Is it Social Engineering when a keylogger is installed from a compromised account on the domain?

Question

So… this is a matter of definitions.

Social Engineering (SE) is referred to as being related to psychological manipulation. The relation to manipulation is also prominent in the description made on social-engineering.org:

We define social engineering (SE) as “any act that influences a person to take an action that may or may not be in their best interest.”

Using a keylogger embedded in a physical device, or the process of getting a user to install a keylogger are both related to SE in my opinion. But what about when an adversary has gained access to a machine over a network and installed a keylogger on the victim's machine. In this case I fail to see how the victim has been SE'd to give their credentials, as the compromise is not due to a victim's action.

Would you use SE to describe the attack in this case, or am I missing a descriptive term for this type of attack?

Answer 1

but what of the case where an adversary has gained access to a machine over a network and installed keylogger software on the target machine.

This is not social engineering.

You are describing the outcome of an attack: an attacker gains access to a machine an put a keylogger. You are describing what happened. However, social engineering is not an attack per se, but an attack vector. Social engineering is more about how it happened.

To call this social engineering, you would need to interact somehow with the victim and influence them to perform some action needed for the attack. How did the attacker managed to gain access to the machine? If the attacker impersonated one of the victim's friend and sent a mail along the lines of:

Subject: Lol dude

Message:
Dude, have you seen that pic of you? Why did you do that lol!!

File attached: IMG_1234.jpg.exe

Then, it would be social engineering. :-)

One last, thing, when you said:

In general using a keylogger as a physical device […] [is] related to SE

Once again, this is not social engineering. It depends of how you managed to get that device plugged into the victim's computer.

• Did you break-in, during the night and plugged it discretely?
  That's not social engineering.

• Did you make a malicious USB key, put a sticker TOP-SECRET on it and dropped it in front of the victim's door?
  That's social engineering.

Answer 2

In order to qualify as social engineering, the victim must actively participate in the ruse of their own free will, usually by the attacker gaining the user's trust and then exploiting it. Installing a key-logger directly is simply a successful security penetration, as is getting the victim's password off a Post-It note that's stuck to their monitor. Kidnapping someone and holding them random is also not social engineering. Asking the user to install a key-logger for you is social engineering.

If you're ever in doubt about a scenario, just remember that there are two components to social engineering: (a) there must be direct interaction between the attacker and victim, and (b) the user must perform some action, including giving up information, of their own free will.

While it's technically possible to use a fake kidnapping or other emergency, most attackers prefer to be covert, performing the attack in a way that the attacker themselves will be unremarkable and will not be easy to recall later when the attack is finally discovered. This makes it harder to discover who the attacker was, or try to track them down.