Markus Jakobsson
Attackers increasingly, and with high success rates, use social engineering techniques to circumvent second factor authentication (2FA) technologies, compromise user accounts and sidestep fraud detection technologies. We introduce a social engineering resistant approach that we term device-aware 2FA, to replace the use of traditional security codes.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
继续探索
Social engineering has posed a serious threat to cyberspace security. To protect against social engineering attacks, a fundamental work is to know what constitutes social engineering. This paper first develops a domain ontology of social engineering in cybersecurity and conducts ontology evaluation by its knowledge graph application. The domain ontology defines 11 concepts of core entities that significantly constitute or affect social engineering domain, together with 22 kinds of relations describing how these entities related to each other. It provides a formal and explicit knowledge schema …
Social engineering is described as the art of manipulation. Cybercriminal use manipulation to victims their targets using psychological principles to change their behavior to make unconscious decisions. This study identifies the attack and techniques used by cybercriminal to conduct social engineering attacks within an organization. This study evaluate how social engineering attacks are delivered, techniques used and highlights how attackers take advantage Compromised systems. Lastly this study will also evaluate and provide the best solutions to help mitigate social engineering attacks with a…
Protecting Quantum Circuits Through Compiler-Resistant Obfuscation
本文提出了一种基于随机化U3变换的量子电路混淆方法，有效隐藏电路结构并保持功能，实现93%的语义准确性，具有低开销和强抗逆向工程能力。
Social engineering through social media channels targeting organizational employees is emerging as one of the most challenging information security threats. Social engineering defies traditional security efforts due to the method of attack relying on human naiveté or error. The vast amount of information now made available to social engineers through online social networks is facilitating methods of attack which rely on some form of human error to enable infiltration into company networks. While, paramount to organisational information security objectives is the introduction of relevant compre…
Social engineering cyberattacks are a major threat because they often prelude sophisticated and devastating cyberattacks. Social engineering cyberattacks are a kind of psychological attack that exploits weaknesses in human cognitive functions. Adequate defense against social engineering cyberattacks requires a deeper understanding of what aspects of human cognition are exploited by these cyberattacks, why humans are susceptible to these cyberattacks, and how we can minimize or at least mitigate their damage. These questions have received some amount of attention but the state-of-the-art unders…
User Awareness Measurement Through Social Engineering
TUBITAK国家电子和密码学研究所（UEKAE）信息系统安全部在“信息安全测试”框架内对土耳其公共机构进行社会工程攻击。本文将对土耳其几个公共机构进行的社会工程测试进行分析。这些测试包括由社会工程师打电话对员工进行抽样，并试图利用员工的善意来获取他们的敏感信息。这项研究的目的是数字，在土耳其公共机构的雇员缺乏信息安全意识，他们妥协的信息安全的原则，应该是必要的任何公共机构。社会工程学以其低成本和利用低技术的能力，在信息安全文献中作为一种非常有效的攻击形式占据了一席之地[8]。
This paper attempts to strengthen the pursued research on social engineering (SE) threat identification, and control, by means of the author's illustrated classification, which includes attack types, determining the degree of possible harm to each types of possible, known attacks, countermeasures by types of threats that leads to loss of personal or corporate confidential information (user id, passwords, closed documentation). Further, this analytical study will become the starting point for deeper, practically oriented and tested research.
TASEP: A Collaborative Social Engineering Tabletop Role-Playing Game to Prevent Successful Social Engineering Attacks
针对社会工程学攻击，提出一款名为TASEP的桌面角色扮演游戏，通过模拟渗透测试和乐高模型，提供沉浸式培训，以提高员工安全意识，经评估具有良好效果。
The number of registered SIM cards and active mobile phone subscribers in Zambia in 2020 surpassed the population of the country. This clearly shows that mobile phones in Zambia have become part of everyday life easing not only the way people communicate but also the way people perform financial transactions owing to the integration of mobile phone systems with financial payment systems. This development has not come without a cost. Cyberattackers, using various social engineering techniques have jumped onto the bandwagon to defraud unsuspecting users. Considering the aforesaid, this paper pre…
Ethereum holds multiple billions of U.S. dollars in the form of Ether cryptocurrency and ERC-20 tokens, with millions of deployed smart contracts algorithmically operating these funds. Unsurprisingly, the security of Ethereum smart contracts has been under rigorous scrutiny. In recent years, numerous defense tools have been developed to detect different types of smart contract code vulnerabilities. When opportunities for exploiting code vulnerabilities diminish, the attackers start resorting to social engineering attacks, which aim to influence humans -- often the weakest link in the system. T…
We reveal six zero-day social engineering attacks in Ethereum, and subdivide them into two classes: Address Manipulation and Homograph. We demonstrate the attacks by embedding them in source codes of five popular smart contracts with combined market capitalization of over \$29 billion, and show that the attacks have the ability to remain dormant during the testing phase and activate only after production deployment. We analyze 85,656 open source smart contracts and find 1,027 contracts that can be directly used for performing social engineering attacks. For responsible disclosure, we contact s…
Some Recommended Protection Technologies for Cyber Crime Based on Social Engineering Techniques -- Phishing
网络钓鱼（密码+钓鱼）是一种基于社会工程和网站欺骗技术的网络犯罪形式。“网络钓鱼”的名称是“钓鱼”一词的故意拼写错误，涉及从用户的计算机中窃取机密数据，然后使用这些数据窃取用户的钱。在本文中，我们研究，讨论和提出了网络钓鱼攻击的阶段和类型，检测网络钓鱼网页的技术，并总结了我们的论文与一些重要的建议，以防止网络钓鱼的消费者和公司。
The purpose of this report is to research the topic called Social Engineering in Cyber Security and present the explanation of the meaning, concepts, techniques, and security countermeasures of Social Engineering based on factual academic research.
From Social Engineering to Quantum Threats: Safeguarding User Wallets with FailSafe
针对加密货币用户钱包交互中的资金损失问题，本文提出FailSafe纵深防御方案，并配套qMig工具以应对未来量子威胁。
Countering Social Engineering through Social Media: An Enterprise Security Perspective
针对社交媒体渠道的社交工程师的威胁越来越大，以提高他们对公司数据的攻击效率，许多组织都推出了更好地了解这些漏洞的举措。本文探讨了企业内部通过社交媒体进行社会工程的问题，并探讨了为遏制随之而来的风险而采取的对策。报告还分析了公共和私营部门现有的社交媒体安全政策和准则。
The Shadow of Fraud: The Emerging Danger of AI-powered Social Engineering and its Possible Cure
本文综述了AI驱动的社会工程学攻击的演变，提出“3E阶段”分类框架，并强调构建风险评估体系以指导防御策略开发。
Case Study On Social Engineering Techniques for Persuasion
市场上有很多安全软件;每个都声称是最好的，但我们每天都面临病毒和其他恶意活动的问题。如果我们知道这种恶意软件的基本工作原理，那么即使没有安全软件，我们也可以很容易地阻止其中的大多数。黑客和破解者是心理学专家，他们操纵人们让他们访问或获得访问所需的信息。本文讨论了这种攻击的内部工作。提供了Spandex的案例研究。在本案例研究中，我们使用社会工程技术在Linux操作系统（被认为是最安全的操作系统）上进行欺骗，获得了100%的成功。在这里，我们讨论了几个基本的防御原则，无论是对个人还是对组织，只要遵循这些原则，就可以防止大多数这样的攻击。
Social engineering attacks are phenomena that are equally applicable to both the physical world and cyberspace. These attacks in the physical world have been studied for a much longer time than their counterpart in cyberspace. This motivates us to investigate how social engineering attacks in the physical world and cyberspace relate to each other, including their common characteristics and unique features. For this purpose, we propose a methodology to unify social engineering attacks and defenses in the physical world and cyberspace into a single framework, including: (i) a systematic model ba…
Social Engineering has emerged as a significant threat in cyber security. In a dialog based attack, by having enough of a potential victim's personal data to be convincing, a social engineer impersonates the victim in order to manipulate the attack's target into revealing sufficient information for accessing the victim's accounts etc. We utilise the developing understanding of human information processing in the Information Sciences to characterise the vulnerability of the target to manipulation and to propose a form of countermeasure. Our focus is on the possibility of the social engineer bei…
Decoding the Threat Landscape : ChatGPT, FraudGPT, and WormGPT in Social Engineering Attacks
本研究采用博客挖掘技术分析ChatGPT、FraudGPT及WormGPT在社会工程攻击中的多维度应用与风险，提出防御策略，为利益相关者应对相关网络安全威胁提供参考。
Targeted phishing emails are on the rise and facilitate the theft of billions of dollars from organizations a year. While malicious signals from attached files or malicious URLs in emails can be detected by conventional malware signatures or machine learning technologies, it is challenging to identify hand-crafted social engineering emails which don't contain any malicious code and don't share word choices with known attacks. To tackle this problem, we fine-tune a pre-trained BERT model by replacing the half of Transformer blocks with simple adapters to efficiently learn sophisticated represen…
A series of bots performing simulated social engineering attacks using phishing in the Twitter platform was developed to identify potentially unsafe user behavior. In this work different bot versions were developed to collect feedback data after stimuli directed to 1,287 twitter accounts for 38 consecutive days. The results were not conclusive about the existence of preceptors for unsafe behavior, but we conclude that despite Twiter's security this kind of attack is still feasible.
This paper reports on a study aiming to explore factors associated with behavioral intention to follow a social engineering awareness campaign. The objectives of this study were to determine how perceived severity, perceived vulnerability, perceived threat, fear, subjective norm, attitude towards behavior, perceived behavioral control, self-efficacy, response efficacy, trust in authorities, perceived regulation, authorities performance, information sensitivity and privacy concern are associated with individuals' behavioral intention to follow a social engineering awareness campaign. The study …
This paper proposes an authentication-simplified and deceptive scheme (SEIGuard) to protect server-side social engineering information (SEI) and other information against brute-force attacks. In SEIGuard, the password check in authentication is omitted and this design is further combined with the SEI encryption design using honey encryption. The login password merely serves as a temporary key to encrypt SEI and there is no password plaintext or ciphertext stored in the database. During the login, the server doesn't check the login passwords, correct passwords decrypt ciphertexts to be correct …
The article presents a study using attacks such as a fake access point and a phishing page. The previous publications on social engineering have been reviewed, statistics of break-ups are analyzed and directions and mechanism of realization of attacks having elements of social engineering are analyzed. The data from the research in three different places were collected and analyzed and the content statistics were provided. For comparison, three categories of higher education institutions were chosen: technical, humanitarian and mixed profiles. Since the research was conducted in educational in…
An Analysis of the Impact of Psychological Factors and Techniques Across Different Types of Social Engineering
该研究通过含12名参与者的实验室研究，分析不同社会工程攻击类型与心理因素的组合效果，发现鱼叉式钓鱼对权威、信任、贪婪最有效，贪婪与鱼叉式钓鱼的组合最成功，三类组合完全无效。
A Synthetic Conversational Smishing Dataset for Social Engineering Detection
本文提出一个包含3201个标注多轮对话的合成数据集，用于模拟真实的对话式钓鱼攻击，通过评估八种模型发现基于TF-IDF的模型在检测对话式钓鱼攻击中表现更优。
Digital Deception: Generative Artificial Intelligence in Social Engineering and Phishing
本文探讨了生成式AI在社会工程攻击中的变革性作用，提出三大攻击支柱并构建了生成式AI社会工程框架，以研究AI驱动攻击的复杂性，同时探索人类影响与应对对策，促进更安全的人机交互。
Breaching the Human Firewall: Social engineering in Phishing and Spear-Phishing Emails
我们研究了三种社会工程策略对用户判断点击电子邮件中的链接有多安全的影响。研究的三种策略是权威、稀缺和社会证明，电子邮件要么是真实的，要么是网络钓鱼或鱼叉式网络钓鱼。在这三种策略中，使用权威是说服用户电子邮件中的链接是安全的最有效的策略。当检测网络钓鱼和鱼叉式网络钓鱼电子邮件时，用户在电子邮件使用权威原则时表现最差，而在存在社会证据时表现最好。总体而言，用户很难区分真正的和鱼叉式网络钓鱼电子邮件。最后，在做出决定时不那么冲动的用户通常不太可能判断欺诈性电子邮件中的链接是安全的。对教育和培训的影响进行了讨论。
Social engineering attacks are a major cyber threat because they often serve as a first step for an attacker to break into an otherwise well-defended network, steal victims' credentials, and cause financial losses. The problem has received due amount of attention with many publications proposing defenses against them. Despite this, the situation has not improved. In this paper, we aim to understand and explain this phenomenon by looking into the root cause of the problem. To this end, we examine the literature on attacks and defenses through a unique lens we propose -- {\em psychological facto…
Towards a Security Lifecycle Model against Social Engineering Attacks: SLM-SEA
这项研究考虑了社会工程安全攻击的影响，这些攻击被认为是利用用户意识和行为的机会。在这方面，研究提出了一种管理方法，以加强甚至确保保护。本研究的目的是构建一个安全的生命周期模型，对这些不测事件，并分析已在土耳其公共部门的背景下进行的测试结果。这项研究的主要目的是确定为什么员工通过访谈陈述谬误和相关修正来共享敏感信息，从而了解用户在面对真正的社会工程攻击时的行为。研究结果表明，土耳其公共组织的雇员对信息安全认识不足，他们通常忽视至关重要的安全程序。这是一个重要的例子，说明越来越需要进一步普及用户意识和责任，使个人而不仅仅是软件成为安全保护组合的一个关键要素。
Filter-then-Verify: A Multiphase GNN and ModernBERT Framework for Social Engineering Detection in Email Networks
本文提出了一种结合图神经网络和现代BERT的多阶段框架，用于检测电子邮件网络中的社会工程攻击，通过结构异常检测和内容验证相结合，实现了高召回率和高精确度。
On the Feasibility of Using MultiModal LLMs to Execute AR Social Engineering Attacks
本文首次通过SEAR框架研究多模态大语言模型执行AR社会工程攻击的可行性，经60人实验验证其诱导高风险行为有效（如93.3%易钓鱼），为相关防御提供了概念验证与见解。
Recovering WPA-3 Network Password by Bypassing the Simultaneous Authentication of Equals Handshake using Social Engineering Captive Portal
本研究提出通过中间人攻击和社会工程学强制门户绕过 WPA3-SAE 握手以恢复网络密码，发现未实施受保护管理帧时可成功获取密码，且部分设备无法兼容 WPA3 过渡网络。
UNSEEN: A Cross-Stack LLM Unlearning Defense against AR-LLM Social Engineering Attacks
针对AR-LLM社会工程攻击，提出UNSEEN跨栈防御机制，结合AR访问控制层、基于F-RMU的LLM去学习和运行时代理防护，通过用户研究验证其有效性。
Cyber adversaries have increasingly leveraged social engineering attacks to breach large organizations and threaten the well-being of today's online users. One clever technique, the "watering hole" attack, compromises a legitimate website to execute drive-by download attacks by redirecting users to another malicious domain. We introduce a game-theoretic model that captures the salient aspects for an organization protecting itself from a watering hole attack by altering the environment information in web traffic so as to deceive the attackers. Our main contributions are (1) a novel Social Engin…
DevPhish: Exploring Social Engineering in Software Supply Chain Attacks on Developers
本文全面探究攻击者在软件供应链关键步骤中利用社会工程学诱骗软件工程师交付恶意软件的策略，为威胁建模和安全差距分析提供见解。
In this paper we argue, drawing from the perspectives of cybersecurity and social psychology, that Internet-based manipulation of an individual or group reality using ambient tactical deception is possible using only software and changing words in a web browser. We call this attack Ambient Tactical Deception (ATD). Ambient, in artificial intelligence, describes software that is "unobtrusive," and completely integrated into a user's life. Tactical deception is an information warfare term for the use of deception on an opposing force. We suggest that an ATD attack could change the sentiment of t…
Deep-Fake CAPTCHA: Mitigating Next-Generation Social Engineering Attacks
针对实时深度伪造冒充，提出DF-CAPTCHA主动挑战-响应验证框架，通过真实性、身份一致性、任务完成度和响应时间四标准检测，在音频和视频模态均达高准确率，有效防御下一代社会工程攻击。
SENet: Visual Detection of Online Social Engineering Attack Campaigns
本文提出 SEShield 框架，通过 SECrawler 爬取野外社会工程攻击样本，训练深度学习图像分类器 SENet 识别攻击页面视觉特征，并嵌入浏览器实现实时检测，检测率达 99.6%。
This paper explores the threat detection for general Social Engineering (SE) attack using Machine Learning (ML) techniques, rather than focusing on or limited to a specific SE attack type, e.g. email phishing. Firstly, this paper processes and obtains more SE threat data from the previous Knowledge Graph (KG), and then extracts different threat features and generates new datasets corresponding with three different feature combinations. Finally, 9 types of ML models are created and trained using the three datasets, respectively, and their performance are compared and analyzed with 27 threat det…
SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents
提出SEVRA-BENCH基准，通过社会工程攻击框架评估LLM代码审查智能体拒绝恶意PR的能力，发现闭源与开源模型间存在显著安全差距。
A Survey on the Principles of Persuasion as a Social Engineering Strategy in Phishing
本综述系统回顾了劝说原则在钓鱼攻击中作为社会工程策略的应用，指出鱼叉式钓鱼因可针对目标定制信息而尤为有效，并强调当前研究在理解该策略影响方面仍存在显著空白。
Security in IS and social engineering -- an overview and state of the art
本综述针对信息系统安全与社会工程领域，梳理了数字化及物联网发展下网络犯罪利用社会工程结合人因漏洞的现状，指出需从上游预判、检测等环节采取预防协作策略，并综合了相关文献与行业实践。
Cybercrime and Prevention: Colonel Blotto in Social Engineering
本文通过Colonel Blotto游戏模型探讨如何优化防御资源分配以防范社会工程攻击，结合 Routine Activity Theory 和 VIVA 框架，分析国家与组织层面的防御策略。
Personalized Attacks of Social Engineering in Multi-turn Conversations: LLM Agents for Simulation and Detection
提出LLM智能体框架SE-VSim模拟多轮社会工程攻击，并基于超1000个对话提出SE-OmniGuard，利用受害者个性特征提供个性化防护与检测。
Information security awareness (ISA) is a practice focused on the set of skills, which help a user successfully mitigate a social engineering attack. Previous studies have presented various methods for evaluating the ISA of both PC and mobile users. These methods rely primarily on subjective data sources such as interviews, surveys, and questionnaires that are influenced by human interpretation and sincerity. Furthermore, previous methods for evaluating ISA did not address the differences between classes of social engineering attacks. In this paper, we present a novel framework designed for ev…
When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent
研究提出AgentBait攻击范式，揭示网络自动化代理的社会工程威胁，并设计SUPERVISOR模块有效缓解此类攻击。
Social Engineering Attacks: A Systemisation of Knowledge on People Against Humans
本文系统化研究社会工程攻击，提出三层次分析框架，揭示人类、组织和攻击者维度，并提出风险加权HAISQ分析和适应性培训方案，以提升智能城市安全策略。
扫码添加微信好友，提出您的宝贵建议 👇
💡 备注请填写：网站反馈
发表机构由 AI 从论文文本抽取，如发现错误，欢迎反馈修正建议。