I have had the usual phishing messages — the ones asking for help urgently, or asking to confirm bank details on a link that goes nowhere legitimate. Every one of them has had some kind of tell, whether that was a strange sender address, clumsy wording, or a link that clearly did not match where it claimed to lead. Writing this post is what made me actually stop and think about how long that is likely to keep being true.
Social Engineering#
The attacks covered in an earlier post all targeted a protocol or a piece of network infrastructure — ARP, DNS, a switch’s own trunking behaviour. Social engineering is a completely different category, because the thing being exploited is not a weakness in a protocol at all. It is a person, and the trust or habits they bring to a normal interaction.
Phishing is the broadest and most familiar form — a message, usually email or text, designed to trick someone into handing over information or clicking something they should not, often by impersonating a legitimate sender or creating a false sense of urgency. The impact ranges from stolen credentials to malware being installed, depending entirely on what the message actually gets the person to do.
Dumpster diving is exactly what it sounds like — physically searching through discarded rubbish for information that should have been destroyed rather than thrown out whole. Old documents, printed passwords, discarded hardware still holding data — anything not properly shredded or wiped becomes freely available to anyone willing to go through the bin. The impact is information that was assumed to be gone actually still being fully readable.
Shoulder surfing is simply watching someone directly, over their shoulder, as they type a password or PIN, or view something sensitive on a screen. No technology involved at all — just proximity and observation. The impact is the same as anyone else being handed the credential outright, just obtained by watching rather than asking.
Tailgating is following someone through a physical door or secured entry point they have just unlocked, relying on politeness or a lack of a second badge check to get through a barrier that should have stopped an unauthorised person entirely. The impact is a physical security boundary — covered in an earlier post — being bypassed not through any flaw in the lock itself, but through a person simply being let through it.
What ties all four together is that none of them require breaking anything technical. Each one works by exploiting an entirely reasonable human habit — wanting to be helpful, not wanting to be rude, trusting that a message from a familiar-looking sender is genuine — rather than a flaw in a system.
Malware#
Malware is software deliberately written to cause harm, gain unauthorised access, or disrupt a system, and it covers a wide range of specific forms — viruses that attach themselves to other programs and spread when those programs run, worms that spread on their own across a network without needing to attach to anything, trojans that disguise themselves as legitimate software while doing something else entirely, and ransomware that encrypts a victim’s own files and demands payment for the key to unlock them again.
The impact varies by type, but the common thread is that malware is often what actually gets delivered through a successful social engineering attack — phishing gets someone to click, and malware is frequently what that click actually installs. The two categories are not always separate incidents; social engineering is often just the delivery method, and malware is the payload it delivers.
Why the Obvious Signs Won’t Stay Obvious#
Every phishing message I have personally received has had something noticeably off about it — bad grammar, a mismatched sender domain, a tone that did not quite sound right. Those tells have made spotting them fairly easy so far, and it is tempting to assume that will keep being true.
It almost certainly will not. AI tools capable of generating fluent, well-written, convincingly personalised messages remove exactly the kind of mistake that has made phishing easy to catch by eye. A message with perfect grammar, correct context, and a genuinely convincing tone is not automatically safe just because it reads well — and relying on writing quality as the main way to judge whether something is legitimate is a habit that is going to get considerably less reliable, not more, from here on.