syssec_red_book

13. Social Engineering and Phishing13.5 State of the ArtDhamija’s [154] is among the most cited works regarding “phishing.” Althoughdating back to 2006, this research was the first that provided empirical evidenceabout the reasons why phishing attacks work: by analyzing the (ineffectivenessof) standard security indicators, the paper corroborates with objective findingsthe anecdotal (true) belief that phishing and social engineering work becauseof the scarce security education of the typical users. Albeit simple, this conceptis still the foundation of today’s social-engineering-based attacks. Three yearslater, Bilge et al. in [104] showed that, once an attacker has managed toinfiltrate a victim’s online social circle, the victim will trust the attacker andblindly follow any link they post, regardless of whether the victim knows theattacker in real life. Throughout the years, phishing and social engineeringhave evolved to find new ways to exploit trust relationships between humansubjects, or between a human subject and an institution or website. A recentexample is the abuse of short URLs [265] (e.g., bit.ly, tinyurl.com), to whichusers have grown accustomed thanks to Twitter, to spread phishing and othermalicious resources on social networks and email campaigns. Unfortunately,many years later, security warnings, which are supposed to help inexperiencedusers to distinguish between trustworthy and non-trustworthy websites orresources, are still of debatable effectiveness [79].Effective, personalized phishing and social-engineering-based attacks hasbeen considered a small-scale threat, because collecting sufficient informationand launching tailored attacks require time and manual effort. HoweverBalduzzi et al. [92] and Polakis et al. [317] both demonstrated how online socialnetworks can be used as oracles, for mapping users’ email addresses to theirFacebook profiles. Thus, using the information contained in the profiles, onecould construct very convincing personalized spam emails. Furthermore, theauthors have shown [109] that automated social engineering in social networksis feasible. They introduce the concept of socialbots, automated programs thatmimic real online social network users with the goal of infiltrating a victim’ssocial circle. They operated their proof-of-concept “socialbot” on Facebook foreight weeks and showed that current online social networks can be infiltratedwith a success rate of up to 80%. Additionally, they show that, dependingon users’ privacy settings, an infiltration can result in privacy breaches withmore users involved. Other work in the past tackled the threat of automatedsocial engineering on social networks. Notably, Irani et al. [218] measuredthe feasibility of “attracting” victims using honey profiles, to eventually lurethem into clicking on some malicious link. This “passive” social engineeringapproach turned out to be effective and once again showed that humans areoften the weakest security link.98