GCS 5-4: Assets-Threats

Google Cybersecurity Course 5 (Assets, Threats, and Vulnerabilities) Module 4 (Threats to asset security)

Social engineering

A manipulation technique that exploits human error to gain private information, access, or valuables.

Stages of social engineering

1. Prepare

2. Establish trust

3. Use persuasion tactics

4. Disconnect from the target

Preventing social engineering

• Implementing managerial controls

• Staying informed of trends

• Sharing your knowledge with others

Twitter Hack 2020

A breach carried out by a 17-yeer-old hacker on Twitter’s network. It occurred on July 15, 2020. They made phone calls to Twitter employees pretending to be from the IT department. They gained control of high-profile accounts and tweeted out a “double your bitcoin” scam.

Baiting, phishing, quid pro quo, tailgaiting, watering hole

Common types of social engineering

Baiting

A social engineering tactic that tempts people into compromising their security. A common example is USB baiting that relies on someone finding an infected USB drive and plugging it into their device.

Phishing

A social engineering tactic that is the use of digital communications to trick people into revealing sensitive data or deploying malicious software. It is one of the most common forms of social engineering, typically performed via email.

Quid pro quo

A social engineering tactic that is a type of baiting used to trick someone into believing that they’ll be reqwarded in return for sharing access, information, or money. For exmpale, an attacker might impoersonate a loan officer at a bank and call customers offering them a lower interest rate on their credit card. They’ll tell the customers that they simply need to provide their account details to claim the deal.

Tailgaiting

A social engineering tactic in which unauthorized people follow an authorized person into a restricted area.

Piggybacking

Aka tailgating.

Watering hole

A social engineering tactic that is a type of attach when a threat actor compromises a website frequently visited by a specific group of users. Oftentimes, these watering hole sites are infected with malicious software. An example is the Holy Water attack of 2020 that infected various religious, charity, and volunteer websites.

Phishing kit

A collection of software tools needed to launch a phishing campaign

Phishing kit tools

• Malicious attachments

• Fake data-collection forms

• Fraudulent web-links

Smishing

The use of text messages to obtain sensitive information or to impersonate a known source

Vishing

The exploitation of electronic voice communication to obtain sensitive information or impersonate a known source.

Phishing security measures

• Anti-phishing policies

• Employee training resources

• Email filters

• Intrusion prevention systems

Common types of phishing

• Email phishing

• Smishing

• Vishing

• Spear phishing

• Whaling

Email phishing

A type of attack sent via email in which threat actors send messages pretending to be a trusted person or entity.

Smishing

A type of phishing that uses SMS. It covers all forms of text messaging services, including Apple’s iMessages, WhatsApp, and other chat mediums on phones.

Short Message Service

Aka SMS.

SMS

A technology that powers text messaging.

Vishing

Refers to the use of voice calls or voice messages to trick targets into providing personal information over the phone.S

Spear phishing

A subset of email phishing in which specific people are purposefully targeted, such as the accountants of a small business.

Whaling

Refers to a category of spear phishing attempts that are aimed at high-ranking executives in an organization.

2003

In what year did attackers around the world create fraudulent websites that resembled businesses like eBay and PayPal. Mass phishing campaigns to distribute malicious programs were also launched against e-commerce and banking sites.

2010s

In what decade did attackers begin to shift away from mass phishing attempts to targeted phishing attempts.

Angler phishing

A technique where attackers impersonate customer service representatives on social media. This tactic evolved from people’s tendency to complain about businesses online. Threat actors intercept complaints from places like message boards or comment sections and contact the angry customer via social media. Like the AIM attacks of the 1990s, they use fraudulent accounts that appear similar to those of actual businesses. They then trick the angry customers into sharing sensitive information with the promise of fixing their problem.