Malicious APKs (Android Package format) files are being used by cybercriminals by using social engineering methods as new means to scam users.

• Example: In a Recent case of cyber fraud, a woman claimed having lost upto Rs.1 lakh after she downloaded an app on her iPhone via an APK file on WhatsApp at the Bengaluru airport lounge.
  • Social Engineering Technique was used to download the malicious apps by which the device was accessed and likely enabled call forwarding.

About Social engineering in Cyber Crime

• Social Engineering  is a cyber crime technique that uses psychological manipulation and deceiving human emotion to trick users into revealing sensitive information or making security mistakes.

• Common Techniques: 

• • Phishing: These are email and text message campaigns which are aimed at creating a sense of urgency, or fear in victims prodding  them into revealing sensitive information, clicking on links to malicious websites, or opening attachments that contain malware.
    • Example:  An email sent to users of an online service that alerts them of a policy violation requiring immediate action on their part, such as a required password change. 
  • Baiting: A technique that uses a false promise to lure victims into a trap that steals their personal information or infects their systems with malware. 
    • Example: Baiting usually uses physical media to disperse malware (typically malware-infected flash drives) in areas where potential victims are certain to see them (e.g., bathrooms, elevators etc). Also  Online forms of baiting consist of enticing ads that lead to malicious sites
    • Scareware: A technique that involves bombarding victims with false alarms and threats to trick them into installing software that is either malware or has no real benefit.

Enroll now for UPSC Online Classes

• Example: A common example being the popup banners appearing in browser while surfing the web, displaying such text such as, “Your computer may be infected with harmful spyware programs.” 
• Pretexting: A technique that involves gaining a victim’s trust through a series of lies, often by pretending to need sensitive information to perform a critical task. 
• Quid pro quo: A technique that exploits people’s tendency to reciprocate good gestures.
  • For example, an attacker may offer free technical support in exchange for the victim turning off their antivirus software. 
• Deep Fakes: A technique that uses artificial intelligence (AI) to create realistic but fake audio, video, or images that impersonate real people. 
• Watering hole attacks: A targeted technique that involves compromising a website that is likely to be visited by a particular group of people. 

• Reasons for its Prevalence:

• • • Lack of Security Knowledge: Many employees lack the knowledge to identify and defend themselves against these types of attacks as social engineering attacks are designed to exploit human weaknesses.
    • Social Media Presence: Social engineers use deception and manipulation to pose as friends or family members or pretend to be from a trusted organisation like a bank or government agency often targeting people with an active social media presence.
    • Appealing to Greed: The infamous Email Nigerian Prince scam of 2018 is an example of catering to the human nature of greed. In the scam,a Nigerian royal claims to offer a giant financial reward in exchange for the recipient’s bank account information or a small advance fee.
    • Appealing to Generosity: It can also appeal to victims’ better nature like to offer technical help to a friend or ask for participation in a survey, claiming  that the recipients’ post has gone viral and providing  a spoofed link to a fake website or malware download. 

• Social Engineering Prevention: 

• • Double Check on the Information: Do not open emails and attachments from suspicious or unknown sources. Also always cross-check and confirm the news in an email from other sources, such as via telephone or directly from a service provider’s site if suspicion arises.
  • Use Multifactor Authentication: Using multi factor authentication helps ensure your account’s protection in the event of system compromise as user credentials are one of the most valuable pieces of information seeked by attackers
  • Up to date Antivirus/Antimalware Software: Periodically check to make sure that the updates have been applied, and scan your system for possible infections.
  • Cyber Security Awareness: General Education on the multiple types of social engineering scams and use of  free tools such as phishing simulators, training videos, and cyber security assessments to strengthen organisation and reduce human risk 
  • Training Modules: Social engineering awareness training model uses animated videos, interactive online training, managed security services, microlearning modules, and phishing simulations to provide continual support.

Enroll now for UPSC Online Classes

DOWNLOAD PDF