Social engineering attack examples, templates and scenarios

• Published in: Computers & security Vol. 59; pp. 186 - 209
• Main Authors: Mouton, Francois, Leenen, Louise, Venter, H.S.
• Format: Journal Article
• Language: English
• Published: Amsterdam Elsevier Ltd 01.06.2016; Elsevier Sequoia S.A
• Subjects: Bidirectional communication; Computer information security; Data integrity; Engineering; Human; Indirect communication; Intrusion detection systems; Leaking of information; Links; Manipulation; Mapping; Mitnick's attack cycle; Social engineering; Social engineering attack detection model; Social engineering attack examples; Social engineering attack framework; Social engineering attack scenario; Social engineering attack templates; Studies; Unidirectional communication; Unidirectional communication; Social engineering attack framework; Bidirectional communication; Social engineering; Social engineering attack detection model; Social engineering attack templates; Social engineering attack examples; Indirect communication; Mitnick's attack cycle; Social engineering attack scenario
• ISSN: 0167-4048; 1872-6208
• DOI: 10.1016/j.cose.2016.03.004

The field of information security is a fast-growing discipline. Even though the effectiveness of security measures to protect sensitive information is increasing, people remain susceptible to manipulation and thus the human element remains a weak link. A social engineering attack targets this weakness by using various manipulation techniques to elicit sensitive information. The field of social engineering is still in its early stages with regard to formal definitions, attack frameworks and templates of attacks. This paper proposes detailed social engineering attack templates that are derived from real-world social engineering examples. Current documented examples of social engineering attacks do not include all the attack steps and phases. The proposed social engineering attack templates attempt to alleviate the problem of limited documented literature on social engineering attacks by mapping the real-world examples to the social engineering attack framework. Mapping several similar real-world examples to the social engineering attack framework allows one to establish a detailed flow of the attack whilst abstracting subjects and objects. This mapping is then utilised to propose the generalised social engineering attack templates that are representative of real-world examples, whilst still being general enough to encompass several different real-world examples. The proposed social engineering attack templates cover all three types of communication, namely bidirectional communication, unidirectional communication and indirect communication. In order to perform comparative studies of different social engineering models, processes and frameworks, it is necessary to have a formalised set of social engineering attack scenarios that are fully detailed in every phase and step of the process. The social engineering attack templates are converted to social engineering attack scenarios by populating the template with both subjects and objects from real-world examples whilst still maintaining the detailed flow of the attack as provided in the template. Furthermore, this paper illustrates how the social engineering attack scenarios are applied to verify a social engineering attack detection model. These templates and scenarios can be used by other researchers to either expand on, use for comparative measures, create additional examples or evaluate models for completeness. Additionally, the proposed social engineering attack templates can also be used to develop social engineering awareness material.