1.0 Attacks, Threats, and Vulnerabilities Flashcards
How can familiarity/liking be used in social engineering?
Familiarity/Liking:
Some people have the sort of natural charisma that allows them to persuade others to do as they request. One of the basic tools of a social engineer is simply to be affable and likable, and to present the requests they make as completely reasonable and unobjectionable. This approach is relatively low-risk as even if the request is refused, it is less likely to cause suspicion and the social engineer may be able to move on to a different target without being detected.
How can consensus/social proof be used in social engineering?
The principle of consensus or social proof refers to the fact that without an explicit instruction to behave in a certain way, many people will act just as they think others would act. A social engineering attack can use this instinct either to persuade the target that to refuse a request would be odd (“That’s not something anyone else has ever said no to”) or to exploit polite behavior to slip into a building while someone holds the door for them. As another example, an attacker may be able to fool a user into believing that a malicious website is actually legitimate by posting numerous fake reviews and testimonials praising the site. The victim, believing many different people have judged the site acceptable, takes this as evidence of the site’s legitimacy and places their trust in it.
How can authority and intimidation be used in social engineering?
Many people find it difficult to refuse a request by someone they perceive as superior in rank or expertise. Social engineers can try to exploit this behavior to intimidate their target by pretending to be a senior executive. An attack might be launched by impersonating someone who would often be deferred to, such as a police officer, judge, or doctor. Another technique is using spurious technical arguments and jargon.
How can scarcity and urgency be used in social engineering?
Often also deployed by salespeople, creating a false sense of scarcity or urgency can disturb people’s ordinary decision-making process. The social engineer can try to pressure his or her target by demanding a quick response.
How can trust be used in social engineering?
Making a convincing impersonation and establishing a trust with the target usually depends on the attacker obtaining privileged information about the organization. For example, where the attacker impersonates a member of the organization’s IT support team, the attack will be more effective with identity details of the person being impersonated and the target.
What is dumpster diving?
Dumpster diving refers to combing through an organization’s (or individual’s) garbage to try to find useful documents (or even files stored on discarded removable media).
What is tailgaiting and Piggy Backing?
Tailgating is a means of entering a secure area without authorization by following close behind the person that has been allowed to open the door or checkpoint. Piggy backing is a similar situation, but means that the attacker enters a secure area with an employee’s permission. For instance, an attacker might impersonate a member of the cleaning crew and request that an employee hold the door open while they bring in a cleaning cart or mop bucket.
What is pretexting?
The classic impersonation attack is for the social engineer to phone into a department, claim they have to adjust something on the user’s system remotely, and get the user to reveal their password. This specific attack is also referred to as pretexting.
What is a lunchtime attack?
Lunchtime attacks—most authentication methods are dependent on the physical security of the workstation. If a user leaves a workstation unattended while logged on, an attacker can physically gain access to the system. This is often described as a lunchtime attack. Most operating systems are set to activate a password-protected screen saver after a defined period of no keyboard or mouse activity. Users should also be trained to lock or log off the workstation whenever they leave it unattended.
How can credential databases be used for social engineering?
Credential databases—account details from previous attacks are widely available (haveibeenpwned.com). An attacker can try to match a target in one of these databases and hope that they have reused a password. The attacker could also leverage third-party sites for impersonation. For example, rather than using a work account, they could gain control of a social media account.
What is phishing?
Phishing is a combination of social engineering and spoofing. It persuades or tricks the target into interacting with a malicious resource disguised as a trusted one, traditionally using email as the vector.
What is spear phishing?
Spear phishing—a phishing scam where the attacker has some information that makes an individual target more likely to be fooled by the attack. Each phishing message is tailored to address a specific target user.
What is whaling?
Whaling—a spear phishing attack directed specifically against upper levels of management in the organization (CEOs and other “big fish”). Upper management may also be more vulnerable to ordinary phishing attacks because of their reluctance to learn basic security procedures.
What is vishing?
Vishing—a phishing attack conducted through a voice channel (telephone or VoIP, for instance). For example, targets could be called by someone purporting to represent their bank asking them to verify a recent credit card transaction and requesting their security details. It can be much more difficult for someone to refuse a request made in a phone call compared to one made in an email.
What is SMiShing?
SMiShing—this refers to using short message service (SMS) text communications as the vector.
