Protection Against Semantic Social Engineering Attacks

摘要: Phishing, drive-by downloads, file and multimedia masquerading, domain typosquatting, malvertising other semantic social engineering attacks aim to deceive the user rather than exploit a technical flaw breach system’s security. We start with chronological overview illustrate growing prevalence of such from their early inception 30 years ago, identify key milestones indicative trends which have established them as primary weapons choice for hackers, cyber-criminals state actors today. To demonstrate scale widespread nature threat space, we over 35 individually recognised types attack, existing within cross-contaminating between vast range different computer platforms interfaces. Their extreme diversity little no traces they leave make particularly difficult protect against. Technical protection systems typically focus on single attack type platform wider landscape deception-based attacks. address this issue, discuss three high-level defense approaches preemptive proactive protection, including adopting killchain concept simplifies targeted defense; principles passive threats; based defense-in-depth lifecycle designed harness non-technical capabilities providers base. Here, human-as-a-security-sensor paradigm can prove useful by leveraging collective natural ability users themselves in detecting deception attempts against them.