Social Engineering

The three messages below are one social engineering attack. One adversary sent all three to one high school student on the same Saturday, about the student's account on an online game. Each row gives the time, the channel, who the message claims to be from, and what it says.

This lesson reads each one for what it asks, how it pressures the student, and what the adversary gains.

Each message asks the student to do something. The first asks for four personal facts, the second for a code, and the third for a download.

Getting a target to reveal sensitive information is called elicitation, and the first two messages aim at it. The third aims at a malicious file, the installer.

The tournament message also gives the student a reason to comply. It names a consequence, and the consequence falls on the whole team: dropped from the bracket. It also names a time: registration closes at 12:00 noon, less than two hours away.

That message uses both tactics. Dropping the team is a threat, so it's intimidation, and the noon deadline is urgency. The other two work differently: the text leans on a friendly request from someone who sounds like a teammate, and the giveaway offers something instead of threatening anything.

Both tactics work on ordinary instincts. The tournament message draws the student's attention to one possible consequence, letting the whole team down. They want to avoid that outcome, and fear of it gives them a reason to act. The message offers one action that seems to prevent it: a reply with the four facts.

Urgency works through time. With the team's place at stake by noon, the student feels pressured to act quickly. That pressure can keep them from stopping to consider whether sending a home address to an unknown office is reasonable or safe.

The student replies at 10:07. From then on the adversary knows the student's full name, home address, phone number, and school. The student's username was never private, since the game shows it to every player.

An adversary who holds all four can pose as the student to a person, and a website that checks identity with personal facts like these would accept them too.

The text at 10:41 reached the student's phone because of that reply. The game lets a player sign in with a code texted to the phone number on the account, with no password. At 10:40 the adversary typed the student's username on the game's sign-in page. So the game texted a code to the student's phone, and a minute later the adversary's text asked for it. On this game the code is all anyone needs: if the student sends it, the adversary signs in as the student and holds the account, items included.

The installer offered at 1:15 is a malicious file, and a free prize nobody asked for is a common way to deliver one.

Running the installer would put malware on the student's computer, where it could copy what the browser has stored, including the saved sign-in that keeps the student logged in to the game. With that, the adversary needs no code at all. A link can do the same damage without a download, by sending the student to a page that looks like the game's sign-in and keeps whatever is typed into it.