Section 5.45 Other Social Engineering Attacks

Question 1

8 other common Social Engineering Attacks

Other Social Engineering Attacks

Answer 1

1. Diversion Theft
2. Hoaxes
3. Shoulder Surfing
4. Dumpster Diving
5. Eavesdropping
6. Baiting
7. Piggybacking
8. Tailgating

Question 2

Diversion Theft

Answer 2

Involves manipulating a situation or creating a distraction to steal valuable items or information

e.g DNS spoofing attack - when user types in legimiate URL they are redirected to another URL

Question 3

Hoaxes

Answer 3

Malicious deception that is often spread through social media, email, or other communication channels

Often paired with phishing attacks and impersonation attacks

To prevent hoaxes people must fact check and use good critical thinking skills

Question 4

Shoulder Surfing

Answer 4

Involves looking over someone’s shoulder to gather personal information

Includes the use of high powered cameras or closed-circuit television cameras to steal information from a distance

To prevent shoulder surfing, users must be aware of their surroundings when providing any sensitive information

Question 5

Dumpster Diving

Answer 5

Involves searching through trash to find valuable information

Commonly used to find discarded documents containing personal or corporate information

Use clean desk and clean desktop policies

Virrtual dumpster diving involves searching through deleted files

Question 6

Eavesdropping

Answer 6

Involves the process of secretly listening to private conversations

Perpetrator intercepts the communication of parties without their knowledge

Prevent this by encrypting data in transit

Question 7

Baiting

Answer 7

Involves leaving a malware-infected physical device, like a USB drive, in a place where it will be found by a victim, who will then hopefully use the device to unknowingly install malware on their organization’s computer system

To prevent baiting, train users to not use devices they find

Question 8

Piggybacking

Answer 8

Involves an attacker convincing an authorised employee to let
them into the facility by getting the authorized employee to swipe their own access badge and allow the attacker inside the facility

Question 9

Tailgating

Answer 9

Attacker attempts to follow an employee through an access
control vestibule or access control point without their knowledge