The Art of Deception: Vocabulary and Key Concepts

This set covers essential vocabulary used by Kevin Mitnick to describe social engineering techniques, security vulnerabilities, and data classification policies.

Social Engineering

The use of influence and persuasion to deceive people by convincing them that the social engineer is someone he is not, or by manipulation, to obtain information with or without the use of technology.

Crackers

Hackers who maliciously destroy people's files or entire hard drives; also referred to as vandals.

Script Kiddies

Novice hackers who do not bother learning technology but simply download hacker tools to break into computer systems.

Phone Phreaking

A type of hacking that allows individuals to explore the telephone network by exploiting phone systems and phone company employees.

The Human Factor

Noted as security's weakest link, representing the vulnerability that exists when individuals are manipulated or deceived due to gullibility, naivete, or ignorance.

Human Firewall

The people and management elements of an organization that, when properly trained, act as a defense against social engineering attacks.

Mark

The designated victim of a con or social engineering scheme.

Burn the Source

When an attacker allows a victim to recognize that an attack has taken place, making it extremely difficult to exploit that same source in the future.

Mail Drop

A rental mailbox, often used under an assumed name, where a social engineer has documents or packages delivered after duping a victim.

Loop-around

A specific test number used by phone phreaks to find other phreaks to chat with or to create a untraceable call-back number.

Trojan Horse

A program containing malicious or harmful code designed to damage a computer or files, or to provide an infiltrator with covert remote access.

Remote Command Shell

A non-graphical interface that accepts text-based commands to perform functions or run programs on a victim's computer.

Reverse Social Engineering

An attack where the perpetrator sets up a situation that causes the victim to encounter a problem and initiate contact with the attacker to ask for help.

Candy Security

A security scenario described as a 'hard crunchy shell with a soft chewy center,' where the outer firewall is strong but the internal infrastructure is weak.

Speakeasy Security

Security that relies solely on knowing the location of information or using a specific word or name to gain access.

Security Through Obscurity

An ineffective security method relying on keeping the details of how a system works secret, assuming no one outside a trusted group will circumvent it.

Two-Factor Authentication

The use of two different types of authentication to verify identity, such as a physical token combined with a password.

Password Hash

A string of gibberish resulting from a one-way encryption process performed on a password; it is intended to be irreversible.

Dead Drop

An Internet site in a remote country or a low-visibility physical location used by hackers or spies to leave information without being detected.

Malware

Slang for malicious software, including viruses, worms, and Trojan Horses that perform damaging tasks without user consent.

RAT

An abbreviation for Remote Access Trojan, which gives an attacker full access to a victim's computer as if they were sitting at the keyboard.

Root Kit

A modification to an operating system that installs one or more back doors at the system level to change the user's perception of system activity.

Back Door

A covert entry point providing a secret way into a user’s computer that is unknown to the user.

Secure Sockets Layer (SSL)

A protocol providing authentication of both client and server and encryption of information during communication on the Internet.

Dumpster Diving

Going through a company’s garbage to find discarded information that has value or can be used as a tool in a social engineering attack.

Shoulder Surfing

The act of watching a person type at a computer keyboard to detect and steal their password or other user information.

Enumeration

A process used by attackers to reveal details about a system, including enabled services, operating system platforms, and lists of account names.

Dictionary Attack

A password recovery or detection strategy that tries every word in an electronic dictionary to uncover a user's password.

Brute Force Attack

A password detection strategy that systematically tries every possible combination of alphanumeric characters and special symbols.

Spyware

Specialized software used to covertly monitor a target's computer activities, capturing keystrokes, passwords, and screenshots.

Silent Install

A method of installing a software application without the computer user or operator being aware that the installation is occurring.

Thin Client

A diskless workstation or computer where the operating system and applications reside on the corporate network rather than the local device.

War Driving

A technique involving driving or walking around with a laptop to detect and locate wireless networks.

War Dialing

A technique used to identify active modem lines within a range of telephone numbers.

Information Owner

A manager assigned the responsibility for protecting specific information assets and deciding the level of data classification to assign them.

Confidential

The highest data classification for information intended for use ONLY within the organization, such as trade secrets or proprietary source code.

Private

Data classification for personal employee information such as medical history, bank account details, or salary history.

Internal

Data classification for information freely shared with employees but requiring a confidentiality agreement before being disclosed to third parties.

Public

Data classification for information specifically designated for release to the public, such as press releases or brochures.

ANI

Abbreviation for Automatic Number Identification, a service that provides the billing number of a calling party for identification purposes.

Butyl Mercaptan

A harmless chemical that creates the odor of a natural gas leak, sometimes used by intruders to cause an emergency evacuation as a diversion.