Denial of Service and Social Engineering

Learning outcomes:

  • Explain how denial of service and distributed denial of service attacks affect availability
  • Identify the symptoms of a denial of service attack, and describe ways to defend against one
  • Describe common social engineering vectors and types, such as phishing, vishing, smishing, and pretexting
  • Explain how individuals and businesses can protect themselves against social engineering

Would you like to download my PowerPoint to follow along?

  • Denial of Service (DoS)
    • An attack on availability, the A in the CIA triad
    • Example attacks
      • Packet flooding
      • Smurf attack (ICMP)
      • Pulsing zombies
      • Permanent denial of service (PDoS), such as PhlashDance
  • Distributed Denial of Service (DDoS)
    • Application layer DDoS (the top layer of the OSI model)
    • Advanced persistent DoS by an advanced persistent threat (APT)
    • Denial of service as a service, known as booters or stressers
    • Example: the Mirai botnet, made from hacked IoT devices
  • Symptoms
    • Slow networks
    • Sites that are unavailable
    • No internet service
  • What to do
    • Third party services designed to stop DoS and DDoS
    • Packet filtering, ingress and egress
    • Turn off unused ports
    • Update and patch
    • Watch network traffic, and watch the news
    • Harden your machines
  • Legality
    • Denial of service is illegal
    • In the US, it's a federal crime under the Computer Fraud and Abuse Act
    • Some activists, such as Anonymous, have argued DDoS should be a legal form of protest
  • Social Engineering
    • Targeted against non-specific attacks
    • Vectors
      • Email
      • Phone
      • In person
      • Social media
    • Types
      • Phishing and spear phishing
      • Vishing (voice) and smishing (text messages)
      • Pretexting
      • Typosquatting
  • Deepfakes and AI-powered social engineering
    • Deepfake video calls: in 2024, an employee at engineering firm Arup sent $25.6 million after a video call where everyone else on the call was a deepfake (CNN)
    • Voice cloning makes vishing calls sound like your boss or a family member
    • Watch: an ethical hacker clones a reporter's voice with AI, and tricks a coworker into giving up a passport number in 5 minutes (60 Minutes, with a transcript)
    • Canvas (2026): attackers used voice phishing to steal data on over 30 million students and staff
    • Instagram (2026): attackers abused Meta's AI support chatbot to reset passwords, and thousands of accounts were hijacked (TechCrunch)
    • Defense: check through a second channel, call back on a number you already know, and agree on a code word with family
  • How it works
    • Reconnaissance
      • Searching online: social media, business networking sites, and company websites
      • Reading people: social engineers watch body language to find out who's in charge, and who's likely to help
      • Dominance cues: whose hand is on top in a handshake, who takes up space, who talks the most and gets the last word
      • Comfort and trust cues: eye contact, open hands, and mirroring, which is copying someone's posture or gestures to build trust
    • Setting the environment
    • Exfiltration
  • Inoculation: personal
  • Inoculation: businesses
    • Training and awareness
    • Scripted responses, so staff know what to say
    • Test! Test! Test!

Suggested Activities and Discussion Topics:

  • Observation game: watch how people greet each other and who seems to be in charge of a conversation, using my body language checklist. Don't be creepy!
  • Discussion: should DDoS ever be considered a legal form of protest? Why or why not?
  • Discussion: what social engineering attempt have you seen or received? What gave it away?
  • Follow the instructions on this PDF (accessible HTML version)

Would you like to see some more classes? View all classes