Chapter 4 - Social Engineering and Password Attacks

Question 1

Social Engineering

Answer 1

Social engineering is the practice of manipulating people through a variety of strategies to accomplish desired actions.

Question 2

What are some of the most common principles that are leveraged to successfully social engineer an individual?

Answer 2

1. Authority: Most people will obey someone who appears to be in charge or knowledgeable (manager, government official, etc.)
2. Intimidation: Scaring or bullying an individual into taking a desired action (threatening that one will lose their job).
3. Consensus-based/Social Proof: Lying and saying that everyone else in a department had already taken an action.
4. Scarcity: Make something look more desirable by making it seem like the last one available.
5. Familiarity: These attacks rely on the target liking the individual or organization that the attacker is claiming to represent.
6. Urgency: Creating a feeling that the action must be taken quickly.

Question 3

Phishing

Answer 3

Phishing involves sending fraudulent communications that appear to come from a legitimate source.

Question 4

Whaling

Answer 4

Whaling is phishing that is targeted at senior employees (CEOs, CFOs, etc.).

Question 5

Vishing

Answer 5

Vishing is phishing accomplished via voice or voicemail messages. Common Vishing scams include requests to help a relative or friend in another country, various tax scams, threats of law enforcement action and requests for a staff member to perform a task for a senior executive.

Question 6

Smishing

Answer 6

Smishing relies on text messages as part of the phishing scam. Smishing scams frequently attempt to get users to click on a link in a text message.

Question 7

Misinformation

Answer 7

Misinformation is incorrect information, often resulting from getting facts wrong.

Question 8

Disinformation

Answer 8

Disinformation is incorrect, inaccurate, or outright false information that is intentionally provided to serve an individual or organization’s goals.

Question 9

Impersonation

Answer 9

Impersonation is pretending to be someone else (either a specific person or simply a member of some organization).

Question 10

Business Email Compromise

Answer 10

Business Email Compromise relies on using apparently legitimate email addresses to conduct scams and other attacks. Some common methods for creating emails that appear legitimate include:

1. Using compromised accounts
2. Sending spoofed emails
3. Using common fake but similar domain techniques
4. Using malware or other tools

Question 11

Pretexting

Answer 11

Pretexting is the process of using a made-up scenario to justify why you are approaching an individual. This can often be defeated by asking the attacker questions or requiring verification.

Question 12

Watering Hole Attacks

Answer 12

Watering Hole Attacks use websites that targets frequent to attack them. Attackers compromise the frequently visited site and use the site to deploy malware to end-user machines.

Question 13

Brand Impersonation

Answer 13

Brand Impersonation attacks use emails that are intended to appear to be from a legitimate brand, relying on name recognition or even using email templates used by the brand itself.

Question 14

Typosquatting

Answer 14

Typosquatting attacks use misspelled and slightly off but similar to the legitimate site URLs to conduct Typosquatting attacks. These attacks rely on the fact that some people will mistype URLs and end up on their sites.

Question 15

Pharming

Answer 15

Pharming, similar to typosquatting, relies either on changing a system’s hosts file or on malware that will change the system’s DNS servers.

Question 16

Brute-force attacks

Answer 16

Brute-force attacks iterate through passwords until they find one that works. These attacks can vary in sophistication, making use of common passwords or password complexity rules.

Question 17

Password Spraying attacks

Answer 17

Password spraying attacks are a form of brute-force attack that attempts to use a single password or small set of passwords against many accounts.

Question 18

Dictionary attacks

Answer 18

Another form of brute-force attack, dictionary attacks use a list of words for their password attempts.

Question 19

Rainbow tables

Answer 19

Rainbow tables are an easily searchable database of precomputed hashes using the same hashing methodology as the captured password file.