2.2 - Social engineering attacks
Security+ SY0-701 objective 2.2 covers social-engineering attacks that target people rather than technology. Phishing uses fraudulent email; smishing is the same trick over SMS, such as an urgent text with a malicious link asking you to verify your bank; vishing uses voice calls. Pretexting invents a believable scenario, as when an attacker calls staff pretending to be IT support to talk them into resetting a password. Baiting leaves tempting malware-laden USB drives in a parking lot hoping staff plug them in. Typosquatting registers a misspelled domain like 'gooogle.com' to trap mistyping users. Other techniques include impersonation, business email compromise, watering-hole and pharming. Expect scenario questions that describe the con in plain language and ask you to name the specific social-engineering attack, so learn the distinguishing detail of each.
Malicious link by SMS = smishing (email = phishing, voice = vishing). Invented believable scenario ('IT support') = pretexting. Tempting USB drops = baiting. Misspelled lookalike domain = typosquatting.
Practice questions
1. An urgent text message with a malicious link asking you to verify your bank is which attack?
- Vishing
- Smishing (correct answer)
- Whaling
- Pharming
Smishing is phishing via SMS. Vishing=voice call, whaling=targets executives, pharming=redirects to a fake site via DNS.
2. Compromising a website that a target group frequently visits to infect them is a:
- Vishing phone scam
- Watering-hole attack (correct answer)
- Password-spray attack
- Directory-traversal attack
A watering-hole attack compromises a site the victims trust and visit, delivering malware to that community. It targets the group indirectly.
3. Registering a misspelled domain like 'gooogle.com' to trap mistyping users is:
- DNS cache poisoning
- Typosquatting (correct answer)
- On-path interception
- A watering-hole attack
Typosquatting (URL hijacking) registers look-alike/misspelled domains to catch mistyped visits for phishing or malware. Watch for near-miss domains.
4. An attacker calls staff pretending to be IT support to talk them into resetting a password. This is:
- A brute-force attack
- Pretexting (social engineering) (correct answer)
- A SQL-injection attack
- A denial-of-service attack
Pretexting invents a believable scenario/identity to manipulate a victim into acting. Verify identities out-of-band and follow strict callback/reset procedures.
5. A fraudulent email impersonating a CEO to trick finance into wiring money is:
- A password-spray attack
- Business email compromise (BEC) (correct answer)
- A directory-traversal attack
- A watering-hole attack
BEC impersonates executives/partners to authorize fraudulent payments or data release. Defenses: out-of-band verification, payment controls, DMARC and awareness.
6. An attacker leaves malware-laden USB drives in a company parking lot hoping staff plug them in. This is:
- A tailgating attempt
- A baiting attack (correct answer)
- A pharming attack
- A brute-force attempt
Baiting lures victims with something enticing (found USB, free download) that delivers malware. Defend with removable-media policy, disabled autorun and training.