2.2 Explain common threat vector and attacks surfaces/ social engineering Flashcards
2.0 Threats, Vulnerabilities, and Mitigations
Different Threat Vectors
■ Message-based : email, SMS, phishing
■ Image-based : embedding of malicious code inside of an image file
■ File-based : disguised as legitimate documents or software, can be
transferred as email attachments, through file-sharing services, or hosted
on a malicious website
■ Voice Calls : Vhishing
■ Removable Devices : Baiting : Attacker might leave a malware-infected USB drive in a location where their target might find it.
■ Unsecured Networks : wireless, wired, and Bluetooth networks that
lack the appropriate security measures to protect these networks
BlueBorne or BlueSmack
exploits
BlueBorne
■ Set of vulnerabilities in Bluetooth technology that can
allow an attacker to take over devices, spread malware, or
even establish an on-path attack to intercept
communications without any user interaction
BlueSmack
■ Type of Denial of Service attack that targets
Bluetooth-enabled devices by sending a specially crafted
Logical Link Control and Adaptation Protocol packet to a
target device
Threat Vector
how is the attack
- Means or pathway by which an attacker can gain unauthorized access
Attack Surface
where is the attack
- various points where an unauthorized user can try to enter
data to or extract data from an environment
Attack Surface Can be minimized by
Restricting Access
Removing unnecessary software
Disabling unused protocols
Human vectors/social engineering Techniques
- Phishing
- Vishing
- Smishing
- Misinformation/disinformation
- Impersonation
- Business email compromise
- Pretexting
- Watering hole
- Brand impersonation
- Typosquatting
- Frauds and Scams
Social Engineering
Manipulative strategy exploiting human psychology for unauthorized access to
systems, data, or physical spaces
○ Motivational Triggers Used by Social Engineer
- Familiarity and Likability
● Consensus and Social Proof
● Authority and Intimidation
● Scarcity and Urgency
- Phishing
Sending fraudulent emails that appear to be from reputable sources to reveal personal information
- Vishing
Voice Phishing, tricks their victims into sharing personal or financial information
- Smishing
text messages to trick individuals into providing their
personal information
- Misinformation/disinformation
Misinformation
■ False or inaccurate information shared without harmful intent
○ Disinformation
■ Involves the deliberate creation and sharing of false information with the intent to deceive or mislead
- Impersonation
Attackers provide details to help make the lies and the impersonation
more believable to a potential victim.
- Business email compromise
targets businesses by
using one of their internal email accounts to get other employees to
perform some kind of malicious actions on behalf of the attacker
- Pretexting
Creating a fabricated scenario to manipulate targets
- Watering hole
compromise a specific
website or service that their target is known to use
- Brand impersonation
Attackers use the brand’s logos, language, and information to create
deceptive communications or website.
attacker pretends to
represent a legitimate company or brand
- Typosquatting
Also known as URL hijacking or cybersquatting.
attacker will register a domain name that is similar to a popular website but contain some kind of common typographical errors
Frauds and Scams
Deceptive practices to deceive people into parting with money or valuable
information
Consequences of Impersonation
○ Unauthorized access
○ Disruption of services
○ Complete system takeover
Four main forms of impersonation used by attackers
- Brand Impersonation
- Typosquatting
- Watering Hole Attacks
- Impersonation : assumes the identity of another person to gain
unauthorized access
To protect against brand impersonation
Educate their users
Use secure email gateways
Regularly monitor their brand’s online presence
To combat typosquatting
○ Register common misspellings of their own domain names
○ Use services that monitor for similar domain registrations
○ Conduct user security awareness training to educate users about
the risks of typosquatting
To mitigate watering hole attacks, organizations should do the following
- Keep their systems and software updated
○ Use threat intelligence services to stay informed about new
threats
○ Employ advanced malware detection and prevention tools
Mitigation for Pretexting
training the employees not to fall for pretext and not to fill in the
gaps for people when they are calling
Spear Phishing
More targeted form of phishing,
more tightly focused on a specific group of individuals or organizations
Whaling
Form of spear phishing that targets high-profile individuals, like CEOs or
CFOs
Fraud
Wrongful or criminal deception that is intended to result in financial or personal
gain for the attacker
■ One of the most common types of fraud that you will see online is known as
Identity Fraud and Identity Theft
○ Involves the use of another person’s personal information without their authorization to commit a crime or to deceive or defraud
that other person or some other third party
Difference between identity fraud and identity theft
In identity fraud, the attacker takes the victim’s credit card
number and charges items to the card
○ In identity theft, the attacker tries to fully assume the identity of
their victim
Scams
Fraudulent or deceptive act or operation
Most common scam is called the invoice scam
● Invoice Scam
○ In which a person is tricked into paying for a fake invoice for a
product or service that they did not actually order
Influence Campaigns
affect public perception or behavior towards a particular
cause, individual, or group
■ Are a powerful tool for shaping public opinion and behavior
■ Foster misinformation and disinformation
■ Diversion Theft
Involves manipulating a situation or creating a distraction to steal
valuable items or information
Hoaxes
● Malicious deception that is often spread through social media, email, or
other communication channels
● Often paired with phishing attacks and impersonation attacks
● To prevent hoaxes people must fact check and use good critical thinking
skills
Shoulder Surfing
● Involves looking over someone’s shoulder to gather personal information
● Includes the use of high powered cameras or closed-circuit television
cameras to steal information from a distance
● To prevent shoulder surfing, users must be aware of their surroundings
when providing any sensitive information
Dumpster Diving
Involves searching through trash to find valuable information
● Commonly used to find discarded documents containing personal or
corporate information
Eavesdropping
● Involves the process of secretly listening to private conversations
Baiting
Attacker might leave a malware-infected USB drive in a location where their target might find it.
