Understanding Smishing

What is smishing?

• A type of phishing attack conducted via SMS

• A method of secure communication

• A new social media platform

• A type of email scam

Answer explanation

Smishing is a type of phishing attack that occurs via SMS, where attackers send fraudulent messages to trick individuals into revealing personal information. This makes the first answer choice correct.

Smishing is a type of phishing attack carried out over which medium?

• Email

• Mobile text messaging

• Social media

• Phone calls

Answer explanation

Smishing specifically refers to phishing attacks conducted via mobile text messaging (SMS). Unlike email phishing, smishing targets users through their mobile devices, making 'Mobile text messaging' the correct answer.

What are the two methods cybercriminals use to steal data in smishing attacks?

• Phishing and Vishing

• Sending malicious links and requesting personal information

• Hacking and Phishing

• Social engineering and Malware

Answer explanation

In smishing attacks, cybercriminals often use methods like sending malicious links to trick victims into clicking and requesting personal information to steal sensitive data. This makes 'sending malicious links and requesting personal information' the correct choice.

The term 'smishing' combines which two words?

• A) SMS and phishing

• B) SMS and fishing

• C) Social and phishing

• D) Smart and phishing

Answer explanation

The term 'smishing' is a combination of 'SMS' (Short Message Service) and 'phishing', which refers to fraudulent attempts to obtain sensitive information via text messages. Therefore, the correct answer is A) SMS and phishing.

What are the core components of any SMS phishing attack?

Answer explanation

Core components of an SMS phishing attack include a deceptive message, a sense of urgency, and a malicious link or phone number that leads to a fraudulent site or service, aiming to steal personal information.

How do social engineering principles help smishing attackers?

• By enhancing their technical skills

• By exploiting human psychology

• By providing financial resources

• By improving network security

Answer explanation

Smishing attackers use social engineering principles by exploiting human psychology, manipulating emotions and trust to trick individuals into revealing sensitive information or clicking malicious links.

What are the three driving factors of deception in smishing?

Answer explanation

The three driving factors of deception in smishing are urgency, fear, and trust. Attackers exploit these emotions to manipulate victims into providing personal information or clicking malicious links.

Attackers want the recipient to open a URL link within the text message because:

• it leads to a legitimate website.

• it can install malware on the device.

• it provides a discount coupon.

• it verifies the recipient's identity.

Answer explanation

Attackers often use malicious links to install malware on the recipient's device. This is a common tactic in phishing attacks, where the goal is to compromise the device rather than provide legitimate offers or services.

What method allows an attacker to hide their true phone number behind a decoy?

Answer explanation

An attacker can use a technique called 'caller ID spoofing' to hide their true phone number behind a decoy number, making it appear as if the call is coming from a different source.

The key phases an attacker will carry out in a smishing attack are:

• Reconnaissance, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives

• Planning, Scanning, Gaining Access, Maintaining Access, Covering Tracks

• Research, Crafting the Message, Sending the Message, Harvesting Information

• Identification, Targeting, Attack Execution, Data Exfiltration

Answer explanation

In a smishing attack, the attacker first conducts research to identify targets, then crafts a convincing message, sends it to the victim, and finally harvests the information provided by the victim, making this the correct choice.