1.1 Compare and contrast different types of social engineering

[CERTMaster]

SMiShing - a phishing technique that uses SMS text communications as the attack vector. May include a link to a fake website

asking a user to log in.

Spam - unsolicited messages, like email, are sent in bulk to users for advertisements or to deliver malware

SPIM - a spam (or mass unsolicited messages) but over instant messaging or Internet messaging services

Phising - a type of email-based social engineering attack. The attacker sends an email from a supposedly reputable source, such

as a bank, to try to elicit private information from the victim.

Spear phishing - refers to a phishing scam where the attacker has some information that makes an individual target more likely

to be fooled by the attack. The attacker might know the details that help convince the target that the communication is genuine.

Vishing - A phising attack conducted through a voice channel (telephone or VoIP, for instance). Someone may attempt to

represent a bank and ask the target to verify information over the phone.

Hoax attack - an email alert or web pop-up will claim to have identified some sort of security problem, such as a virus infection,

and offer a tool to fix the problem. The tool, of course, will be some sort of Trojan application.

Typosquatting -

Scarcity and urgency - creating a false sense of urgency can disturb people's ordinary decision-making process. The social

engineer can try to pressure his or her target by demanding a quick response.

Consensus/Social Proof - an attacker fools users into believing that a malicious website is legitimate by posting fake reviews. The

victims believe the reviews and place their trust in the website.

Familiarity/liking - one of the basic tools of an attacker is to be likeable and to present the requests they make as completely

reasonable and unobjectionable.

Authority - Social engineers can try to intimidate their target by pretending to be someone else, such as someone of authority, or

superior rank or expertise.

Pharming -

Whaling - an attack directed specifically against upper levels of management

Trust - to be convincing (or to establish trust). Usually depends on the attacker obtaining privileged information. An impersonation

attack is more effective if the attacker knows the information about the employee.

Dumpster Diving -

Tailgating and Lunchtime Attacks - Tailgating is getting unauthorized access to a building by following someone. A lunchtime

attack refers to an attack on a user who leaves a workstation unattended while logged on.

Spyware- a program that monitors user activity and sends the information to someone else. This can occur with or without the user's

knowledge

Rogueware - a fake antivirus web pop-up that claims to have detected viruses on the computer and prompts the user to initiate a full

scan, which installs the attacker's Trojan.

[CLC website]

Social Engineering Attacks:

Hijacking and Related Attacks:

Driver Manipulation Attacks:

Module 1: Attacks, Threats, and Vulnerabilites