1.1 Compare and contrast different types of social engineering techniques Flashcards
Phising
the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.
Smishing
the fraudulent practice of sending text messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords or credit card numbers.
Vishing
the fraudulent practice of making phone calls or leaving voice messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as bank details and credit card numbers.
Spam
This is unsolicited emails we get. These emails are getting us or wanting us to click some links to buy something
Spam over instant messaging (SPIM)
This is unsolicited instant messaging. This is when you pop open your IM and suddenly you’re getting messages all over the place.
Spear Phishing
the fraudulent practice of sending emails ostensibly from a known or trusted sender in order to induce targeted individuals to reveal confidential information.
Dumpster diving
Dumpster diving is the process of searching trash to obtain useful information about a person/business that can later be used for the hacking purpose
Shoulder surfing
Shoulder surfing is a practice where thieves steal your personal data by spying over your shoulder as you use a computer, laptop, ATM, public kiosk or other electronic device.
Pharming
A cyberattack intended to redirect a website’s traffic to another, fake site by installing a malicious program on the computer. Can be conducted either by changing the hosts file on a victim’s computer or by exploitation of a vulnerability in DNS server software.
Tailgating
the passage of unauthorised personnel, either forced or accidental, behind that of an authorised user.
Eliciting Information
A technique used to discreetly gather information. The strategic use of casual conversation to extract information from people (targets) without giving them the feeling that they are being interrogated or pressed for the information.
Whaling
a highly targeted phishing attack - aimed at senior executives - masquerading as a legitimate email.
What is the difference between Spear Phising and Whaling?
whaling exclusively targets high-ranking individuals within an organization, while spear phishing usually goes after a category of individuals with a lower profile.
Prepending
adding code to the beginning of a presumably safe file. It activates when the file is opened.
Identity Fraud
A crime in which an imposter obtains key pieces of personally identifiable information (PII), such as Social Security or driver’s license numbers, to impersonate someone else.
Invoice Scam
These scams happen when adversaries trick individuals into transferring funds by acting as legitimate companies.
Credential Harvesting
the use of MITM attacks, DNS poisoning, phishing, and other vectors to amass large numbers of credentials (username / password combinations) for reuse.
Reconnaissance
The practice of covertly discovering and collecting information about a company, network, or system.
Hoax
A threat that doesn’t actually exist, But they seem like they COULD be real. Often an email, but can be a Facebook wall post, or tweet, or…
Will attempt take your money, but not necessarily through electronic means.
Impersonation
A form of fraud in which attackers pose as a known or trusted person to dupe an employee into transferring money to a fraudulent account, sharing sensitive information (such as intellectual property, financial data or payroll information), or revealing login credentials that attackers can used to hack into a company’s computer network.
Watering Hole Attack
A security exploit where the attacker infects websites that are frequently visited by members of the group being attacked, with a goal of infecting a computer used by one of the targeted group when they visit the infected website.
Typosquatting
A type of attack which targets internet users who incorrectly type a URL into their web browser rather than using a search engine. Typically, it involves tricking users into visiting malicious websites with URLs that are common misspellings of legitimate websites.
Pretexting
A type of social engineering attack that involves a situation created by an attacker in order to lure a victim into a vulnerable situation and to trick them into giving private information, specifically information that the victim would typically not give. Has been described as the first stage of social engineering, and has been used by the FBI to aid in investigations. A specific example of is reverse social engineering, in which the attacker tricks the victim into contacting the attacker first
What are the two methods of influence campaigns?
Social media and Hybrid warfare
