#NoHacked: How to recognise and protect yourself against social engineering
Stay organized with collectionsSave and categorize content based on your preferences.
Monday, August 03, 2015
Today in our #NoHacked campaign, we'll be talking about social engineering. Follow along with
discussions onTwitterandGoogle+using the #nohacked hashtag.
(Part 1)
If you've spent some time on the web, you have more than likely encountered some form ofsocial engineering.
Social engineering attempts to extract confidential information from you by manipulating or
tricking you in some way.
Phishing
You might be familiar with phishing, one of the most common forms of social engineering. Phishing
sites and emails mimic legitimate sites and trick you into entering confidential information like
your username and password into these sites. Arecent study from Googlefound that some phishing sites can trick victims 45% of the time! Once a phishing site has your
information, the information will either be sold or be used to manipulate your accounts.
Other Forms of Social Engineering
As a site owner, phishing isn't the only form of social engineering that you need to watch out
for. One other form of social engineering comes from the software and tools used on your site. If
you download or use anyContent Management System(CMS), plug-ins, or add-ons, make sure that they come from reputable sources like directly from
the developer's site. Software from non-reputable sites can contain malicious exploits that allow
hackers to gain access to your site.
For example, Webmaster Wanda was recently hired by Brandon's Pet Palace to help create a site.
After sketching some designs, Wanda starts compiling the software she needs to build the site.
However, she finds out that Photo Frame Beautifier, one of her favorite plug-ins, has been taken
off the official CMS plug-in site and that the developer has decided to stop supporting the
plug-in. She does a quick search and finds a site that offers an archive of old plug-ins. She
downloads the plug-in and uses it to finish the site. Two months later, a notification in Search
Console notifies Wanda that her client's site has been hacked. She quickly scrambles to fix the
hacked content and finds the source of the compromise. It turns out the Photo Frame Beautifier
plug-in was modified by a third party to allow malicious parties to access the site. She removed
the plug-in, fixed the hacked content, secured her site from future attacks, and filed a
reconsideration request in Search Console. As you can see, an inadvertent oversight by Wanda led
to her client's site being compromised.
Protecting Yourself from Social Engineering Attacks
Social engineering is effective because it's not obvious that there's something wrong with what
you're doing. However, there are a few basic things you can do protect yourself from social
engineering.
Stay vigilant:Whenever you enter confidential information online or install website
software, have a healthy dose of skepticism. Check URLs to make sure you're not typing
confidential information into malicious sites. When installing website software make sure the
software is coming from known, reputable sources like the developer's site.
Use two-factor authentication:Two-factor authentication like Google's2-Step Verificationadds
another layer of security that helps protect your account even if your password has been stolen.
You should use two-factor authentication on all accounts where possible. We'll be talking more
in-depth next week about the benefits of two-factor authentication.
If you have any additional questions, you can post in theWebmaster Help Forumswhere a community of webmasters can help answer your questions. You can also join ourHangout on Air about Securityon August 26.
Posted by Eric Kuan, Webmaster Relations Specialist and Yuan Niu, Webspam Analyst
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],[],[[["\u003cp\u003eSocial engineering is a tactic used by hackers to trick you into revealing confidential information or installing malicious software.\u003c/p\u003e\n"],["\u003cp\u003ePhishing is a common form of social engineering where attackers mimic legitimate websites or emails to steal your login credentials.\u003c/p\u003e\n"],["\u003cp\u003eUsing software from untrusted sources can expose your website to security vulnerabilities and compromise.\u003c/p\u003e\n"],["\u003cp\u003eProtect yourself by verifying URLs before entering sensitive data, downloading software only from reputable sources, and enabling two-factor authentication.\u003c/p\u003e\n"]]],["The post focuses on social engineering, particularly phishing, and how to avoid it. Phishing sites mimic legitimate ones to steal confidential information. Site owners are warned against downloading software from non-reputable sources, as these can contain exploits. The example of Webmaster Wanda illustrates this risk. To protect against these attacks, users should stay vigilant by checking URLs and software sources, and use two-factor authentication. Additional resources, forums, and a Hangout are available for further information.\n"],null,["# #NoHacked: How to recognise and protect yourself against social engineering\n\nMonday, August 03, 2015\n\n\nToday in our #NoHacked campaign, we'll be talking about social engineering. Follow along with\ndiscussions on [Twitter](https://twitter.com/googlesearchc) and\n[Google+](https://google.com/+googlewebmasters)\nusing the #nohacked hashtag.\n([Part 1](/search/blog/2015/07/nohacked-how-to-avoid-being-target-of))\n\n\nIf you've spent some time on the web, you have more than likely encountered some form of\n[social engineering](https://en.wikipedia.org/wiki/Social_engineering_(security)).\nSocial engineering attempts to extract confidential information from you by manipulating or\ntricking you in some way.\n\nPhishing\n--------\n\n\nYou might be familiar with phishing, one of the most common forms of social engineering. Phishing\nsites and emails mimic legitimate sites and trick you into entering confidential information like\nyour username and password into these sites. A\n[recent study from Google](https://research.google.com/pubs/pub43469.html)\nfound that some phishing sites can trick victims 45% of the time! Once a phishing site has your\ninformation, the information will either be sold or be used to manipulate your accounts.\n\nOther Forms of Social Engineering\n---------------------------------\n\n\nAs a site owner, phishing isn't the only form of social engineering that you need to watch out\nfor. One other form of social engineering comes from the software and tools used on your site. If\nyou download or use any\n[Content Management System](https://en.wikipedia.org/wiki/Content_management_system)\n(CMS), plug-ins, or add-ons, make sure that they come from reputable sources like directly from\nthe developer's site. Software from non-reputable sites can contain malicious exploits that allow\nhackers to gain access to your site.\n\n\nFor example, Webmaster Wanda was recently hired by Brandon's Pet Palace to help create a site.\nAfter sketching some designs, Wanda starts compiling the software she needs to build the site.\nHowever, she finds out that Photo Frame Beautifier, one of her favorite plug-ins, has been taken\noff the official CMS plug-in site and that the developer has decided to stop supporting the\nplug-in. She does a quick search and finds a site that offers an archive of old plug-ins. She\ndownloads the plug-in and uses it to finish the site. Two months later, a notification in Search\nConsole notifies Wanda that her client's site has been hacked. She quickly scrambles to fix the\nhacked content and finds the source of the compromise. It turns out the Photo Frame Beautifier\nplug-in was modified by a third party to allow malicious parties to access the site. She removed\nthe plug-in, fixed the hacked content, secured her site from future attacks, and filed a\nreconsideration request in Search Console. As you can see, an inadvertent oversight by Wanda led\nto her client's site being compromised.\n\nProtecting Yourself from Social Engineering Attacks\n---------------------------------------------------\n\n\nSocial engineering is effective because it's not obvious that there's something wrong with what\nyou're doing. However, there are a few basic things you can do protect yourself from social\nengineering.\n\n- **Stay vigilant:** Whenever you enter confidential information online or install website software, have a healthy dose of skepticism. Check URLs to make sure you're not typing confidential information into malicious sites. When installing website software make sure the software is coming from known, reputable sources like the developer's site.\n- **Use two-factor authentication:** Two-factor authentication like Google's [2-Step Verification](https://www.google.com/landing/2step/) adds another layer of security that helps protect your account even if your password has been stolen. You should use two-factor authentication on all accounts where possible. We'll be talking more in-depth next week about the benefits of two-factor authentication.\n\nAdditional resources about social engineering:\n\n- Learn more about [how to protect yourself from phishing attacks](https://support.google.com/accounts/answer/75061)\n- [Report a Phishing Page](https://www.google.com/safebrowsing/report_phish/)\n- [Avoid and report Google scams](https://support.google.com/faqs/answer/2952493)\n- [Identify \"phishing\" and \"spoofing\" emails](https://support.google.com/wallet/answer/105822)\n\n\nIf you have any additional questions, you can post in the\n[Webmaster Help Forums](https://support.google.com/webmasters/go/community)\nwhere a community of webmasters can help answer your questions. You can also join our\n[Hangout on Air about Security](https://plus.google.com/events/csqjnqe8vl28qbn526makjecobc)\non August 26.\n\n\nPosted by Eric Kuan, Webmaster Relations Specialist and Yuan Niu, Webspam Analyst"]]
