1.1 Social Engineering Techniques Flashcards
Typosquatting / Sting Site / Fake URL / URL Hijacking
A user types www.gooogle.com into their address bar and get redirected to a malicious website that freezes up their browser and warns that their computer has been infected
Pharming
Redirect a legit website to a bogus site
Vishing
Voice Phishing
Smishing
Phishing done by text message / SMS
Reconnaissance
Gather information on the victim
Spear Phishing
Targeting a specific individual or group within a company
Whaling
Spear Phishing the CEO/CFO of a company
Impersonation
Pretending to be someone else to gain information
Eliciting Information
Extracting information from a victim
Dumpster Diving
Diving in the dumpster…. literally.
Shoulder Surfing
Gathering information from afar, such as webcam monitoring, looking at the info through a mirror, binoculars/telescopes, etc.
Tailgating
Following someone into a restricted area
Hoax
A threat that doesn’t actually exist
Watering Hole Attack
A web server has been compromised and is being used to target web traffic in order to deploy malware or collect data.
SPAM
Unsolicited messages from texts, email, forums, etc.
Unsolicited email, Trackback, negative SEO attacks, spiders, and malware warnings
SPIM
Spam over Instant Messenger
rDNS
Reverse Domain Name Service lookup of a domain name from an IP address
Influence Campaigns
This type of campaign, also known as a misinformation operation, involves collecting tactical information, determining key stakeholders, and launching propaganda campaigns, often to gain a competitive advantage
Invoice Scam
A false email from a seemingly reputable entity or a high-level manager requesting a payment and may even link to a “pay” website
AUP
Acceptable Use Policy
Hybrid Warfare
Involves traditional warfare as well as incorporation of the cyber realm in a non-traditional way
BEC (Business Email Compromise)
Often targets companies who outsource, perform wire xfers, or use suppliers from abroad by creating phony invoices, using C-Team fraud, compromising their email accounts, or impersonating an attorney or trusted person.
Xfer
Transfer / move oneself from one location or job to another
SMTP
Simple Mail Transfer Protocol:
Internet standard communication protocol for electronic mail transmission
Credential Harvesting
Harvesting passwords and login credentials
Smishing
Phishing is done by text message / SMS
