Social Engineering Flashcards
What is Phishing
Persuades or tricks target into interacting with a malicious resource. traditionally over Email. Combines social engineering and spoofing.
What is Smishing
A standard scam sent via text (SMS). Used to trick target into giving valuable info.
What is Vishing
Over the phone Phishing. Scam to extract info or convince target to interact with malicious resource.
What is Spam
Unsolicited Email both malicious and mundane
What is SPIM (Spam over internet messaging)
Unsolicited messaging through internet messaging{ catch all for not email but sent over the internet}
What is Spear Phishing
Focused Phishing usually including information to add credibility. Tailored to address a specific target.
What is Dumpster Diving
Combing through garbage for files/removable media.
What is Shoulder Surfing
Observing the input of a password or information. not just physically looking over the shoulder cameras are fair game. Recorded video counts.
What is Pharming
Corrupts name resolution process in order to reroute users of legitimate websites to malicious websites passively.
What is Tailgating
Entering an area unauthorized via following closely behind someone without their knowledge or consent of malicious goals. Still count if they hold the door open but were tricked into doing so.
What is Eliciting Information
The discrete gathering of information. For example a conversation in which tricks the other party into giving useful information.
What is Whaling
Spear Phishing but aimed at somebody big like a CEO.
A focused scam using information to create legitimacy.
What is Prepending
Adds text to Hoax of Spam that looks the the email system produced to create legitimacy
What is Identity Fraud
Used specific details of someone’s identity to impersonate them. Also compromised accounts.
What is Invoice Scams
Spoofs invoice details but changes changes bank account number. You fake being the collector of a bill.
What is Credential Harvesting
Campaign specifically designed to steal account credentials on mass typically but can be small scale. Threat actor might just sell instead hacking further.
What is Reconnaissance
Reconnaissance is the practice of covertly discovering and collecting information about a system.
What is Hoax
Fake security alerts/chain Emails. introduces a potential threat and offer fake solution.
What is Impersonation
Pretending to be someone else.
What is Watering Hole attack
A passive hack wherein the threat actor creates a fake something people want to use to enact malicious intentions. Example making a fake app for local pizza place that acts as a trojan.
What is Typo Squatting
You register a domain that is spelled extremely similar to something legitimate and wait.
What is Pretexting
Is an attack in which the attacker creates a scenario to try and convince the victim to give up valuable information, such as a password.
What is Influence campaign
An attack or series of attacks launched by a group. Specifically to influence public opinion.
What is Hybrid warfare
An influence campaign deployed along with espionage, disinformation/fake news, and hacking.
What is Social media
websites and applications that enable users to create and share content or to participate in social networking.
What is Social Engineering Principles (reasons for effectiveness)
Familiarity/Liking// Be Affable able to make people like you
Consensus/Social Proof// Using polite behavior/ societal constraints to your advantage.
Authority and Intimidation// Using feigned authority or peoples bias against being wrong.
Scarcity and Urgency// creating demand or urgency to trick targets.
What is Social Engineering Principle Authority
People hesitate to enter conflict with perceived superiors
What is Social Engineering Principle Intimidation
Overloading the person with jargon/ making them feel stupid/ threats of repercussions
What is Social Engineering Principle Consensus
A social engineering attack can use this instinct either to persuade the target that to refuse a request would be odd or to exploit polite behavior.
What is Social Engineering Principle Scarcity
Convincing the target that they will miss out.
What is Social Engineering Principle Familiarity
Getting chummy with the target
What is Social Engineering Principle Trust
What is Social Engineering Principle Urgency
Convincing the target of urgency requiring immediate action
