is the secretary of Jack and receives the following email.
- You may wonder that how can a person respond to emails like that. The mail IDs are crafted with such perfection that it becomes really difficult if you do not give attention to the minute details.
Hypothetical Examples:
Original Mail ID – [email protected]
Fake – [email protected]
What can we do? Simple – Pay attention. Do not respond to emails just like that. Check the sender’s mail id always. Save the attachment, scan it and only then open it. Your attention can save everyone.
- Be Smart, Be Cybersafe.
- Note - This article is written to spread security awareness. All links are fictitious.
