Examkin

Question

Difficulty: Very hardSocial Engineering and Threat Types

A network administrator discovers that multiple employees in the legal department received text messages on their corporate mobile devices containing a link to reset their domain credentials due to a mandatory security update. The link directs users to a fraudulent web page whose URL replaces the letter 'o' with the digit '0' in the company's official domain name to harvest login details. Which of the following social engineering attack vectors did the threat actor combine to execute this attack?

  1. Smishing and typosquattingAnswer
  2. B
    Spear phishing and watering hole
  3. C
    Vishing and pretexting
  4. D
    Baiting and pharming

Answer

Smishing and typosquatting
The correct answer combines smishing (using SMS text messages as the initial attack vector) and typosquatting (registering a fake domain with a subtle visual misspelling such as replacing 'o' with '0').

Step-by-Step Solution

1
Analyze the primary communication channel used by the threat actor.
The attack message was delivered via SMS text messages to mobile devices, which identifies the delivery vector as smishing (SMS phishing).
Phishing variants are categorized by their medium: email (phishing), voice calls (vishing), and SMS text messaging (smishing).
2
Examine the technical method used to host the deceptive web page.
The attacker registered a domain name replacing 'o' with '0' to mimic the official corporate domain, which defines typosquatting (URL hijacking).
Typosquatting relies on user typographical errors or visual character similarities in domain names to trick victims into providing credentials on fraudulent portals.
3
Combine the identified attack vectors to select the matching threat pair.
The combination of SMS-based delivery and misspelled domain spoofing equals smishing and typosquatting.
Both vectors must be correctly identified to accurately classify the composite attack scenario.

Key Concept

Classification of Social Engineering Delivery Mechanisms and Domain Spoofing Techniques
Estimated Time:1m 30s
Rate this question

Topics

Social Engineering and Threat Types

More questions from this topic