Social engineering
Overview
Social engineering is a general term for methods that target human psychology rather than system vulnerabilities. It uses emotions such as trust, fear, curiosity, and urgency to get the target to disclose information or carry out unauthorized actions. No matter how strong the technical security is, it can be broken if a person is deceived.
Common methods
Phishing is a common method that steals login information through emails or websites posing as legitimate services. Pretexting is a method of gaining trust by making up a fictional person or situation, using a pretext such as "I'm from the IT department, and I need to confirm your password."
Baiting is a method that uses curiosity to get people to run malware, for example by dropping a USB stick in a parking lot. Tailgating is a physical method of following an authorized visitor through a security gate. None of these rely on technical sophistication; they all exploit how predictable human behavior patterns are.
Social engineering through anonymous questions
Anonymous question services can be misused as a channel for social engineering. In this tactic, an attacker sends anonymous questions and collects personal information and behavior patterns from the owner's answers. For example, they send questions like "What's your nearest station?" and "What time of day are you usually active?" spread over several rounds, and build up fragments of information.
In clever cases, the questions themselves look harmless. They may estimate where you spend your time from your answer to "Do you have a cafe you recommend?" or narrow down which school you went to from "What club were you in as a student?" When answering, the owner needs to be aware of how far that information could identify them if it is pieced together.
How to think about defense
Technical measures alone are not enough to defend against social engineering, and improving users' awareness is essential. For question box owners, efforts to encourage them not to include information that could identify them in their answers are needed.
On the service side, one possible measure is a system that analyzes question patterns from the same IP address and detects strings of questions aimed at gathering information. Using content filtering to flag questions that directly ask for personal information can also be effective. However, fully judging the intent of a question automatically is difficult, and in the end, much depends on the owner's own judgment.