In cybersecurity, Quid Pro Quo is a low-tech social engineering attack. In this attack, attacker promises a benefit or service in exchange for sensitive information or system access. Unlike phishing, Quid Pro Quo relies on the victim’s desire for assistance or a specific reward.

How Quid Pro Quo Attack Typically Works?

The attacker positions themselves as a helper, often posing as a service provider or technical expert.

• Outreach: The attacker calls or messages a target, often claiming to be from a “Technical Support” department or an “IT Help Desk“.
• Offer: They inform the user that they have detected a problem such as a slow connection or a pending software update and offer to fix it for free.
• Exchange: To perform the fix, the attacker asks the user to disable their antivirus, provide their login credentials, or install a remote access tool.
• Payload: Once the user complies, the attacker gains access to the network, installs malware, or steals sensitive data.

Common Examples

• IT Support Scams: An attacker calls random extensions in a company until they find someone experiencing a genuine technical glitch. They offer to fix it if the user shares their password.
• Survey Rewards: An email promises a gift card or a free eBook in exchange for completing a security survey that asks for corporate credentials or personal details.
• Software Upgrades: A prompt offers a free premium upgrade to a tool you already use, provided you download a specific executable file (which is actually a Trojan).

Quid Pro Quo vs. Baiting

While similar, these two tactics have a distinct difference:

• Baiting relies on curiosity or greed by leaving an object (like a malware-infected USB drive in a parking lot) for the victim to find.
• Quid Pro Quo involves an active two-way exchange where the attacker performs a service to earn the victim’s trust.

How to Defend Against It?

• Verify Identity: Never provide credentials to someone who contacted you first. Hang up and call the official support number found on your company’s internal directory.
• Standardize Support: Organizations should have a set protocol for how IT support is requested and delivered.
• Security Awareness: Training users to recognize that legitimate technical support will never ask for a password to resolve an issue.