Security Week, Thursday: The phone call

Phishing and its cousins

Social engineering tricks people instead of hacking machines.

• Phishing: fake emails that lure clicks or logins
• Spear phishing: phishing aimed at one person or team, using real details
• Whaling: spear phishing aimed at executives (Mr. Barkley)
• Vishing: voice phishing over the phone
• Smishing: phishing by SMS text message
• QR code phishing: a QR code (on a flyer or email) leads to a fake login page

In-person tricks

Not every attack comes through a screen:

• Impersonation: pretending to be IT, a vendor or a boss
• Shoulder surfing: watching someone type a password or PIN
• Tailgating: following an authorized person through a secure door
• Dumpster diving: searching trash for papers, sticky notes or old drives

Exam tip Defenses: verify by calling back a known number, privacy screens, vestibules, shredding.

Network attacks

Attacks that target availability or the connection:

• DoS (denial of service): one source floods or crashes a service
• DDoS (distributed DoS): many sources, often a botnet, flood it at once
• Evil twin: a fake access point using a real SSID to capture traffic
• On-path attack: attacker sits between two parties, reading or changing traffic (formerly man-in-the-middle)
• Spoofing: faking an identity: email sender, IP address, MAC address or caller ID

Password and app attacks

Attacks on logins and applications:

• Brute-force attack: tries every possible combination
• Dictionary attack: tries common words and leaked passwords
• SQL injection: database commands typed into a web form or URL
• Cross-site scripting (XSS): malicious script injected into a website that runs in other users' browsers
• Zero-day attack: exploits a flaw the vendor doesn't know about yet, so there's no patch

Login form:    ' OR 1=1 --
  -> SQL injection
Comment field: <script>steal()</script>
  -> XSS

Exam tip Account lockout after failed attempts stops brute-force and dictionary attacks.

Installing browsers and extensions

Browser download/installation: get it only from trusted sources (the vendor's site or the company software portal). Check the hash: compare the file's SHA-256 with the one the vendor publishes. Untrusted sources (pop-up 'update your browser' sites) are a classic trojan route. Extensions and plug-ins follow the same rule: official store only, few permissions, approved by IT.

PS> Get-FileHash .\BrowserSetup.exe
(SHA256 is the default algorithm)
Hash:        3F9A...C21B
Vendor page: 3F9A...C21B
-> match, safe to install

Patching, passwords and certificates

Browser patching: keep auto-update on; browsers are attacked constantly. Password managers: built in or standalone, they create and store unique passwords and won't autofill on a fake domain. Secure connections/sites: HTTPS with a valid certificate (trusted issuer, not expired, matching the site name).

Exam tip Certificate warning on the company payroll site? Stop and report it. It may be an on-path attack or an expired cert.