Social Engineering (SE) is one of the most dangerous aspect an attacker can use against a given entity (private citizen, industry, government, ...). In order to perform SE attacks, it is necessary to collect as much information as possible about the target (or victim(s)). The aim of this paper is to report the details of an activity which took to the development of an automatic tool that extracts, categorizes and summarizes the target interests, thus possible weaknesses with respect to specific topics. Data is collected from the user's activity on social networks, parsed and analyzed using text mining techniques. The main contribution of the proposed tool consists in delivering some reports that allow the citizen, institutions as well as private bodies the screening of their exposure to SE attacks, with a strong awareness potential that will be reflected in a decrease of the risks and a good opportunity to save money.
Social engineering has emerged as a serious threat in virtual communities and is an effective means to attack information systems. The services used by today's knowledge workers prepare the ground for sophisticated social engineering attacks. The growing trend towards BYOD (bring your own device) policies and the use of online communication and collaboration tools in private and business environments aggravate the problem. In globally acting companies, teams are no longer geographically co-located, but staffed just-in-time. The decrease in personal interaction combined with a plethora of tools used for communication (e-mail, IM, Skype, Dropbox, LinkedIn, Lync, etc.) create new attack vectors for social engineering attacks. Recent attacks on companies such as the New York Times and RSA have shown that targeted spear-phishing attacks are an effective, evolutionary step of social engineering attacks. Combined with zero-day-exploits, they become a dangerous weapon that is often used by advanced persistent threats. This paper provides a taxonomy of well-known social engineering attacks as well as a comprehensive overview of advanced social engineering attacks on the knowledge worker.