Social Engineering Techniques Flashcards
What is Phishing?
Hacker getting user to provide their secure information (usually through fake email links)
What is Smishing?
Type of Phishing that uses SMS messages
What is Vishing?
Type as Phishing but uses VOICE / VOIP
What is Spear Phishing?
Type of phishing where the hacker attacks a specific person/ user
What is Whaling?
Type of spear phishing where the hacker goes against a the highest possible target (CEO, CIO, CFO, ect….) to get more sensitive data
How do you fight Phishing?
primarily done through user training to identify fake emails and URLs and not to provide any sensitive data
What is web ripper?
Software that allows user to download entire websites, usually used by hackers to create phishing websites
What is Shoulder Surfing and how do you fight it?
Hacker looking over a users shoulder to steal data. You fight it by user training and providing ways to limit viewing angles (privacy screens)
What is dumpster Diving and how do you fight it?
Hackers going through an organizations trash to find sensitive information. You fight it by either the shredding or preferably burning documents.
What is the main concept of social engeenering?
To gather data directly from users
What different techniques do social engeers employ use to get data out of users
Authority, Intimidation, Consensus, Scarcity, Familiarity, Trust, and Urgency
What is Authority relating to Social Engineering?
When a hacker tries to get information out of user by trying to get users to think they have the Authority to get it (EX. Someone pretending to be in IT, HR, or Accounting).
What is Intimidation relating to Social Engineering?
When a hacker scares users into giving them data
What is Consensus relating to Social Engineering?
When a hacker tries to convince users to give data by using herd mentality
What is Scarcity relating to Social Engineering?
When a hacker tries to convince users to give data by saying something is scarce or in limited supply
What is Familiarity relating to Social Engineering?
When a hacker tries to convince users to give data by becoming familiar or “friends” with a user
What is Trust relating to Social Engineering?
When a hacker builds trust with a user to gather data
What is Urgency relating to Social Engineering
When a hacker tries to gather data by creating and or claiming an urgency situations.
What is Pharming?
When a hacker redirects web traffic by manipulating DNS server or DNS Cache (Host File)
Where is the Location of the Host File?
C:\Windows\System32\Drivers\etc\hosts
How do you protect your organization from Pharming?
Fight by securing DNS Server/ Settings and using Anti Malware
What is Spam?
unsolicited messages/ emails`
How do you fight spam?
fight by only giving your email/ phone number to only repeatable people/ organizations, Use software spam filters such as Barracuda
What is SPIM?
Spam that comes over Instant Messenger
What percentage of emails is classified as Spam
48% of all email traffic is classified as spam
What is Tailgating?
Unauthorized Person/user who follows Authenticated users into secure locations
What is Piggy Backing
User holding door for Unauthorized users
How do you fight Tailgating/ Piggy backing?
Fight by using Man Traps (Double Door System) and User Training, Some regulations make Man Traps Mandatory
What is prepending social engineer attack?
Attacker prepends information to a URL to go to a phishing website. Usually through email links.
What is is Identity fraud?
Attacker steals your identity and pretends to be you and uses your identity
How do you fight identity theft?
Fight by monitoring credit score, and not giving out personal information
What is an invoice Scam?
When attackers send fake invoices to companies trying to collect
How do you fight invoice scams?
Keeping track of bills and vendors
What is Credential Harvesting?
Large scale phishing for passwords
What is Reconasince
when an attacker researches a company (usually for spear phishing)
What is a Hoax engineer attack?
When an attacker wants you to believe something is happening that is not (fraud)
What is Impersonation
When an attacker pretends to be someone within the company. Usually coincides with Reconnaissance
What is a watering hole attack?
Attacker will injects code in websites or applications that your company/ organization uses.
How do you fight Watering Hole Attacks?
User training to identify legit sites
What is Typo Squatting Attacks?
It is when an attacker registers domain names with similar names as other sites (IE gooogle.com, Yaho.com)
How do you protect customers from possible squatting attacks?
you can fight my registering domain names similar to your company domain
What is Pretexting?
When attackers use lying to accomplish a social engineer attack
What is an influence campaign?
influence a group of people, usually done through social media
What is Hybrid Warfare?
it is an influence campaign that is used in Warfare.
