Social Engineering in a Post-Phishing Era: Ambient Tactical Deception Attacks
share
It is an ordinary day working from home, and you are part of a team that regularly interacts over email. Since this is your main line of communication, the company trained you to spot phishing emails. You've learned to skip over emails that exhibit obvious phishing red flags: suspicious links, attachments, grammar errors, etc. You just received an email from your boss about a major project on which you play a critical role. The email is more demanding than usual, even impolite. Your boss has generally seemed more upset with you lately, so you approach them to express your concerns and clear the air. Your boss is not receptive to your feedback. This causes a rift that impacts your working relationship, compromising the effectiveness and productivity of the entire team. You have been a victim of an Ambient Tactical Deception (ATD) attack. We developed and tested a proof-of-concept social engineering attack targeting web-based email users. The attack is executed through a malicious browser extension that acts as a man-in-the-middle and reformats the textual content to alter the emotional tone of the email. The objective of ATD is not stealing credentials or data. ATD seeks to coerce a user to the attacker's desired behavior via the subtle manipulation of trusted interpersonal relationships. This goes beyond simple phishing and this paper reports the findings from study that investigated an ATD attack on the politeness strategy used in work emails.
READ FULL TEXT