Chapter 1 Flashcards
Social Engineering
attack against a user
Best defense against Social Engineering?
user awareness & education
Phishing
most common by pretending to be a trusted entity like email or instant message to gain sensitive information from user.
Tailgating
piggybacking
Dumpster Diving
looking for discarded information and equipment to gain information.
Shoulder Surfing
looking over someone’s shoulder to gain info. Ex. In a crowded area peering over shoulder
Smishing
SMS message designed to trick victim to a link.
Vishing
fake caller ID to get account details over phone.
SPIM
Spam sent over Instant messaging.
Whaling
phishing attempts on high level targets like CEO.
Spear phishing
targeting a specific person.
Watering Hole Attacks
attacking a site target frequently visits.
Typo Squatting
URL Hijacking. using typo errors to direct to malicious site.
Prepending
supplying info that one will act on in attempt to legitimize request.
Hoax
presenting a threat that doesn’t exist causing an action that weakens security.
Credential Harvesting
phishing attempt causing one to click a link presenting a look-a-like page where the victim enters sensitive information.
Principles of Influence
> Authority-using symbols of authority makes one feel obligated to comply.
Intimidation- using this to make target fear getting into trouble or fired.
Consensus-use of trusted peers to elicit response “safety in numbers”.
Scarcity/Urgency- “FIrst 50 callers…” or taking immediate action will prevent severe consequences/.
Familiarity-getting victim to like them
Trust- gaining victims trust.
