Step 167. Social Engineering: Hacking Humans — One Email That Bypasses the Firewall

Level 2 — Introduction to Security and Attack Skill Basics | Difficulty ★★☆☆☆ | Estimated time: 2.5 hours

Prerequisites: Steps 122–125 (authentication attacks) complete. You know the word phishing.

What you need: the spam folder of your own mailbox (never click any links), writing tools
Chapter type: today is a [concept] chapter. There is no exercise that creates or sends phishing email — we dissect existing mail and design defenses.
Ethical/legal boundary: creating or sending phishing sites/emails is illegal regardless of purpose or scale, except simulations approved in writing by an organization. "Just a prank on a friend" counts too. This chapter’s goal is not attack technique but a discerning eye and defense design.

Until now we’ve knocked on technology’s doors — ports, passwords, web vulnerabilities. Yet in breach statistics, the biggest share of initial intrusion paths is not a technical attack but one email sent to a person. The reason is simple: no matter how sturdy the firewall, it can’t stop a situation where "an employee types in the password themselves."

Social engineering is the collective name for techniques that exploit human psychology — urgency, authority, curiosity — instead of technical vulnerabilities, making the defense open itself. Today you dissect one phishing email with no tools, read the X-ray called mail headers, and build a judgment checklist you can explain to your family.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain with examples that social engineering is a technique "attacking psychology, not technology"
Pick out phishing email’s three psychological devices (urgency, authority, curiosity) from real phrasing
Identify subtle deformations of sender addresses and links
Read the Received path and SPF/DKIM results in mail headers
Build a phishing judgment checklist and explain it to a non-expert

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	The mail client’s "show original" feature (Gmail: three dots → Show original)
Today’s commands	no new commands — your eyes and headers are the tools
Concepts needed	social engineering, phishing structure, SPF/DKIM, look-alike domains, the legal conditions of simulations
Today’s artifact	three phishing analysis notes + one judgment checklist

2-1. Why Humans Are the Weakest Link

Technical controls work by the rules. Password policies, firewalls, antivirus — all are yes/no machines. Humans are different. Humans judge within situations, and that judgment is swayed by emotion. Social engineering manipulates exactly that emotion.

Kevin Mitnick, famous as a historical case, said in his memoir that he gained more from a single phone call — "this is the IT team, we need to confirm your password" — than from technical intrusion. Decades later, a large share of major breaches still starts from a single phishing email. Technology has advanced, but human psychology hasn’t.

2-2. Three Psychological Buttons

Dissect a phishing email and, almost without exception, it’s pressing one or more of these three.

Psychological device	How it works	Representative phrasing
Urgency	Steals the time to think	"Your account will be suspended if no action is taken within 24 hours"
Authority	Rides on a presence hard to defy	"Executive office directive," "Tax agency notice," "IT security team"
Curiosity/gain	Touches the urge to check	"Prize winner," "Confirm your delivery address," "Someone posted your photo…"

The common thread of the three: they rush your judgment. No legitimate organization demands "click this link right now or face a penalty." This one sentence becomes the first line of the checklist you’ll build today.

Real phishing presses these buttons in combination. A combo like "executive office directive (authority) + by today (urgency)" takes precise aim at an office worker’s line of resistance. The reason for learning the three buttons separately is so you can decompose them one by one even when they overlap. The habit of asking, when a mail arrives, "which of my buttons is this sentence pressing right now?" — that is the starting posture of social-engineering defense.

2-3. Look-Alike Domains — The Anatomy of Deception

Phishing’s technical part is mostly address deformation.

Added/substituted letters: naver.com → naver-secure.com, rnicrosoft.com (rn looks like m)
Subdomain illusion: naver.com.evil-site.example — the real domain is the rightmost evil-site.example
Mismatch between link text and actual URL: the text says "www.bank.example," but the actual connection goes elsewhere

There’s one judgment principle: read domains from the right. The registered domain at the very end is the real owner; everything to its left is decoration the owner attached at will.

2-4. Mail Headers — The Postmark on the Back of the Envelope

The mail body is the letter paper; the headers are the envelope and postmark. The sender display in the body can be written freely by the sender, but the headers retain the record of the servers the mail actually passed through (Received) and the authentication results of the sending domain.

SPF: is this IP qualified to send mail for this domain?
DKIM: is the content genuinely signed by its domain? (tamper verification)
DMARC: the policy for how to handle the two results

The receiving mailbox writes these results into the headers — finding and reading phrases like spf=fail, dkim=fail is today’s practice.

2-5. The Existence of Attack Tools and the Conditions of Legality

Tools like SET (Social-Engineer Toolkit) and Gophish automate sending phishing mail and fake login pages. These tools have exactly one legal use — simulated phishing drills approved in writing by the organization: drills a company contracts for employee security education, with scope, duration, and targets fixed in documents.

"Legal tool + illegal use = illegal." The fact that a tool is public is not a license to use it — it’s merely the standard-equipment list of attacks a defender must know.

3. Follow Along

3-1. Dissecting a Sample Phishing Email

Below is a sample made up for this textbook. It gathers the typical elements of real phishing. There are no real links.

Sender: KB Bank Security Center <noreply@kb-secure-alert.example>
Subject: [URGENT] An overseas payment attempt was detected on your account

A payment of $487 was just attempted on your account from an overseas IP (USA).
If this was not your transaction, you must verify your identity immediately at the
link below within 24 hours to protect your account. Otherwise your account will
be temporarily suspended.

>> Verify your identity <<  (actual link: http://kb-secure-alert.example/verify)

Dissection practice — find the five clues (answers in Section 5):

What are the psychological devices?
What’s the problem with the domain?
How do "link text and actual URL" differ?
What is the demand a real bank would never make?
If you looked at the headers, what results would you expect?

3-2. Finding Real Samples in My Spam Folder

Now let’s look at real material. Rules first.

⚠️ Never open links or attachments — we look only at bodies and addresses
⚠️ Never reply to the sender
If a mail is suspicious, that state is itself practice material — delete after analysis

Pick three from the spam folder and dissect each in the same format as 3-1. At least three clues each should come out. Real phishing is often craftier than the sample — the sender may look genuine, or it may cite part of your actual transaction history (leaked information).

A recommended format for analysis notes:

[Analysis 1] Subject: (write it), Displayed sender: (write it)
- Psychological device: which of urgency / authority / curiosity
- Address clues: (domain deformation, etc.)
- Demand clues: (a demand no legitimate organization would make)
- Headers: SPF=?, DKIM=?
- One-line verdict: this mail's true identity

You record because the eye grows from records. After dissecting three mails in this format, from the fourth mail onward the clues start showing themselves before the format.

3-3. Reading Headers — The Mail’s X-Ray

In Gmail: three dots at the mail’s top right → "Show original." Below is an example (actual values differ per mail).

Authentication-Results: mx.example-mail.com;
    spf=fail (sending IP 203.0.113.7 is not an authorized sender for kb-secure-alert.example)
    smtp.mailfrom=kb-secure-alert.example;
    dkim=fail (no signature);
    dmarc=fail
Received: from mail-out.badhost.example (mail-out.badhost.example [203.0.113.7])
    by mx.example-mail.com ...
Return-Path: <bounce@badhost.example>

How to read it: three lines are enough. ① spf=fail — it came from somewhere that isn’t the envelope domain’s authorized sending server. ② dkim=fail — the domain signature is missing or broken. ③ The Return-Path differs from the displayed sender. The odds of all three being fail in a real bank’s mail are effectively zero.

3-4. Building a Judgment Checklist — Today’s Artifact

Move what you dissected into a checklist for non-experts. The example’s first five lines:

### Phishing judgment checklist (family edition)
1. If it says "right now," "within 24 hours," or "will be suspended," suspect first
2. Look at the rightmost domain of the sender address — a bank using @gmail.com is 100% fake
3. Hover over the link (mobile: long-press) to check the actual address
4. If in doubt, don't use the link in the mail — verify directly through the official app or phone number you know
5. Any input window asking to "verify" your password, OTP, or card number is fake

Standard: fill in 10 items, but each item must be "a sentence your grandmother would understand if read over the phone." If jargon creeps in, rewrite it.

3-5. Defense Design — How Organizations Block It

Individual eyes alone have limits. An organization’s defense forms layers.

Technology, layer 1: SPF/DKIM/DMARC verification and spam filters — most are filtered here
Technology, layer 2: link rewriting, sandboxed attachment inspection
People: the organizational version of today’s checklist — regular education and simulated phishing drills (with written approval)
Procedure: a rule that "important tasks ordered by mail must always be re-confirmed through a separate channel"

The core philosophy: design that reduces damage on the premise of being breached — with a re-confirmation procedure, the organization isn’t fooled even if one person is.

Drill results must be viewed from the same perspective. In organizations that discipline employees who click, nobody reports when the next attack comes. Only organizations that turn a click into an opportunity to report gain the drill’s effect — phishing defense’s real metric is not "0% click rate" but "time elapsed until someone reports."

4. Missions & Exercises

Mission — Three Phishing Analyses and One Checklist

Pick three mails from my spam folder and dissect them in 3-1’s format (at least 3 clues each, without clicking links)
Open one of their header originals and find and record the SPF/DKIM results and Received path (mask personal information)
Complete a 10-item "family judgment checklist"
Actually explain the finished checklist to one person, and fix the items they didn’t understand

Exercises

Exercise 1. Explain why social engineering has a higher success rate than technical attacks, "from the firewall’s perspective."

Exercise 2. State one common thread of the three devices (urgency, authority, curiosity), and explain why it becomes a clue for detection.

Exercise 3. In naver.com.evil-site.example, what is the real domain, and why must you read from the right?

Exercise 4. The body’s sender display can’t be trusted, but the header’s authentication results (SPF/DKIM) can — explain why from the perspective of "who writes it."

5. Model Answers & Completion Criteria

Mission Model Answer

The five clues of the 3-1 sample (practice reference):

Psychological devices: urgency ("within 24 hours," "temporarily suspended") + authority (impersonating a bank security center)
Domain: kb-secure-alert.example — a look-alike domain, not the real bank’s domain
Link mismatch: the text "Verify your identity" hides a completely different address
Abnormal demand: banks don’t demand "immediate identity verification" via a mail link — the official app or phone is the normal path
Expected headers: spf=fail, dkim=fail, Return-Path mismatch

How to verify: ① Do the three analyses include both body clues and address clues? ② Does the header record include SPF/DKIM results? ③ Does the checklist contain only action guidance, no jargon? ④ Are there traces of fixes after the actual explanation — if the sentences before and after explaining differ, that’s evidence of growth?

Exercise Answers

Answer 1. Firewalls and filters inspect packets and code, but "a password a person voluntarily typed" can’t be distinguished from normal traffic. Social engineering doesn’t break technical controls — it bypasses through the point where controls are paused (human judgment).

Answer 2. The common thread is that they rush judgment — they remove the time to think. That’s why it becomes a detection clue: one question, "is this mail rushing me?", detects all three devices. For a rushing mail, responding slowly is enough.

Answer 3. The real domain is evil-site.example. Domains are hierarchical, so the rightmost is the actual owner, and everything to the left is subordinate names the owner attaches freely. Read from the left and you’re fooled by decoration.

Answer 4. The body’s sender display (From:) is text the sender writes freely. SPF/DKIM results, by contrast, are recorded by the receiving server, which verified the actual sending IP and cryptographic signature. The referee is not the sender but the receiving infrastructure, so it can be trusted.

Completion Criteria Checklist

[ ] I found the five clues in the sample mail myself
[ ] I dissected three real spam mails without clicking links
[ ] I found and read SPF/DKIM results in a header original
[ ] I can explain the habit of reading domains from the right
[ ] I completed a 10-item family checklist
[ ] I actually explained the checklist to someone and fixed it
[ ] I can state that sending phishing is illegal, along with the legal conditions of drills

6. Common Pitfalls & Fixes

Wall 1. My spam folder is empty

Symptom: no samples to analyze.
Cause: a clean account with a well-working filter, or spam auto-deletes.
Fix: complete the dissection practice with 3-1’s made-up sample first, then use capture images of real phishing cases published in the news (phishing alerts from financial regulators or national CERTs) as material. Cases published by official bodies are safe teaching materials.

Wall 2. There’s a mail I simply cannot tell real from fake

Symptom: a sophisticated mail, e.g., one that knows part of your actual transaction history.
Cause: spear phishing, personalized with leaked personal information.
Fix: that’s the textbook case — the response to an indistinguishable mail is not "try harder to distinguish" but channel separation. Don’t touch the link in the mail; verify directly through the official app or main phone number. This one procedure keeps you safe regardless of distinguishing skill.

Wall 3. Headers pour out terms I’ve never seen

Symptom: multiple Received lines, ARC, X- headers…
Cause: headers are the records of every server actually traversed, so they’re long.
Fix: no need to read it all. Find just three: spf=, dkim=, dmarc= in the Authentication-Results block. The rest is merely water flowing above them.

Wall 4. I start thinking "I wouldn’t fall for it"

Symptom: looking at the samples, the reaction "who falls for this?"
Cause: nobody falls for it in an analytical posture. Social engineering targets the moments when the analytical posture is off — a busy afternoon, the commute home, tax season.
Fix: this is the checklist’s real use. Judgment varies with condition, but a procedure like "for a rushing mail, change channels" doesn’t.

Wall 5. I want to send a phishing drill mail myself

Symptom: you want to test friends or coworkers with a tool like Gophish.
Cause: curiosity — but there’s a clear line.
Fix: sending is illegal (drills presuppose the organization’s written approval). The legal activities available with today’s learning are analysis and defense design only — and those alone achieve all of this chapter’s goals.

7. Summary

Today’s Concepts

Concept	One-line explanation
Social engineering	Techniques that attack human psychology instead of technical vulnerabilities
Phishing	The representative form of social engineering — luring information with fake mail/sites
Urgency·authority·curiosity	The three psychological buttons phishing presses — the common thread is "rushing"
Look-alike domain	Subtle address deformation — read domains from the right
SPF/DKIM/DMARC	Sender authentication results recorded by the receiving server
Simulated phishing drill	The only legal sending — conducted by an organization with written approval
Channel separation	The procedure of re-confirming suspicious requests through a separate path

Today’s Commands

Tool	What it does
Mail "Show original" (Gmail, etc.)	Read headers — check SPF/DKIM
Mouse-over on links	Compare text vs actual URL
CERT/regulator phishing alerts	Safe real-case teaching material
(For organizations) Gophish, SET	Tools for written-approval drills only

An Instinct More Important Than Commands

The phishing mail you dissected today is technically crude — no vulnerability, no exploit. Yet the world’s largest breaches started from exactly this crude mail. The higher technical defenses climb, the more attackers aim lower — at people. The final line of defense has moved from machines to humans.

That’s why the checklist you made today is not an appendix but this chapter’s main text. And remember — a phishing analyst’s real weapon is not a keen eye but the procedure: "the more you’re rushed, the slower you go, through another channel." Eyes tire; procedures don’t.

Once every box is checked, Step 167 is complete.