CompTIA Security+ Section 1.1 Social Engineerin

Principles

Authority, Intimidation, Consensus, Scarcity, Familiarity, Trust, Urgency

hybrid warfare

Combining classical military strategy with modern capabilities, including digital influence campaigns, psychological warfare efforts, political tactics, and cyber warfare capabilities.

Pretext

a false statement crafted to sound believable to convince you to act or respond

Session hijacking (a.k.a. TCP/IP hijacking)

a form of attack in which the attacker takes over an existing communication session

Social engineering

a form of attack that exploits human nature and human behavior. The only direct defense against social engineering attacks is user education and awareness training

Business Email Compromise (BEC)

a form of spear phishing that is often focused on convincing members of accounting to transfer funds, pay invoices, or purchase products from a message that appears to originate from a boss, manager, or executive

Whaling

a form of spear phishing that targets specific high-value individuals, such as the CEO or other C-level executives, administrators, or high-net-worth clients. Often the goal of a whaling attack is to steal credentials from the high-level target or to use that target to steal funds or redirect resources to the benefit of the attacker.

Watering hole attack

a form of targeted attack against a region, a group, or an organization. The attacker observes the target's habits to discover a common resource that one or more members of the target frequent. This location is considered the watering hole. Malware is planted on the watering hole system. The target visits the poisoned watering hole, and they bring the infection back into the group or at least their system.

Clickjacking

a means to redirect a user's click or selection on a web page to an alternate, often malicious target instead of the intended and desired location.

Spear phishing

a more targeted form of phishing where the message is crafted and directed specifically to an individual or group of individuals.

Typosquatting

a practice employed to take advantage of when a user mistypes the domain name or IP address of an intended resource.

SMS phishing or smishing

a social engineering attack that occurs over or through standard text messaging services or apps

Scarcity

a technique used to convince someone that an object has a higher value based on the object's limited quantity.

Authority

an effective technique because most people are likely to respond to authority with obedience.

Spoofing

any action to hide a valid identity often by taking on the identity of something else.

Familiarity

attempts to exploit a person's native trust in that which is familiar. The attacker often tries to appear to have a common contact or relationship with the target, such as mutual friends or experiences, or uses a facade to take on the identity of another company or person.

Intimidation

can sometimes be seen as a derivative of the authority principle. Intimidation uses authority, confidence, or even the threat of harm to motivate someone to follow orders or instructions

Reconnaissance

collecting information about a target, often for the purposes of planning an attack against that target. Social engineering reconnaissance can include all of the previously mentioned techniques.

hoax

designed to convince targets to perform an action that will cause harm or reduce their IT security. Victims may be instructed to delete files, change configuration settings, or install fraudulent security software. A hoax often presents a threat and then provides or suggests a response or solution, while claiming taking no action will result in harm

Social media

has become a weapon in the hands of nation-states as they wage elements of hybrid warfare against their targets. They are also used by anyone wanting to control information, distribute propaganda, or change public opinion. We cannot just assume that content we see on a social network is accurate, valid, or complete.

Trust

involves an attacker working to develop a relationship with a victim. This may take seconds or months, but eventually the attacker attempts to use the value of the victim's trust in the attacker to convince the victim to reveal information or perform an action that violates company security.

Spam

not just unwanted advertisements; it can also include malicious content and attack vectors as well

Piggybacking

occurs when an unauthorized entity gains access to a facility under the authorization of a valid worker by tricking the victim into providing consent.

Shoulder surfing

occurs when someone is able to watch a user's keyboard or view their display.

Invoice scams

often attempts to steal funds from an organization or individuals through the presentation of a false invoice often followed by strong inducements to pay.

Urgency

often dovetails with scarcity, because the need to act quickly increases as scarcity indicates a greater risk of missing out.

Vishing

phishing done over any telephony or voice communication system. This includes traditional phone lines, Voice-over-IP (VoIP) services, and mobile phones.

URL hijacking

refers to the practice of displaying a link or advertisement that looks like that of a well-known product, service, or site, but when clicked redirects the user to an alternate location, service, or product.

Influence campaigns

social engineering attacks that attempt to guide, adjust, or change public opinion, often waged by nation-states against their real or perceived foreign enemies

Dumpster diving

the act of digging through trash, discarded equipment, or abandoned locations to obtain information about a target organization or individual.

Identity theft

the act of stealing someone's identity. This can refer to the initial act of information gathering or elicitation where usernames, passwords, credit card numbers, Social Security numbers, and other related, relevant, and personal facts are obtained by the attacker.

Consensus

the act of taking advantage of a person's natural tendency to mimic what others are doing or are perceived as having done in the past. The attacker attempts to convince the victim that a particular action or response is preferred to be consistent with social norms or previous occurrences.

Impersonation

the act of taking on the identity of someone else to use their access or authority. Impersonation can also be known as masquerading, spoofing, and even identity fraud.

Credential harvesting

the activity of collecting and stealing account credentials

Eliciting information

the activity of gathering or collecting information from systems or people.

Prepending

the adding of a term, expression, or phrase to the beginning or header of a communication. Often prepending is used to further refine or establish the pretext of a social engineering attack.

Doxing

the collection of information about an individual or an organization to disclose the collected data publicly for the purpose of chaining the perception of the target

Pharming

the malicious redirection of a valid website's URL or IP address to a fake website that hosts a false version of the original, valid site. This is often an element of a phishing attack, on-path attack, or Domain Name System (DNS) abuse.

Phishing

the process of attempting to obtain sensitive information in electronic communications.

Spam over instant messaging (SPIM)

the transmission of unwanted communications over any messaging system that is supported by or occurs over the Internet.

Tailgating

when an unauthorized entity gains access to a facility under the authorization of a valid worker but without their knowledge. An attacker may be able to sneak in behind a valid worker before the door closes.

Identity fraud

when you falsely claim to be someone else through the use of stolen information from the victim.