2.2 Deception Flashcards
2.2.1 Social Engineering
Social engineering is a non-technical strategy that attempts to manipulate individuals into performing risky actions or divulging confidential information.
Rather than software or hardware vulnerabilities, social engineering exploits human nature by taking advantage of people’s willingness to help or preying on their weaknesses, such as greed or vanity.
Pretexting
This type of attack occurs when an individual lies to gain access to privileged data. For example, an attacker pretends to need personal or financial data in order to confirm a person’s identity.
Something for something (quid pro quo)
Quid pro quo attacks involve a request for personal information in exchange for something, like a gift. For example, a malicious email could ask you to give your sensitive personal details in exchange for a free vacation.
Identity fraud
This is the use of a person’s stolen identity to obtain goods or services by deception. For example, someone acquires your personal information and attempts to apply for a credit card in your name.
2.2.2 Social Engineering Tactics
Cybercriminals rely on several social engineering tactics to gain access to sensitive information.
Authority
Attackers prey on the fact that people are more likely to comply when instructed by someone they perceive as an authority figure.
For example, an executive opens what looks like an official subpoena attachment but is actually an infected PDF.
Intimidation
Cybercriminals will often bully a victim into taking an action that compromises security.
For example, a secretary receives a call that their boss is about to give an important presentation but the files are corrupt. The criminal on the phone claims it’s the secretary’s fault and pressures the secretary to send across the files immediately or risk dismissal.
Consensus
Often called ‘social proof,’ consensus attacks work because people tend to act in the same way as other people around them, thinking that something must be right if others are doing it.
For example, cybercriminals may publish a social media post about a false business opportunity and get dozens of legitimate or illegitimate accounts to comment on its validity. This encourages unsuspecting victims to make a purchase.
Scarcity
A well known marketing tactic, scarcity attacks work because attackers know that people tend to act when they think there is a limited quantity of something available.
For example, someone receives an email about a luxury item being sold for very little money, but it states that there are only a handful available at this very favorable price. This may spur the unsuspecting victim into impulsively taking action.
Urgency
Similarly, people also tend to act when they think there is a limited time to do so.
For example, cybercriminals promote a fake time-limited shipping offer to try and prompt victims to take action quickly.
Familiarity
People are more likely to do what another person asks if they like this person.
Therefore, attackers will often try to build a rapport with their victim in order to establish a relationship. In other cases, they may clone the social media profile of a friend of yours, in order to get you to think you are speaking to them.
Trust
Building trust in a relationship with a victim may require more time to establish.
For example, a cybercriminal disguised as a security expert calls the unsuspecting victim to offer advice. When helping the victim, the ‘security expert’ discovers a ‘serious error’ that needs immediate attention. The solution provides the cybercriminal with the opportunity to violate the victim’s security.
2.2.4 Shoulder Surfing and Dumpster Diving
Shoulder surfing is a simple attack that involves observing or literally looking over a target’s shoulder to gain valuable information such as PINs, access codes, or credit card details. Criminals do not always have to be near their victim to shoulder surf — they can use binoculars or security cameras to obtain this information.
This is one reason why an ATM screen can only be viewed at certain angles. These types of safeguards make shoulder surfing much more difficult.
You may have heard of the phrase, ‘one man’s trash is another man’s treasure.’ Nowhere is this more true than in the world of dumpster diving — the process of going through a target’s trash to see what information has been thrown out.
This is why documents containing sensitive information should be shredded or stored in burn bags until they can be destroyed.
2.2.5 Impersonation and Hoaxes
Impersonation
Impersonation is the act of pretending to be someone else to trick someone into doing something they would not ordinarily do. For example, a cybercriminal posing as an IRS employee recently targeted taxpayers, telling the victims that they owed money that had to be paid immediately via wire transfer — or risk arrest.
Criminals can also use impersonation to attack others. For example, they can pose as their victim online and post on websites or social media pages to undermine the victim’s credibility.
