Social Engineering Flashcards
Phishing
type of cyber attack in which malicious actors attempt to deceive individuals or organizations into divulging sensitive information, such as login credentials, personal information, or financial details.
Smishing
form of cyberattack and social engineering technique that involves sending fraudulent or malicious text messages (SMS) to individuals with the aim of tricking them into revealing sensitive information, downloading malware, or taking some harmful action.
Vishing
type of social engineering attack that involves using voice communication, typically phone calls, to deceive individuals or organizations into revealing sensitive information, such as personal information, financial data, or login credentials.
Spam
refers to the mass distribution of unsolicited and often irrelevant or inappropriate messages, primarily through electronic communication channels like email, text messages, and social media.
Spam over instant messaging (SPIM)
form of unsolicited and often intrusive messaging that occurs through instant messaging (IM) platforms.
Spear Phishing
targeted form of phishing attack that involves cybercriminals sending highly customized and deceptive emails or messages to a specific individual or a select group of individuals.
Dumpster diving
physical form of information gathering and social engineering that involves searching through discarded materials, such as trash bins, dumpsters, or recycling containers, to obtain valuable information.
Shoulder surfing
form of social engineering and information theft that involves an attacker surreptitiously observing or “surfing” over the shoulder of a person to glean sensitive or confidential information.
Pharming
cyber attack that involves redirecting the traffic of a legitimate website to a fraudulent or malicious website, usually without the victim’s knowledge.
Tailgating
social engineering technique where an unauthorized individual gains physical access to a secured area by closely following an authorized person as they enter a restricted space.
Eliciting information
social engineering technique used to obtain sensitive or valuable information from individuals, often through manipulation and persuasion.
Whaling
specific type of phishing attack that targets high-profile individuals within organizations, such as top executives, senior managers, or individuals with access to sensitive information.
Prepending
refers to a technique used by attackers to manipulate or deceive security systems, particularly those that rely on lists, databases, or filtering rules.
Identity fraud
type of crime in which an individual’s personal information is stolen and used for fraudulent purposes.
Invoice scams
type of financial scam in which fraudsters manipulate invoices or payment requests to deceive individuals or organizations into making fraudulent payments.
Credential harvesting
cyber attack technique where malicious actors attempt to steal usernames and passwords from individuals or organizations.
Reconnaissance
refers to the initial phase of an attack where malicious actors gather information about a target, such as an individual, organization, or system.
Hoax
deceptive or misleading scheme or fabrication designed to trick individuals or the public into believing something false or fictitious.
Impersonation
social engineering technique where an attacker pretends to be someone else or a trusted entity to deceive individuals or organizations.
Watering hole attack
sophisticated cyber attack that targets a specific group of individuals or organizations by compromising websites they frequently visit.
Typosquatting
also known as URL hijacking or domain mimicry, is a cyber attack technique where malicious actors register domain names that are similar to popular, legitimate websites but contain slight typographical errors or variations.
Pretexting
social engineering technique in which an attacker fabricates a scenario or pretext to manipulate individuals into revealing sensitive information or performing specific actions.
Influence campaigns
especially in the context of hybrid warfare and social media, involve coordinated efforts to shape public opinion, sow discord, or achieve strategic objectives through the use of information, disinformation, and psychological manipulation.
Principles
These principles explain the reasons why certain social engineering techniques are effective in persuading individuals to comply with requests or take specific actions.
What are these principles?
- Authority
- Intimidation
- Consensus
- Scarcity
- Familiarity
- Trust
- Urgency
