What is Social Hacking?

With technological advancements and the digitalization of the world, social hacking has evolved into multiple types. The goal behind all those types of social hacking is the same, i.e., to access sensitive information or demand money. When hackers learn about their targeted individuals, they decide which type of social hacking can be the most successful. Below is a quick look at some of the most common types of social hacking:

Phishing

Electronic Email Phishing is used frequently in social hacking attacks. In a phishing attack, the attackers send fraudulent emails that seem to be coming from a trusted source but are intended to direct the user to a malicious website to access personal information or make the user download software (malware infected).

Phishing attacks are primarily based on emails but can also be executed via text messages. An example of a phishing attack can be an alert message of a policy violation from an online service or bank that requires an immediate password change. Similarly, an email from the bank manager claiming to have some vital information related to the account requires some verification. In short, hackers intend to create different scenarios and then send them randomly to hundreds of individuals to expect a few victims.

Spear Phishing

Spear phishing is similar to a phishing attack, but this time the email is designed for a specific individual or organization. The target is to make the attack look more legitimate by orienting it based on the job position or co-workers. The CEO email example we discussed above is precisely how spear phishing works.

Spear phishing demands more effort than a random phishing attack and might take weeks, if not months, to make it work. However, spear phishing offers more success because it is much more difficult to detect and mostly seems legitimate.

Pretexting

Pretexting is another popular social hacking type in which hackers create a scenario where the user feels comfortable providing whatever information the hackers ask. Hackers mostly set up a collection of smartly crafted lies beforehand so that they gradually deploy them based on the scenario.

The hacker pretends to be a banker, policeman, co-worker, or tax officer who has the right to ask for sensitive information. So, the hacker establishes trust with the individuals and then asks them to confirm their identity. This way, they slowly start grabbing personal data, such as social security numbers, bank details, addresses, etc.

Scareware

As the name implies, scareware triggers scare emotions in the targeted individuals mainly by fictitious threats or false alarms. Most often, individuals are made to think that something has happened to their system, and they can fix the issue by installing the provided software, which is mostly the malware itself.

You might have seen a pop-up message appearing suddenly in your browser, claiming that some harmful virus may infect your system. It will either ask you to click the link or provide software (malware itself) to inspect and fix your system. Other than this form of scareware, hackers also use spam emails to show warnings or some attractive services to trick individuals somehow.

Baiting

Baiting attacks present something curious in front of the user, urging the user to explore it more. From the technological perspective, a baiting attack can appear as tempting ads on something like gift cards and free software products.

When the user clicks the ad, the link might take him to a malicious website, encourage him to download malware into the system or try to trick him into providing personal information. In short, baiting is the type of social hacking that triggers the excitement or curiosity of users and then manipulate their behaviors.