syssec_red_book

13. Social Engineering and Phishingare no longer effective. Therefore, the malware authors must resort to socialengineering-basedtechniques for persuading victims to install legitimatelookingapplications that hide malicious functionalities.13.2 Who Is Going to Be Affected?Most Internet users have come across cases of social engineering, such asin cases of spam emails originating from friends’ email addresses [365] thathave been compromised. In other cases, the emails originate from differentaddresses and just masquerade as having been sent by a friend. In bothcases, the attackers goal is to exploit the implicit trust users show towardcommunication from their online contacts.Nowadays, with the seemingly universal adoption of online social networks,and the abundance of personal information released, users are unwillinglyand unknowingly aiding attackers in launching social engineering attacks.Thus, users of such social services are bound to become the main target ofpersonalized spam campaigns, that incorporate user information in order toappear more convincing.Furthermore, the explosive increase of mobile devices with Internet connectivity(i.e., smartphones) is slowly shifting the focus of malware authors tothese devices. Smartphones combine telephone devices capable of “dialing-in”(i.e., have a built-in billing system), with a sophisticated environment capableof executing arbitrary code and, at the same time, offer a full-featured browseraccess to the Internet. Therefore, smartphones present a large attack surface astheir users visit arbitrary sites on the web.Attacks against high-value assets have been seen and are expected tobecome even more prominent, as activists resort to digital media for furtheringpolitical schemes [269], protesting against lawmaking and opposing oppressiveregimes [84].Chapter 6 of the SysSec Deliverable D7.1: Review of the State-of-the-Art inCyberattacks [373] discusses the state of the art in social-network- and socialengineering-basedattacks.13.3 What Is Expected to Happen?While the typical phishing activities via email and online social networkswill continue to affect Internet users, social engineering is also expected toincrease in various areas (most notably, by targeting mobile devices), and in itssophistication and scale (e.g., thanks to automation techniques).Regarding mobile devices, as detailed in Chapter 8, Android’s securitydesign enforces that each installed application must run with a distinct useraccount. As a consequence, each application process has its own, isolated(virtual) memory space. Albeit simple, this security mechanism prevents a94