0

So… this is a matter of definitions.

Social Engineering (SE) is referred to as being related to psychological manipulation. The relation to manipulation is also prominent in the description made on social-engineering.org:

We define social engineering (SE) as “any act that influences a person to take an action that may or may not be in their best interest.”

Using a keylogger embedded in a physical device, or the process of getting a user to install a keylogger are both related to SE in my opinion. But what about when an adversary has gained access to a machine over a network and installed a keylogger on the victim's machine. In this case I fail to see how the victim has been SE'd to give their credentials, as the compromise is not due to a victim's action.

Would you use SE to describe the attack in this case, or am I missing a descriptive term for this type of attack?

2 Answers 2

3

but what of the case where an adversary has gained access to a machine over a network and installed keylogger software on the target machine.

This is not social engineering.

You are describing the outcome of an attack: an attacker gains access to a machine an put a keylogger. You are describing what happened. However, social engineering is not an attack per se, but an attack vector. Social engineering is more about how it happened.

To call this social engineering, you would need to interact somehow with the victim and influence them to perform some action needed for the attack. How did the attacker managed to gain access to the machine? If the attacker impersonated one of the victim's friend and sent a mail along the lines of:

Subject: Lol dude

Message:
Dude, have you seen that pic of you? Why did you do that lol!!

File attached: IMG_1234.jpg.exe

Then, it would be social engineering. :-)

One last, thing, when you said:

In general using a keylogger as a physical device […] [is] related to SE

Once again, this is not social engineering. It depends of how you managed to get that device plugged into the victim's computer.

  • Did you break-in, during the night and plugged it discretely?
    That's not social engineering.

  • Did you make a malicious USB key, put a sticker TOP-SECRET on it and dropped it in front of the victim's door?
    That's social engineering.

3
  • The usage of a physical device as a keylogger would give the target an anomaly, which would then depend on the targets acceptance of various doodads connected to the machine. That is the reason I accept that a keylogger in the physical sense is SE related. But I accept that I confuse terms, so I should just call this a physical attack and my stated network attack vector a network attack?
    – RLFP
    Apr 19, 2016 at 6:50
  • I didn't quite understand your first sentence: "The usage of a physical device as a keylogger would give the target an anomaly, which would then depend on the targets acceptance of various doodads connected to the machine." -- If I'm right, your attacker gives the victim a malicious device (keylogger), and you consider this related to SE as it depends of whether the victim will plug it? Well, I don't know. Some people will say this is SE, as you try to exploit the human curiosity; and some might disagree, stating that the attacker should somehow actively influence the victim. (e.g. sticker)
    – Yuriko
    Apr 19, 2016 at 7:01
  • My first sentence was related to your "night break-in" or similar scenario, where the target is not the one to add a device to the machine setup of the target. But when the attacker gives the target a device and expects that it will be plugged in, I rate that as SE as there is an interaction where the target trusts the attacker enough to actually use the device. From what I can gather here my SE definition is not complete, so thanks for the input.
    – RLFP
    Apr 19, 2016 at 7:10
1

In order to qualify as social engineering, the victim must actively participate in the ruse of their own free will, usually by the attacker gaining the user's trust and then exploiting it. Installing a key-logger directly is simply a successful security penetration, as is getting the victim's password off a Post-It note that's stuck to their monitor. Kidnapping someone and holding them random is also not social engineering. Asking the user to install a key-logger for you is social engineering.

If you're ever in doubt about a scenario, just remember that there are two components to social engineering: (a) there must be direct interaction between the attacker and victim, and (b) the user must perform some action, including giving up information, of their own free will.

While it's technically possible to use a fake kidnapping or other emergency, most attackers prefer to be covert, performing the attack in a way that the attacker themselves will be unremarkable and will not be easy to recall later when the attack is finally discovered. This makes it harder to discover who the attacker was, or try to track them down.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .