Social Engineering Flashcards
(18 cards)
What are the 2 possible goals in Social Engineering?
Psychologically manipulate people into doing something/releasing info, Gather info left by people
What 2 reasons allow Social Engineering to work?
People are vulnerable to manipulation, People can’t easily be patched
What are the 6 stages in an SE attack? 1)🥊2) 🛜 3) 📖 4) 💏5) 😈6) 💼
1) Attack Formulation 2) Information Gathering 3) Preparation 4) Develop Relationship 5) Exploit Relationship 6) Debrief (maintain and ease out of relationship as to not cause suspicion)
What are the 2 types of Commication in Social Engineering attacks?
Direct Communication (attacker to victim), Indirect Communication (attacker uses third party website to talk to victims)
What is meant by Bidirectional communication?
Direct Communication between attacker and victim, both speak
What is meant by Unidirectional communication?
Direct Communication between attacker and victim, attacker doesn’t expect victim reply. e.g. email directly to victim, but victim wouldn’t respond to email
What are the 6 Compliance Principles?
Friendship or Liking, Commitment or Consistency, Scarcity. Reciprocity, Social Validation, Authority
What is Pretexting?
Creating a fake scenario to convince you (e.g. “You booked this flight, call us for a refund”)
What is meant by Compliance Principles “Commitment or Consistency”?
Ask little bit of info from victim, over time will divulge more as they are committed
What is meant by Compliance Principles “Scarcity”?
Scarcity in resources or time, make them feel rushed
What is meant by Compliance Principles “Social Validation”?
This brand new app everyone has, don’t miss out! Download
What are the 6 entities in an SE attack? (the circle diagram)
1) Social Engineer (attacker) 2) Target 3) Goal 4) Medium 5) Technique 6) Compliance Principles
What are 4 Social Engineering techniques?
1) Info Gathering, Interaction with Target, Tailgating, Baiting
What are 3 ways of Info Gathering technique?
Dumpster Dive, Shoulder Surf, Search Internet
What are 3 ways of Interaction with Target technique?
Phishing, Spear Phishing, Visihing, Physical Impersonation
What is Spear Phishing?
Phishing specifically tailored to a particular victim
What is Baiting?
Bait with curiosity, e.g. infected USB
What is Tailgating?
Walk into building behind someone
