Social Engineering in Information Warfare Presented by: Dr. Groš Date: 13 June 2024 Research Question - - Can social engineering (SE) be used for information warfare? • Is SE a technique or something else related to IW? • What is the difference between SE used in cyber security? This question is important for several reasons • SE can be used for the purposes of information operations • Knowledge from SE could be used to better understand information warfare • It is much easier to study SE in cyber security then in information warfare • Protections and detections used for SE might be used in the case of IW as well What is Social Engineering (SE)? - Social Engineering (SE) is a set of applied psychological and analytical techniques used to manipulate victims.* - SE is frequently associated with information and cyber security, but it is separate from them because it uses technology as a mean, not as a target. • Additionally, certain SE techniques don't rely on technology at all! Social Engineering Tactics - SE uses the following steps (tactics) • Attack formulation – Goal and target identification • Information gathering - Identify potential sources, gather information from sources, assess gathered information • Preparation - Combination and analysis of gathered information, development of attack vector • Develop relationship - Establishment of communication, rapport building • Exploit relationship - Priming the target, elicitation • Debrief - Maintenance, Transition, Goal satisfaction Attack formulation in IW - Goal in the case of information operations is to spread disinformation (potentially in a controlled way) - - Depending on disinformation to be spread, targets can be • Highly connected/influential individuals, e.g. influencers • Key people with connections to others • Groups, e.g. echo chambers • Masses The key point is that targets are unaware of being targeted and their role An example - Russia had a stake in a big company in Croatia • Due to sanctions, they were forced out and to protect investment tried to sell their stake to Middle east businessman • This transaction was overturned on the court in Netherlands in December last year • Immediately after New year's holidays a prominent Croatian politician was accusing CEO of the company using the same arguments as the Russians during the trial • - Could this be a social engineering on influential individual? An FBI informant was arrested for fabricating charges against Hunter Biden and Joe Biden. • Prosecution claims that he had contacts with Russian intelligence service • Could this be a social engineering on (or by) a key individual? • Note that whoever is a victim of SE attack turns disinformation into misinformation! Conclusions - It seems that SE can be (and is) used in Information warfare • - Even though it is not called by that name This is still ongoing research.