Social engineering describes various non-technical attack techniques cybercriminals use to manipulate users. The attackers hope the user will bypass security or other business process protocols, perform harmful actions, or disclose sensitive information. Beware of these social engineering classics.
Business Email Compromise
Don’t get fooled by official-looking emails even though the email appears to be work-related. Subject lines such as “Invoice Attached” or “Here’s the file you needed” might be a social engineering classic. To be sure, you should hover your cursor over email addresses and links before clicking to see if the sender and type of file are legitimate. BEC is the most costly form of cybercrime. It stems from faked emails called “Business Email Compromise” or BEC scams. A typical BEC scam involves phony emails in which the attacker spoofs a message from an executive at a company and tricks someone into wiring funds to the fraudsters.
Vishing
Corporate phone systems are often set up to forward voice mail audio files to employees’ inboxes. While this is convenient, forwarding the files can be risky. It makes it harder to determine if the email is phony or legit. Since 2014, scammers have been installing malicious software through emails designed to look like internal voicemail messages, making vishing a social engineering classic.
With vishing, cybercriminals use an urgent or alarming voicemail message to try to get potential victims to call back with their personal information. Fake caller ID information is often used to make the calls appear to be from a legitimate organization or business.
Free Stuff, a social engineering classic
Free Stuff is one of the oldest social engineering classics. Most people can’t resist free Stuff, from pizza to software downloads, and they will click just about any link to get it. Of course, nothing is truly free. Sophisticated attackers might send a link to genuine free software, but they’re sending you through their website, which means you may get infected or compromised.
Baiting
Baiting is a variant of “Free Stuff.” The attacker hopes to trick their victims into executing code by piquing their curiosity or convincing them to run hardware or software with hidden malware. For example, innocent-looking USB sticks handed out at a conference or casually “dropped” in the parking could contain malware. They then detonate when the curious user plugs it into their PC. This is how Stuxnet attacked the Iranian nuclear program.
Quid pro quo social engineering classic
Another version of “Free Stuff.” In Latin, Quid pro quo means “something for something.” In exchange, the attacker offers something of genuine worth to the victim and will work their way into the target’s network. An example: The attacker poses as tech support and solves a problem for you, then convinces you to type in a line of code that serves as a “backdoor.” On the other hand, it may be as simple as trading a candy bar in exchange for a password!
Waterholing
This attack plants malware on a website you and your colleagues frequently visit. The next time you surf the site, the malware—such as a remote-access Trojan or RAT—is downloaded to your computer. And just like that, the attacker can begin exfiltrating data from your employer’s network.
Pretexting
Pretexting is another form of social engineering in which attackers focus on creating a fabricated scenario that they can use to try to steal their information. It is a true con game. It relies on the crook fostering a sense of trust in the victim.
Pretexting can also impersonate co-workers, police, banks, or tax authorities. It pretends to be any individual who could have perceived authority or right-to-know in the targeted victim’s mind. In some cases, all that is needed is an authoritative voice, an earnest tone, and an ability to think on one’s feet to create a pretext scenario.
Related article
Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.
The actress takes over the number one spot from 
Dan Moen at WordFence explains that the Yuzo Related Posts (YRP) plugin for WordPress has an unpatched vulnerability that was publicly disclosed by a security researcher on March 30, 2019. The flaw which allows stored 
