Social Engineering Attacks: A Survey

The advancements in digital communication technology have made communication between humans more accessible and instant. However, personal and sensitive information may be available online through social networks and online services that lack the security measures to protect this information. Communication systems are vulnerable and can easily be penetrated by malicious users through social engineering attacks. These attacks aim at tricking individuals or enterprises into accomplishing actions that benefit attackers or providing them with sensitive data such as social security number, health records, and passwords. Social engineering is one of the biggest challenges facing network security because it exploits the natural human tendency to trust. This paper provides an in-depth survey about the social engineering attacks, their classifications, detection strategies, and prevention procedures.

[1]  Xiangyu Liu,et al.  Social Engineering and Insider Threats , 2017, 2017 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC).

[2]  Kerry-Lynn Thomson,et al.  Towards Culturally Sensitive Policy: Africanising Approaches to Prevent Social Engineering , 2018 .

[3]  Nadezhda N. Pokrovskaia,et al.  Social engineering and digital technologies for the security of the social capital' development , 2017, 2017 International Conference "Quality Management,Transport and Information Security, Information Technologies" (IT&QM&IS).

[4]  Maria Papadaki,et al.  Improving Awareness of Social Engineering Attacks , 2009, World Conference on Information Security Education.

[5]  Siye Wang,et al.  Blockchain-based Mutual Authentication Security Protocol for Distributed RFID Systems , 2018, 2018 IEEE Symposium on Computers and Communications (ISCC).

[6]  Martin J. Tunnicliffe,et al.  A layered defense mechanism for a social engineering aware perimeter , 2016, 2016 SAI Computing Conference (SAI).

[7]  Michael A. Chargo.  You’ve Been Hacked: How to Better Incentivize Corporations to Protect Consumers’ Data , 2018 .

[8]  Yue Xu,et al.  Measuring Source Credibility of Social Engineering Attackers on Facebook , 2016, 2016 49th Hawaii International Conference on System Sciences (HICSS).

[9]  David A. Wagner,et al.  Detecting Credential Spearphishing in Enterprise Settings , 2017, USENIX Security Symposium.

[10]  Adam Doupé,et al.  SoK: Everyone Hates Robocalls: A Survey of Techniques Against Telephone Spam , 2016, 2016 IEEE Symposium on Security and Privacy (SP).

[11]  Patrick Traynor,et al.  CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data , 2016, 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS).

[12]  Stefano Zanero,et al.  HelDroid: Dissecting and Detecting Mobile Ransomware , 2015, RAID.

[13]  George R. S. Weir,et al.  Vulnerability to social engineering in social networks: a proposed user-centric framework , 2016, 2016 IEEE International Conference on Cybercrime and Computer Forensic (ICCCF).

[14]  Martin Libicki.  Could the Issue of DPRK Hacking Benefit from Benign Neglect? , 2018 .

[15]  RYAN HEARTFIELD,et al.  A Taxonomy of Attacks and a Survey of Defence Mechanisms for Semantic Social Engineering Attacks , 2015, ACM Comput. Surv..

[16]  Ali Ismail Awad,et al.  Cyber and Physical Security Vulnerability Assessment for IoT-Based Smart Homes , 2018, Sensors.

[17]  Wouter Joosen,et al.  TabShots: client-side detection of tabnabbing attacks , 2013, ASIA CCS '13.

[18]  Campus Universitário,et al.  A FORMAL CLASSIFICATION OF INTERNET BANKING ATTACKS AND VULNERABILITIES , 2011 .

[19]  George Danezis,et al.  Scoping the Cyber Security Body of Knowledge , 2018, IEEE Security & Privacy.

[20]  Victor I. Chang,et al.  From Intrusion Detection to an Intrusion Response System: Fundamentals, Requirements, and Future Directions , 2017, Algorithms.

[21]  Nabie Y. Conteh,et al.  Cybersecurity:risks, vulnerabilities and countermeasures to prevent social engineering attacks , 2016 .

[22]  Andrea J. Cullen,et al.  The social engineering attack spiral (SEAS) , 2016, 2016 International Conference On Cyber Security And Protection Of Digital Services (Cyber Security).

[23]  Yousef Jaradat,et al.  On tackling social engineering web phishing attacks utilizing software defined networks (SDN) approach , 2016, 2016 2nd International Conference on Open Source Software Computing (OSSCOM).

[24]  Giulio Sandini,et al.  Trust and Social Engineering in Human Robot Interaction: Will a Robot Make You Disclose Sensitive Information, Conform to Its Recommendations or Gamble? , 2018, IEEE Robotics and Automation Letters.

[25]  Abhishek Singhal,et al.  A literature survey on social engineering attacks: Phishing attack , 2016, 2016 International Conference on Computing, Communication and Automation (ICCCA).

[26]  Deepak Singh Tomar,et al.  An Approach To Perceive Tabnabbing Attack , 2012 .

[27]  Shivam Lohani.  Social Engineering: Hacking into Humans , 2019 .

[28]  Chen-Chi Shing,et al.  Email trouble: Secrets of spoofing, the dangers of social engineering, and how we can help , 2017, 2017 13th International Conference on Natural Computation, Fuzzy Systems and Knowledge Discovery (ICNC-FSKD).

[29]  Maksim V. Abramov,et al.  Social engineering attack modeling with the use of Bayesian networks , 2016, 2016 XIX IEEE International Conference on Soft Computing and Measurements (SCM).

[30]  Edward Apeh,et al.  A model for social engineering awareness program for schools , 2016, 2016 10th International Conference on Software, Knowledge, Information Management & Applications (SKIMA).

[31]  Gundars Alksnis,et al.  Security Evaluation of Wireless Network Access Points , 2017, Appl. Comput. Syst..

[32]  Hugo Barbosa,et al.  SOCIAL ENGINEERING AND CYBER SECURITY , 2017 .

[33]  Kristian Beckers,et al.  A Serious Game for Eliciting Social Engineering Security Requirements , 2016, 2016 IEEE 24th International Requirements Engineering Conference (RE).

[34]  Rizik M. H. Al-Sayyed,et al.  Online Social Networks Security: Threats, Attacks, and Future Directions , 2017 .

[35]  Maumita Bhattacharya,et al.  A framework to mitigate social engineering through social media within the enterprise , 2016, 2016 IEEE 11th Conference on Industrial Electronics and Applications (ICIEA).

[36]  Tom Chothia,et al.  Phishing Attacks: Learning by Doing , 2018, ASE @ USENIX Security Symposium.

[37]  Preeti Nagrath,et al.  Protocols for mitigating blackhole attacks in delay tolerant networks , 2016, Wirel. Networks.

[38]  K. Chandrasekaran,et al.  A client-side anti-pharming (CSAP) approach , 2016, 2016 International Conference on Circuit, Power and Computing Technologies (ICCPCT).

[39]  Leyla Bilge,et al.  Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks , 2015, DIMVA.

[40]  Lee Hadlington,et al.  The "Human Factor" In Cybersecurity: Exploring the Accidental Insider , 2018 .

[41]  Ezer Osei Yeboah-Boateng,et al.  Phishing, SMiShing & Vishing: An Assessment of Threats against Mobile Devices , 2014 .

[42]  Tariq Mahmood,et al.  Security Analytics: Big Data Analytics for cybersecurity: A review of trends, techniques and tools , 2013, 2013 2nd National Conference on Information Assurance (NCIA).

[43]  Shraddha Parekh,et al.  A New Method for Detection of Phishing Websites: URL Detection , 2018, 2018 Second International Conference on Inventive Communication and Computational Technologies (ICICCT).

[44]  Jack F. Bravo-Torres,et al.  Social engineering as an attack vector for ransomware , 2017, 2017 CHILEAN Conference on Electrical, Electronics Engineering, Information and Communication Technologies (CHILECON).

[45]  Yue Xu,et al.  Social engineering in social networking sites: Affect-based model , 2013, 8th International Conference for Internet Technology and Secured Transactions (ICITST-2013).

[46]  Benjamin C. M. Fung,et al.  Security and privacy challenges in smart cities , 2018 .

[47]  Edgar R. Weippl,et al.  Advanced social engineering attacks , 2015, J. Inf. Secur. Appl..

[48]  S. Kaushalya,et al.  An Overview of Social Engineering in the Context of Information Security , 2018, 2018 IEEE 5th International Conference on Engineering Technologies and Applied Sciences (ICETAS).

[49]  Taimur Bakhshi,et al.  Social engineering: Revisiting end-user awareness and susceptibility to classic attack vectors , 2017, 2017 13th International Conference on Emerging Technologies (ICET).

[50]  Aiko Pras,et al.  Flow whitelisting in SCADA networks , 2013, Int. J. Crit. Infrastructure Prot..

[51]  Ju-Sung Kang,et al.  Dynamic ransomware protection using deterministic random bit generator , 2017, 2017 IEEE Conference on Application, Information and Network Security (AINS).

[52]  Mohammad Hammoudeh,et al.  Social Engineering Attack Strategies and Defence Approaches , 2016, 2016 IEEE 4th International Conference on Future Internet of Things and Cloud (FiCloud).

[53]  Lech J. Janczewski,et al.  A Taxonomy for Social Engineering attacks , 2011 .

[54]  Gianpiero Costantino,et al.  CANDY: A Social Engineering Attack to Leak Information from Infotainment System , 2018, 2018 IEEE 87th Vehicular Technology Conference (VTC Spring).

[55]  Luka Perkov,et al.  Social Engineering Toolkit — A systematic approach to social engineering , 2011, 2011 Proceedings of the 34th International Convention MIPRO.

[56]  Curtis C. Campbell.  Solutions for counteracting human deception in social engineering attacks , 2019, Inf. Technol. People.

[57]  Arif KOYUN,et al.  Social Engineering Attacks , 2020 .

[58]  Hein S. Venter,et al.  Social engineering attack examples, templates and scenarios , 2016, Comput. Secur..

[59]  Mohd Faizal Abdollah,et al.  Generic Taxonomy of Social Engineering Attack , 2011 .

[60]  Angelos Stavrou,et al.  Malicious PDF detection using metadata and structural features , 2012, ACSAC '12.

[61]  Thaier Hayajneh,et al.  Reverse TCP and Social Engineering Attacks in the Era of Big Data , 2016, 2016 IEEE 2nd International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing (HPSC), and IEEE International Conference on Intelligent Data and Security (IDS).

[62]  Cath Everett,et al.  Ransomware: to pay or not to pay? , 2016 .

[63]  Hardeep Singh,et al.  A Socio-Technical Approach to Preventing, Mitigating, and Recovering from Ransomware Attacks , 2016, Applied Clinical Informatics.

[64]  Ross Brewer,et al.  Ransomware attacks: detection, prevention and cure , 2016, Netw. Secur..

[65]  G. A. Chukwudebe,et al.  Mitigating social engineering for improved cybersecurity , 2015, 2015 International Conference on Cyberspace (CYBER-Abuja).