Compare and contrast different types of social engineering techniques. Flashcards
SOCIAL ENGINEERING
an attempt by an attacker to convince someone to provide info (like a password) or
perform an action they wouldn’t normally perform (such as clicking on a malicious link)
Social engineers often try to gain access to the IT infrastructure or the physical facility
PHISHING
commonly used to try to trick users into giving up personal information (such as user
accounts and passwords), click a malicious link, or open a malicious attachmen
SPEAR PHISIHING
Targets specific groups of users
WHALING
targets high-level executives
VISHING
voice phishing (phone based)
SMISHING
uses sms(text) messaging on mobile
SPAM
Unsolicited email, generally
considered an irritant
SPIM
SPAM over instant messaging, also
generally considered an irritant
DUMPSTER DIVING
Gathering important details (intelligence) from
things that people have thrown out in their TRASH.
TAILGATING
when an unauthorized individual might
follow you in through that open door
without badging in themselves.
ELICITING INFORMATION
strategic use of casual conversation
to extract information without the
arousing suspicion of the target
SHOULDER SURFING
a criminal practice where thieves
steal your personal data by spying
over your shoulder
PHARMING
an online scam similar to phishing, where
a website’s traffic is manipulated, and
confidential information is stolen.
IDENTITY FRAUD
use of another person’s personal information,
without authorization, to commit a crime or to
deceive or defraud that person or other 3rd party
PRENPENDING
Prepending is adding words or phrases like “SAFE”
to a malicious file or suggesting topics via social
engineering to uncover information of interest.
INVOICE SCAMS
fake invoices with a goal of receiving money or
by prompting a victim to put their credentials
into a fake login screen
CREDENTIAL HARVESTING
attackers trying to gain access to your
usernames and passwords that might be
stored on your local computer
HOAXES
Intentional falsehoods coming in a variety of forms ranging from virus
hoaxes to FAKE NEWS. Social media plays a prominent role in hoaxes today
WATERING HOLE ATTACK
Attack strategy in which an attacker guesses or observes which websites an
organization often uses and infects one or more of them with malware
TYPOSQUATTING
a form of cybersquatting (sitting on
sites under someone else’s brand or
copyright) targeting users who type
an INCORRECT WEBSITE ADDRESS
PRETEXTING
an attacker tries to convince a victim to give up
information of value, or access to a service or system. LYING
HYBRID WARFARE
Attack using a mixture of conventional and unconventional
methods and resources to carry out the campaign
INFLUCENCE CAMPAIGNS
A social engineering attack intended to manipulate
the thoughts and minds of large groups of people
PRINCIPLES OF SOCAIL ENGINEERING
Authority - position
Intimidation - negative outcomes
Consensus - peer
Scarcity - quantity
Familiarity -liking
Trust - knowledge and experience
Urgency - Time sensitiv
Urgency
