To connect with friends, family, and coworkers, it’s likely that we have all overshared our personal information on social platforms more than once. Unfortunately, the ease of access to an individual or company’s information has made social media an easy target for threat actors.
According to Comparitech, threat actors “leaked more than 300 million Facebook User IDs, names, and phone numbers on the web,” within the last three years. Given the global impact these threats have had on online communities, we’re going to discuss scenarios of social engineering attacks on social media platforms along with how you can protect yourself, your organization, or both.
Although social engineers — threat actors who use social engineering as part of their cyberattacks — have been using phishing and other attack types for decades, these tactics are becoming more and more common across social media platforms.
Less targeted attacks — such as posting infected links as part of fake advertising — require very little research. However, if a threat actor wishes to target specific social media accounts, they will crawl the profile pages and gather information about their targets.
Business executives may be targeted on social media platforms so the threat actor can gain a foothold to a valuable company’s internal networks and systems. The social engineer may go as far as to impersonate an executive or an entire company. The threat actor will extensively research the “bigger fish” to successfully carry out their attack.
This stage is typically called the investigation stage because the threat actor will use whatever means necessary to gather the needed information. Threat actors may use bots to scrape the needed personal information to carry out the next stage of the attack.
Once a threat actor has information on a target, they may try to build rapport, offer help, or scare the target to more easily trick their victim. For example, a threat actor could:
This stage is known as the hook because the threat actor provides a tempting offer or information that the target wants. Some threat actors may use phishing attacks or other methods in this stage to get what they need so that they can then build a relationship with their main target. They may then attempt to tell a story or provide information that the victim would want.
Once the social engineer has set up the pretext, all they have to do is convince their victim to act. For example, if the threat actor claims that a prize has been won, they would then provide a seemingly innocent link that would take their victim to a page outside of the social platform to claim their “prize.”
This stage is known as the play because the threat actor is fooling — or “playing” — the innocent social media user. Several types of attacks may be used here, such as SMS phishing, pretexting, and baiting.
Once the target performs the desired action, the attack has been launched. The threat actor will steal the data, infect the victim’s computer or network, or steal the victim’s social account or other accounts. For example, the victim may click on an infected link that installs malware onto their system. Once the attack is complete, the social engineer will attempt to finish their attack and end the engagement without drawing suspicion.
Known as the exit, this last step uses a variety of tools and techniques — malware, bots, and more — so that the threat actor has what they want and no one's the wiser. Frequently, the threat actor is after more than one target or more than one goal, so this process repeats itself.
Founder of Mitnick Security, Kevin Mitnick has experienced both sides of the attack. Kevin Mitnick’s Instagram and Twitter accounts have been impersonated more than once. Threat actors will often choose well-known people of interest to impersonate in the course of launching a social engineering attack on social platforms. In these situations, the fake Kevin account would promise cybersecurity services to individuals and ask for payment. Unsuspecting victims would follow through because they were unaware that the real Kevin was not involved at all.
Adjusting your social media account settings and being more careful with what information you share online can be an effective defense against social engineering. To protect yourself, your family, and your organization, avoid sharing personal information such as:
You can also customize your privacy settings across your accounts so that only people you know can see your personal information.
Multi-factor authentication (MFA) requires the user to provide at least two methods of identity verification before granting access. MFA can help protect your social media accounts, business accounts, and more.
Even if the message and actual link look valid, it’s best not to click on anything unless you have done your homework. You can use Google Search to validate the company or research typical company processes and promotions. You can also contact the company using the company website or follow other security awareness training tips.
Public Wi-Fi is commonly used by threat actors to place themselves between their target and the connection point. In this scenario, you are not connected to the hotspot directly. Instead, the threat actor is collecting your user data or redirecting it to another source. Some signs of threat actor involvement include frequent disconnections, strange web addresses, and network delays. Always use a VPN and avoid connecting to strange or unfamiliar public Wi-Fi networks.
Social engineering on social media channels is here to stay. Partly due to past successful social engineering attacks on most social networking sites, threat actors see these platforms as prime opportunities for attacks. Since social engineering involves the human element, it’s crucial to educate yourself, your family, and your team on security best practices both in and out of the office. To discover what you can do to keep threat actors at bay, download your free guide, “Learn to Avoid Cyber Threats in 5 ½ Easy Steps.”