Human Element Security Flashcards
Social engineering and types of attacks
HUMINT
Information that can be gathered by talking to people.
OSINT
Information collected from publicly available sources such as job posting, and public records.
Some sources of OSINT are resume and job posting, social media, public records, Google hacking, metadata.
Metadata
Data about data that can be found in every file like the timestamps or locations, etc.
Geospatial Intelligence(GEOINT)
Geographical information typically from satellites.
Measurement & Signature Intelligence(MASINT)
Measurement and signature data from sensors, such as optical and weather readers.
Signal Intelligence(SIGINT)
Data gathered by intercepting signals between people and systems.
Technical Intelligence (TECHINT)
Intelligence about equipment, technology, and weapons often for the purpose of developing countermeasures.
Financial Intelligence (FININT)
Data about financial dealings and transactions of companies and individuals.
Cyber Intelligence/Digital Network Intelligence (CYBINT/DNINT)
Information gathered from computer systems and networks.
Social Engineering
Manipulate people to gain information or access to facilities by gaining their trust or pretending to be someone they are not.
Pretexting
attacker use information they collected to pretend and act as if they are a manager, customer, reporter, co-worker’s family member, or other trusted person. They create a believable scenario that convince their targets to give up sensitive information or perform actions that usually they don’t for strangers.
Phishing
a social engineering technique in which an attacker uses electronic communications such as email, texting, or phone calls to collect the target’s personal information or install malware on their system often by convincing the target to click a malicious link.
Spear Phishing
To achieve a higher rate of success, attackers may turn to spear phishing which is targeted attacks against specific companies, organizations, or people. In spear phishing the attacker should plan everything strategically and should observe the target so the message appears to come from someone the target would trust such as human resources staff, a manager, the corporate IT support team, a peer or a friend.
Tailgaiting/Piggybacking
is following someone through an access control point such as secure door, instead of using the credentials, badge, or key normally needed to enter.
Cunning and flattery
Impersonating
masquerading as someone else such as a repair technician
Dumpster Diving
Searching through trash to gain information from discarded documents.Literally trash to find documents and devices!
Spam emails
unsolicited emails, commonly advertising emails, but sometimes phishing and scamming attempts.
Email Spoofing
is the forgery of an email header so that the email seems to be sent from a legitimate source.
Email pharming
a user will open an email with malware, which then installs malicious code on the user’s PC. Another way is that the malicious code changes the local hosts file on a personal computer and the code redirects any URL clicks to a fraudulent website without knowledge or consent. The website might look like a familiar website like your bank website and when you enter your username and password, they steal the information. It is pharming data.
Protocol spoofing
misuse of a network protocol to initiate an attack on a host or network device
ARP spoofing
Address Resolution Protocol(ARP) helps computers on a network figure out the MAC address of another computer based on its IP address. ARP poisoning modifies the network’s ARP cache to take over a victim’s MAC address. This allows attacker to receive any data intended for the victim.
DNS Spoofing
Domain Name Service(DNS) translates domain names into IP addresses. In DNS spoofing, the attacker alters the DNS records to redirect traffic to a fraudulent website, where further attacks can occur.
IP Address Spoofing
is an attack where a malicious user forges a packet’s source IP address and by doing so it impersonates the sending computer.
Denial of Service Attack
when an attacker floods a server or other network device to make it unavailable. The server will be overwhelmed so it cannot respond to requests.
Distributed Denial of Service Attack
It is DoS attack that is lunched from a large number of malicious machines.
Common types of DoS and DDoS attacks are:
○ Buffer overflows: Sending the server more data than expected.
○ SYN Attack: Exploits the TCP three-way handshake.
Ping of Death: Exploits the ICMP “ping” protocol.
Back door attack
When someone creates an alternative way into a system that bypasses its security controls
Replay Attack
Similar to a man-in-the-middle, but with a replay attack. The attacker will capture a message sent from a network device to the server. Later, the attacker will send the original, unmodified message to the server, hoping the server would respond thinking the attacker is a valid device. If it does, the attacker created a “trusted” relationship with the server.
Weak Encryption Key
Occurs when enough network traffic is captured to allow the key to be broken. Example: WEP encryption.
Software Vulnerability Attack
he exploitation of known software vulnerabilities/bugs for malicious purposes.
Remote Code Execution Attack
When web applications are improperly coded, attackers can run system-lelvel code for malicious purposes.
SQL Injection Attack
attacker manipulates input forms to pass unauthorized SQL to the SQL server database. This allows attacker to drop tables, obtain data, and delete information.
Cross-Site Scripting Attack (XSS Attack)
attacker embeds HTML or JavaScript malicious code into a website code. The code executes when a user visits website. Attacker can obtain sensitive data, session cookies and more.
