Social Engineering & Phishing: Technical Analysis and Human Defense
From deceptive spear phishing to Business Email Compromise: dissecting attack psychology, SPF/DKIM/DMARC protocols, and human defense.
1. The Human Attack Surface
You can invest millions of dollars in next-generation firewalls, endpoint detection systems, and cryptographic hardware; yet all of it can be undermined if an employee clicks an attachment or approves an MFA prompt.
Social engineering is the art of manipulating individuals into performing actions or releasing confidential information. Rather than finding a zero-day exploit in software, attackers target vulnerabilities in human psychology.
2. Common Social Engineering Vectors
Mass Phishing: Indiscriminate emails pretending to be trusted brands (Amazon, Microsoft, PayPal) designed to harvest credentials.
Spear Phishing: Highly researched, customized messages targeted at specific individuals or roles within an organization.
Business Email Compromise (BEC): Attackers impersonate an executive or vendor, directing finance departments to wire funds to fraudulent accounts.
Vishing & Smishing: Voice phishing over phone calls and SMS-based phishing containing malicious links.
3. Technical Email Authentication: SPF, DKIM, and DMARC
Legacy SMTP email has zero built-in sender verification, allowing anyone to craft an email claiming to be from '[email protected]'. Modern organizations deploy a trio of defensive DNS records to prevent spoofing:
Sender Policy Framework (SPF): A DNS TXT record listing which IP addresses and mail servers are authorized to send mail for your domain.
DomainKeys Identified Mail (DKIM): Adds a cryptographic digital signature to outgoing email headers, verified using the sender's public key published in DNS.
Domain-based Message Authentication (DMARC): Tells receiving mail servers what action to take (none, quarantine, reject) if an email fails SPF or DKIM checks.
; Recommended strict DMARC TXT record
_dmarc.cyberlium.com. IN TXT "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:[email protected];"4. Eliminating Phishing with FIDO2 / Passkeys
Traditional SMS and authenticator app codes can still be intercepted by real-time reverse proxies (like Evilginx).
The definitive technical defense against phishing is FIDO2 / WebAuthn hardware keys (like YubiKeys). FIDO2 cryptographically binds the authentication assertion to the exact domain in the browser address bar, making it impossible for a victim to inadvertently send their credentials to a phishing mirror.