Lesson 02 - Group 3: Social Engineering

Social engineering

Manipulating people to obtain information or gain unauthorized access, sometimes described as “hacking the human.”

What are the two main purposes of social engineering?

Reconnaissance or eliciting information, and intrusion or gaining unauthorized access.

What are examples of human-vector attacks?

Persuading a user to run a malicious file, soliciting information from a help desk, or gaining physical access to install a monitoring device.

Impersonation

Pretending to be someone else.

What approaches may be used during impersonation?

Persuasion, consensus, liking, coercion, threats, and urgency.

Pretexting

Using a convincing scenario and supporting details to make a false identity or request appear legitimate.

How does pretexting support impersonation?

The attacker may obtain or spoof information that supports the claimed identity.

Phishing

Tricking a target into using a malicious resource by spoofing legitimate communications or websites.

Vishing

Phishing conducted through a voice channel.

SMiShing

Phishing conducted through SMS or text messaging.

Pharming

Redirecting a victim to a malicious location through DNS spoofing.

Typosquatting

Using a cousin domain that closely resembles a trusted domain.

Email spoofing

Making an email appear to come from a trusted sender, including through From-field confusion.

Business email compromise

Targeted phishing, vishing, or SMiShing against a specific person while posing as a colleague, business partner, or vendor.

What targeted attacks are associated with business email compromise?

Spear phishing, whaling, CEO fraud, and angler phishing.

Brand impersonation

Creating fake phishing messages, business correspondence, or pharming sites that appear to represent a trusted brand.

Watering hole attack

Compromising a third-party site that the attacker knows is regularly used by the target.

Why may passive social-engineering techniques appeal to attackers?

They generally present less risk of detectio