Chapter 1.1 - Social Engineering

Question 1

Phishing

Answer 1

Social Engineering with a touch of spoofing
Usually by mail, text, etc.
Usually something wrong with the URL

Question 2

Smishing (SMS Phishing)

Answer 2

Done by text message
Forwards links or asks for personal information
Examples: fake check, phone code verification, boss/ CEO

Question 3

Vishing (Voice Phishing)

Answer 3

Done over the phone or voicemail
Caller ID spoofing is common
Examples: fake security checks or bank updates

Question 4

Spam

Answer 4

Unsolicited messages
Examples: emails or forums

Question 5

Mail Gateways

Answer 5

A filter that identifies spam and throws it away

Question 6

Spam Over Instant Messaging (SPIM)

Answer 6

Unsolicited messages over instant messaging

Question 7

Spear Phishing

Answer 7

Targeted phishing with inside information

Question 8

Whaling

Answer 8

Spear phishing/ targeting the higher ups of a company
Have a ton of information for a bigger catch

Question 9

Dumpster Diving

Answer 9

Physically going through a dumpster to find important details (for an attack) people/ companies have thrown out

Question 10

Shoulder Surfing

Answer 10

Physically peeking over someone’s shoulder to look at their screen to try and steal information

Question 11

Pharming

Answer 11

Redirecting a legit website to a bogus site
Harvest large group of people instead of just one person

Question 12

Tailgating

Answer 12

Use an authorized person to gain unauthorized access to a building

Question 13

Eliciting Information

Answer 13

Extracting information from the victim
Often used with vishing

Question 14

Prepending

Answer 14

Add onto the beginning of a fake URL
Example: “https://pprofessormesser.com”

Question 15

Prepending

Answer 15

Add onto the beginning of a fake URL
Example: “https://pprofessormesser.com”

Question 16

Invoice Scams

Answer 16

Sending a fake invoice to the person/ department paying the bills at a company and the attacker ends up with the payment details

Question 17

Credential Harvesting

Answer 17

Attackers collecting login credentials
Opening a document that runs a macro to start harvesting
Called password harvesting

Question 18

Reconnaissance

Answer 18

Gather information on the victim
Usually background information
Examples: social media, corporate website

Question 19

Hoax

Answer 19

A threat that doesn’t actually exist but seems like it COULD be real

Question 20

Impersonation

Answer 20

Attacker pretends to be someone they are not
Uses details from reconnaissance

Question 21

Watering Hole Attack

Answer 21

Strategy in which an attacker guesses or observes which websites an organization often uses and infects one or more of them with malware
Eventually, some member of the targeted group will become infected

Question 22

Typosquatting

Answer 22

A type of URL hijacking
Purposely misspelling an URL
Example: “https:professormessor.com”

Question 23

Pretexting

Answer 23

Lying to a victim to get information
Example: “Hi, we are calling from Visa regarding…”

Question 24

Influence Campaigns

Answer 24

Sway public opinion on political and social issues

Question 25

Influence Campaigns - Hybrid Warfare

Answer 25

A military strategy that can influence elections and fake news
Usually called cyberwarfare
Attack an entity with technology

Question 26

Influence Campaigns - Social Media

Answer 26

Amplifying fake content on social media used by millions of people

Question 27

Social Engineering Principles - Authority

Answer 27

The social engineer is in charge
Example: “I am calling from the off of the CEO…”

Question 28

Social Engineering Principles - Intimidation

Answer 28

Things will be bad if you do not do this
Example: “If you don’t help me…”

Question 29

Social Engineering Principles - Consensus/ Social Proof

Answer 29

Convince the victim based on what’s normally expected
Example: “Your co-worker, Jill, did this for me…”

Question 30

Social Engineering Principles - Scarcity

Answer 30

The situation will not be this way for long
Example: Must make the change before time expires

Question 31

Social Engineering Principles - Familiarity/ Liking

Answer 31

Someone you know, we have common friends

Question 32

Social Engineering Principles - Trust

Answer 32

Someone who is safe
Example: “I am from IT, I am here to help”

Question 33

Social Engineering Principles - Urgency

Answer 33

Paired with scarcity
Example: Act quickly, don’t think

Question 34

Social Engineering Principles

Answer 34

Common methods used to increase social engineering for attacks

Question 35

Defending Waterhole Attack

Answer 35

Defense in depth
Firewalls and IPS
Anti-virus/ anti-malware signature updates