4A Compare and Contrast Social Engineering Techniques Flashcards
Describe the Familiarity/Liking principal
The ability to be affable and likable and to be able to persuade other people to do something for you
Describe the Consensus/Social Proof Principle
Refers to the fact that without an explicit instruction to behave in a certain way, many people will act just as they think others would act
Describe the Authority and Intimidation
Impersonating someone of higher authority
Describe the Scarcity and Urgency Principle
Using a sense of emergency to get someone to do something
What is impersonation?
simply means pretending to be someone else. It is one of the basic social engineering techniques. Impersonation can use either a consensus/liking or intimidating approach. Impersonation is possible where the target cannot verify the attacker’s identity easily, such as over the phone or via an email message.
What is dumpster diving?
refers to combing through an organization’s (or individual’s) garbage to try to find useful documents (or even files stored on discarded removable media).
What is Tailgating?
a means of entering a secure area without authorization by following close behind the person that has been allowed to open the door or checkpoint
What is piggy backing?
A similar situation, but means that the attacker enters a secure area with an employee’s permission, For instance, an attacker might impersonate a member of the cleaning crew and request that an employee hold the door open while they bring in a cleaning cart or mop bucket.
What is Identity fraud?
a specific type of impersonation where the attacker uses specific details of someone’s identity
What is shoulder serving?
When a threat actor obtains info by watching someone input passwords or pins on a computer
What is a Lunchtime attack?
a user leaves a workstation unattended while logged on, an attacker can physically gain access to the system
What is Phishing?
a combination of social engineering and spoofing. It persuades or tricks the target into interacting with a malicious resource disguised as a trusted one, traditionally using email as the vector
What is spear phishing?
a phishing scam where the attacker has some information that makes an individual target more likely to be fooled by the attack. Each phishing message is tailored to address a specific target user
What is whaling?
a spear phishing attack directed specifically against upper levels of management in the organization (CEOs and other “big fish”). Upper management may also be more vulnerable to ordinary phishing attacks because of their reluctance to learn basic security procedures
What is Vishing?
a phishing attack conducted through a voice channel (telephone or VoIP, for instance). For example, targets could be called by someone purporting to represent their bank asking them to verify a recent credit card transaction and requesting their security details.
