1.1 - Social Engineering

Question 1

Define Phishing.

Answer 1

A technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a web site, in which the perpetrator masquerades as a legitimate business or reputable person.

Question 2

Define Typosquatting.

Answer 2

A type of social engineering attack which targets internet users who incorrectly type a URL into their web browser rather than using a search engine.

Question 3

Define Pretexting.

Answer 3

When the social engineer comes up with a story before interacting. Attacker acts as a character in a situation that they create. Lying to get information.

Question 4

Define Prepending.

Answer 4

Adding a letter to the beginning of a URL or adding a trustworthy value to the beginning of an email like “RE:” or “MAILSAFE:PASSED”.

Question 5

Define Pharming.

Answer 5

Redirecting a legit website to a bogus site. This can be caused by a poisoned DNS server or client vulnerabilities being taken advantage of.

Question 6

Define Vishing.

Answer 6

Phishing that is done over the phone. Caller ID spoofing is common.

Question 7

Define Smishing.

Answer 7

Phishing that is done by SMS. Often forwards links or asks for personal information. Can spoof numbers to seem official.

Question 8

How might a social engineer prepare to Phish?

Answer 8

Reconnaissance:
Gathering information on the victim
Background information:
Lead generation sites
Social media
Corporate website
Attacker builds believable pretext
Where you work
Where you bank
Recent financial transactions
Family and friends

Question 9

Define Spear phishing.

Answer 9

Targeted phishing with inside information. Focusing on information tied to an individual.

Question 10

Define Whaling.

Answer 10

Targeted phishing with the possibility of a large catch. Often focuses on high-level executives or people whose position includes high-level information, credentials, or access to resources.

Question 11

Define Dumpster Diving.

Answer 11

The act of going through an individual or organization’s garbage in order to gather valuable information.

Question 12

Is dumpster diving legal in the U.S.?

Answer 12

Yes unless it is on private property behind a no trespassing sign.

Question 13

Give three ways that you can protect information that could be obtained while someone is dumpster diving.

Answer 13

1. Secure your garbage (i.e. fence and a lock)
2. Destroy vital documents (shred or burn)
3. Check what is in the trash

Question 14

Define Shoulder Surfing.

Answer 14

Trying to get vital information from someone’s screen by either standing over their shoulder or viewing it from afar.

Question 15

What are two ways to prevent data loss from shoulder surfing?

Answer 15

1. Control your input
2. Use privacy filters

Question 16

Define Hoax.

Answer 16

A threat that seems like it could be real, but it does not actually exist. Often consumes a lot of resources or may be an attempt to take money.

Question 17

What are 4 ways to prevent hoaxes from doing damage?

Answer 17

1. Believe no one
2. Cross reference with a reputable source
3. Spam filters
4. Make sure that it doesn’t sound too good to be true.

Question 18

Define Watering Hole Attack.

Answer 18

An attack that infects a third-party website that is frequented by certain organization(s) in an attempt to spread the infection from the third-party to the intended target.

Question 19

What are ways to protect against watering hole attacks?

Answer 19

1. Maintain a layered defense
2. Firewalls and IPS
3. Anti-virus/ Anti-malware signature updates

Question 20

What is SPIM?

Answer 20

Spam over Instant Messaging

Question 21

Define Spam.

Answer 21

Unsolicited messages in various mediums sent out to many people. Can be for advertising, proselytizing, and phishing attempts.

Question 22

What are ways to identify and defend against Spam?

Answer 22

1. Allowed list
   Only receive email from trusted senders
2. SMTP standards checking
   Block anything that doesn’t follow RFC standards
3. rDNS - Reverse DNS
   Block email where the sender’s domain doesn’t
   match the IP address
4. Tarpitting
   Intentionally slow down the server conversation
5. Recipient filtering
   Block all email not addressed to a valid recipient
   email address

Question 23

Define Influence Campaign.

Answer 23

An attempt to sway public opinion on political and social issues through social media and fake accounts. Can be directed by nation-state actors and be a part of hybrid warfare (cyberwarfare).

Question 24

Define Tailgating.

Answer 24

Using an authorized person to gain unauthorized access to a building. The attacker may: follow a regular employee in especially if the door is held open for them, hang out in the smoking area, bring food, act like a third party vendor, or blend in with clothing.

Question 25

What are 4 ways to prevent tailgating?

Answer 25

1. Have a policy for visitors
2. One scan per person
3. Access control vestibule / airlock (mantrap)
4. Security conscious campus (have people ask
   strangers for identification.

Question 26

Define Social Engineering.

Answer 26

Using some form of manipulation to trick employees, end users, etc. into giving up vital information (credentials, accounts, etc.). It can involve many people or organizations. Can be in person or electronically.

Question 27

Give 7 ways that social engineers trick people.

Answer 27

1. Authority
   Act as if they are in authority over you
2. Intimidation
   There will be bad things if you don’t help
3. Consensus / Social proof
   Convince based on what’s normally expected
4. Scarcity
   The situation will not be this way for long
5. Urgency
   Act quickly, don’t think
6. Familiarity / Liking
   Someone you know
7. Trust
   Someone who is safe (can be IT)