Lesson 6 Social Engineering Awareness

Social Engineering Awareness

Social engineering exploits human psychology rather than technical vulnerabilities. It's often the weakest link in cybersecurity and can bypass even the strongest technical defenses.

Types of Social Engineering Attacks

Psychological Principles Exploited

Phishing Email Analysis

Learning to identify phishing emails is crucial for cybersecurity professionals and users alike:

Red Flags in Phishing Emails

Python Email Header Analysis Tool

#!/usr/bin/env python3
import email
import re
import urllib.parse
from email.header import decode_header
import dns.resolver
import sys

class PhishingAnalyzer:
    def __init__(self):
        self.suspicious_indicators = []
        self.risk_score = 0
        
    def analyze_email_file(self, email_file_path):
        """
        Analyze an email file for phishing indicators
        """
        try:
            with open(email_file_path, 'r', encoding='utf-8') as f:
                email_content = f.read()
            
            # Parse email
            msg = email.message_from_string(email_content)
            
            # Analyze different components
            self.analyze_headers(msg)
            self.analyze_sender(msg)
            self.analyze_subject(msg)
            self.analyze_body(msg)
            self.analyze_links(msg)
            
            return self.generate_report(msg)
            
        except Exception as e:
            return f"Error analyzing email: {e}"
    
    def analyze_headers(self, msg):
        """
        Analyze email headers for suspicious patterns
        """
        # Check SPF, DKIM, DMARC
        received_headers = msg.get_all('Received', [])
        
        # Look for suspicious routing
        if len(received_headers) > 10:
            self.add_indicator("Excessive mail hops", 2)
        
        # Check for authentication results
        auth_results = msg.get('Authentication-Results', '')
        if auth_results:
            if 'spf=fail' in auth_results.lower():
                self.add_indicator("SPF authentication failed", 3)
            if 'dkim=fail' in auth_results.lower():
                self.add_indicator("DKIM authentication failed", 2)
            if 'dmarc=fail' in auth_results.lower():
                self.add_indicator("DMARC authentication failed", 3)
        
        # Check X-Originating-IP
        orig_ip = msg.get('X-Originating-IP', '')
        if orig_ip:
            # Simple check for suspicious IPs (this is basic)
            ip_pattern = r'\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b'
            ip_match = re.search(ip_pattern, orig_ip)
            if ip_match:
                ip_addr = ip_match.group()
                if self.is_suspicious_ip(ip_addr):
                    self.add_indicator(f"Email from suspicious IP: {ip_addr}", 2)
    
    def analyze_sender(self, msg):
        """
        Analyze sender information
        """
        from_header = msg.get('From', '')
        reply_to = msg.get('Reply-To', '')
        return_path = msg.get('Return-Path', '')
        
        # Extract email addresses
        from_email = self.extract_email(from_header)
        reply_email = self.extract_email(reply_to) if reply_to else None
        
        # Check for mismatched From and Reply-To
        if reply_email and from_email != reply_email:
            self.add_indicator(f"From and Reply-To mismatch: {from_email} vs {reply_email}", 2)
        
        # Check for suspicious domains
        if from_email:
            domain = from_email.split('@')[-1] if '@' in from_email else ''
            if domain:
                if self.is_suspicious_domain(domain):
                    self.add_indicator(f"Suspicious sender domain: {domain}", 3)
                
                # Check for domain spoofing (simplified)
                if self.is_likely_spoofed_domain(domain):
                    self.add_indicator(f"Possible domain spoofing: {domain}", 4)
    
    def analyze_subject(self, msg):
        """
        Analyze subject line for phishing indicators
        """
        subject = msg.get('Subject', '')
        if not subject:
            return
        
        # Decode subject if needed
        decoded_subject = self.decode_header_value(subject)
        
        # Common phishing keywords
        phishing_keywords = [
            'urgent', 'immediate', 'action required', 'verify account',
            'suspend', 'confirm', 'update payment', 'security alert',
            'winner', 'congratulations', 'free', 'limited time'
        ]
        
        subject_lower = decoded_subject.lower()
        found_keywords = [kw for kw in phishing_keywords if kw in subject_lower]
        
        if found_keywords:
            self.add_indicator(f"Suspicious keywords in subject: {', '.join(found_keywords)}", 2)
        
        # Check for excessive punctuation or caps
        if subject.count('!') > 2:
            self.add_indicator("Excessive exclamation marks in subject", 1)
        
        caps_ratio = sum(1 for c in subject if c.isupper()) / len(subject) if subject else 0
        if caps_ratio > 0.5:
            self.add_indicator("Excessive capitalization in subject", 1)
    
    def analyze_body(self, msg):
        """
        Analyze email body content
        """
        body = self.get_email_body(msg)
        if not body:
            return
        
        body_lower = body.lower()
        
        # Look for credential harvesting attempts
        cred_patterns = [
            r'password', r'username', r'login', r'account.*details',
            r'credit.*card', r'social.*security', r'bank.*account'
        ]
        
        for pattern in cred_patterns:
            if re.search(pattern, body_lower):
                self.add_indicator(f"Requests sensitive information: {pattern}", 2)
        
        # Look for urgency language
        urgency_patterns = [
            r'immediately', r'urgent', r'asap', r'expire.*today',
            r'within.*\d+.*hours?', r'act.*now', r'time.*sensitive'
        ]
        
        urgency_matches = []
        for pattern in urgency_patterns:
            if re.search(pattern, body_lower):
                urgency_matches.append(pattern)
        
        if urgency_matches:
            self.add_indicator(f"Urgency language detected: {', '.join(urgency_matches)}", 1)
        
        # Check for generic greetings
        if re.search(r'dear\s+(customer|user|sir|madam)', body_lower):
            self.add_indicator("Generic greeting used", 1)
    
    def analyze_links(self, msg):
        """
        Analyze links in the email
        """
        body = self.get_email_body(msg)
        if not body:
            return
        
        # Find URLs
        url_pattern = r'https?://[^\s<>"]{2,}'
        urls = re.findall(url_pattern, body, re.IGNORECASE)
        
        for url in urls:
            parsed_url = urllib.parse.urlparse(url)
            domain = parsed_url.netloc.lower()
            
            # Check for suspicious domains
            if self.is_suspicious_domain(domain):
                self.add_indicator(f"Suspicious link domain: {domain}", 3)
            
            # Check for URL shorteners
            shorteners = ['bit.ly', 'tinyurl.com', 't.co', 'goo.gl', 'ow.ly']
            if any(short in domain for short in shorteners):
                self.add_indicator(f"URL shortener used: {domain}", 2)
            
            # Check for homograph attacks (simplified)
            if self.has_suspicious_characters(domain):
                self.add_indicator(f"Domain uses suspicious characters: {domain}", 3)
    
    def is_suspicious_domain(self, domain):
        """
        Check if domain appears suspicious
        """
        # Check for common typosquatting patterns
        legitimate_domains = [
            'google.com', 'microsoft.com', 'apple.com', 'amazon.com',
            'paypal.com', 'ebay.com', 'facebook.com', 'twitter.com'
        ]
        
        for legit_domain in legitimate_domains:
            if self.similar_domain(domain, legit_domain) and domain != legit_domain:
                return True
        
        # Check for suspicious TLDs
        suspicious_tlds = ['.tk', '.ml', '.ga', '.cf', '.click', '.download']
        if any(domain.endswith(tld) for tld in suspicious_tlds):
            return True
        
        return False
    
    def is_likely_spoofed_domain(self, domain):
        """
        Check for likely domain spoofing
        """
        # Simple check for character substitution
        substitutions = {'0': 'o', '1': 'l', '3': 'e', '5': 's'}
        for char, replacement in substitutions.items():
            if char in domain:
                return True
        return False
    
    def similar_domain(self, domain1, domain2):
        """
        Check if domains are suspiciously similar
        """
        # Simple Levenshtein distance check
        if abs(len(domain1) - len(domain2)) > 2:
            return False
        
        differences = sum(c1 != c2 for c1, c2 in zip(domain1, domain2))
        return differences <= 2 and differences > 0
    
    def has_suspicious_characters(self, domain):
        """
        Check for homograph attack characters
        """
        # Look for mixed scripts or suspicious Unicode
        suspicious_chars = ['а', 'е', 'о', 'р', 'с', 'х', 'у']  # Cyrillic that look like Latin
        return any(char in domain for char in suspicious_chars)
    
    def is_suspicious_ip(self, ip):
        """
        Basic check for suspicious IP addresses
        """
        # Check for private IP ranges (simplified)
        private_ranges = ['10.', '192.168.', '172.']
        return any(ip.startswith(range_) for range_ in private_ranges)
    
    def extract_email(self, header_value):
        """
        Extract email address from header
        """
        if not header_value:
            return None
        
        email_pattern = r'[\w\.-]+@[\w\.-]+\.\w+'
        match = re.search(email_pattern, header_value)
        return match.group() if match else None
    
    def decode_header_value(self, header_value):
        """
        Decode email header value
        """
        decoded_parts = decode_header(header_value)
        decoded_string = ''
        
        for part, encoding in decoded_parts:
            if isinstance(part, bytes):
                decoded_string += part.decode(encoding or 'utf-8')
            else:
                decoded_string += part
        
        return decoded_string
    
    def get_email_body(self, msg):
        """
        Extract email body content
        """
        body = ""
        
        if msg.is_multipart():
            for part in msg.walk():
                if part.get_content_type() == "text/plain":
                    body += part.get_payload(decode=True).decode('utf-8', errors='ignore')
        else:
            body = msg.get_payload(decode=True).decode('utf-8', errors='ignore')
        
        return body
    
    def add_indicator(self, description, score):
        """
        Add suspicious indicator
        """
        self.suspicious_indicators.append(description)
        self.risk_score += score
    
    def generate_report(self, msg):
        """
        Generate analysis report
        """
        report = []
        report.append("PHISHING EMAIL ANALYSIS REPORT")
        report.append("=" * 40)
        
        # Basic email info
        report.append(f"From: {msg.get('From', 'Unknown')}")
        report.append(f"Subject: {msg.get('Subject', 'No Subject')}")
        report.append(f"Date: {msg.get('Date', 'Unknown')}")
        report.append("")
        
        # Risk assessment
        risk_level = self.get_risk_level()
        report.append(f"Risk Level: {risk_level}")
        report.append(f"Risk Score: {self.risk_score}")
        report.append("")
        
        # Suspicious indicators
        if self.suspicious_indicators:
            report.append("Suspicious Indicators:")
            for i, indicator in enumerate(self.suspicious_indicators, 1):
                report.append(f"  {i}. {indicator}")
        else:
            report.append("No suspicious indicators detected.")
        
        report.append("")
        report.append("Recommendation:")
        if self.risk_score >= 5:
            report.append("HIGH RISK - Likely phishing email. Do not interact.")
        elif self.risk_score >= 3:
            report.append("MEDIUM RISK - Exercise caution. Verify sender independently.")
        else:
            report.append("LOW RISK - Email appears legitimate but remain vigilant.")
        
        return "\n".join(report)
    
    def get_risk_level(self):
        """
        Determine risk level based on score
        """
        if self.risk_score >= 5:
            return "HIGH"
        elif self.risk_score >= 3:
            return "MEDIUM"
        else:
            return "LOW"

def main():
    if len(sys.argv) != 2:
        print("Usage: python3 phishing_analyzer.py ")
        sys.exit(1)
    
    email_file = sys.argv[1]
    analyzer = PhishingAnalyzer()
    report = analyzer.analyze_email_file(email_file)
    print(report)

if __name__ == "__main__":
    main()

Social Engineering Defense Strategies

Building a Security Culture

Training Program Components

Exercise

Incident Response for Social Engineering

Legal and Ethical Considerations