Social Engineering Techniques Flashcards
Phishing
social engineering technique where attacker tricks user into responding to something (ex. email) to instance a malware-based attack
Smishing
phishing via text message
Vishing
phishing via phone calls
Spam
unwanted and unsolicited digital mail sent out in bulk
Spim
spam over instant messaging
Spear Phishing
targeted phishing
Dumpster Diving
act of going through the garbage at an organization in order to find sensitive information that could possibly compromise a network and its resources
Shoulder Surfing
act of looking over a persons shoulder to gather sensitive information from an individuals device/desk (can include looking through windows w/ binoculars)
Pharming
the use of malicious code to direct victims to spoofed websites in an attempt to steal their credentials and data
Tailgating
following closely behind someone to gain unauthorized access to a physical building or location
Eliciting Information
the act of casual conversation to extract information from a victim w/out giving the impression that they are being interrogated
Whaling
targeting a higher up w/ a phishing attack (ex. CEO)
Prepending
?
Identity Fraud
the act of stealing someones identity and pretending to be them
Invoice Scams
scams over the phone that attempt to gain sensitive/personal information
Credential Harvesting
act of stealing or obtaining a persons login information (credentials) to attack a system
Reconnaissance
act of gathering information about an intended victim/target to prepare for an attack
Hoax
faking an event or alert in order to obtain information from a target victim
Impersonation
pretending to be someone else in order to obtain sensitive/personal information from someone
Watering Hole Attack
infecting a website w/ malware that users usually trust and use (specifically, one an organization may use)
Typosquatting (URL Hijacking)
act of using purposely misspelled domains (ones that are commonly misspelled) for malicious purposes (ex. gooogle.com or favebook.com)
Pretexting
?
Influence campaigns and the two types
large scale campaigns that attempt to shift public opinion (hybrid warfare and social media)
Hybrid warfare
influence campaign that…
Social media
influence campaign that…
Principles and the seven types
reasons for attack effectiveness. Authority, intimidation, consensus, scarcity, familiarity, trust, urgency.
Authority
(principle) pretending to be someone in power to pressure a response or action from a victim (ex. CEO)
Intimidation
(principle) threatening or blackmailing someone into giving up information
Consensus
(principle) when an attackers claims that an action is normal or generally accepted
Scarcity
(principle) focuses on the fact that people are more likely to find value in things that are less available
Familiarity
(principle) creating a sense of familiarity w/ a user to take advantage of them
Trust
(principle) creating a bond to gain the users trust in order to take advantage of them
Urgency
(principle) claiming that something is urgent and that the intended target needs to “act fast” to pressure them to perform an action
