Mod 02 Pervasive Attack Surfaces and Controls

An individual who was recently fired goes to their former place of employment on a weekend. Since they are unable to enter, security goes to the front door to inquire. The fired employee says they forgot their access card and just needs to pick up their tablet in their office. What attack surface is the former employee trying to exploit?

• Human vector

• Mobile device

• Hardware

• Specialized vector

Answer explanation

The former employee is attempting to manipulate the security personnel's trust, which is a human vector. They exploit the human element by claiming to have forgotten their access card to gain unauthorized access.

The CEO of a small retail chain is visiting a client. They call the help desk in a panic and request a password reset because it expired. The technician says they are not allowed to manually reset passwords but to kindly use the online password reset system. The CEO gets irate, says "You're fired," and hangs up. Which of the following best characterizes what happened, or what should have happened?

• The technician should have requested approval from the manager.

• The technician should have changed the password.

• This is an example of social engineering.

• The technician did the right thing.

Answer explanation

The technician did the right thing by directing the CEO to the online password reset system, adhering to company policy. Manually resetting passwords could compromise security, regardless of the caller's position.

Chafik works at Company A. He apparently receives an email from Jon Dough of the purchasing department. The email includes a link along with a request to fill out a survey because they want to improve the procurement process. The from field in the email reads as follows: From: Jon Dough

• This is an example of a potential BEC attack.

• This is an example of a potential phishing attack.

• The email is legitimate because Jon Dough's name appears in the From field.

• This is an example of a potential whaling attack because it is highly targeted.

• The recipient is potentially more likely to click on the link because a reason was supplied.

Answer explanation

This email is a potential phishing attack because it uses a deceptive link and requests sensitive information. The reason provided increases the likelihood of the recipient clicking the link.

Company A sends a fictitious overdue invoice that appears legitimate via email to Company B, a large corporation. Company A hopes that Company B will comply and make the payment without investigating. This scenario represents which type of social engineering attack?

• Phishing

• Pretexting

• Baiting

• Tailgating

Answer explanation

This scenario represents phishing, as Company A is attempting to deceive Company B into making a payment by sending a fake invoice that looks legitimate, hoping for compliance without verification.

Which two methods are commonly used in social engineering attacks? Select two.

• BEC

• Phishing

• Executive fraud

• Brand impersonation

• Account compromise

Answer explanation

The correct answers are BEC (Business Email Compromise) and Phishing. Both involve deceptive tactics to manipulate individuals into providing sensitive information or funds, often using email as the primary method.

You receive a call from someone pretending to be a government agent. They claim there is an issue with your taxes and you need to provide certain information to clear up the problem. However, the caller's true goal is to obtain private information. Which of the following best describes this behavior?

• Vishing

• Smishing

• Vectoring

• Pretexting

Answer explanation

The caller is using a false identity to manipulate you into providing private information, which is known as pretexting. This tactic involves creating a fabricated scenario to gain trust and extract sensitive data.

Which of the following most accurately describes the differences or similarities between typo squatting and cybersquatting? Select two.

• Cybersquatting is registering a domain that contains trademarks and then selling it.

• Cybersquatting changes a letter in a domain hoping to capitalize on a single-bit error.

• Typo squatting will very likely render an "HTTP Error 404 Not Found" message in a browser.

• A domain name with a one-letter change relative to an authentic site is an example of typo squatting.

Answer explanation

Cybersquatting involves registering domains with trademarks to sell them, while typo squatting involves minor changes to a domain name, like a one-letter change, to mislead users. Both practices exploit similar principles.

Gemalyn enters websiteA.com in the address bar of a browser but is redirected to websiteB.com due to an infected DNS. What type of exploit did Gemalyn experience?

• A redirection technique due to a single-bit error in Gemalyn's computer.

• A redirection technique due to a single-bit error in a DNS server.

• A redirection technique due to bitsquatting.

• A redirection technique called pharming.

Answer explanation

Gemalyn experienced pharming, a type of exploit where users are redirected to a malicious site due to compromised DNS settings, rather than a simple error or bitsquatting.

Which of the following most accurately describes the differences or similarities between misinformation and disinformation? Select two.

• Misinformation is a hoax.

• One is false and the other is inaccurate.

• Disinformation is a type of misinformation.

• Misinformation comes with a malicious intent.

• A false warning is an example of disinformation.

Answer explanation

Disinformation is indeed a type of misinformation, as it involves spreading false information with intent to deceive. A false warning exemplifies disinformation, as it misleads people intentionally.

An attacker attempts to target individuals by infecting the website they visit, often to contribute papers, do research, and sign up for conferences. What type of attack is this?

• Spear phishing

• Executive fraud

• Watering hole attack

• Business executive compromise

Answer explanation

A watering hole attack targets specific groups by infecting websites they are likely to visit, such as those for research or conferences. This aligns with the scenario described, making 'watering hole attack' the correct choice.