A security analyst is investigating a dual-vector social engineering campaign targeting a corporate facility. During the investigation, the analyst notes that employees received text messages prompting them to verify credentials on a spoofed portal, while physical USB flash drives labeled "Executive Salaries" were strategically dropped in the employee parking area. Which of the following social engineering attack vectors were executed during this campaign? (Select TWO.)
- Smishing by delivering malicious web links through cellular text messagingAnswer
- Baiting by leaving physical storage media loaded with malware in accessible areasAnswer
- CVishing by placing voice phone calls to trick personnel into granting remote access
- DWatering hole attacks by compromising legitimate websites frequented by company staff
Answer
The attack vectors executed in this campaign are smishing (using cellular text messages with malicious links) and baiting (strategically dropping infected physical media to exploit curiosity).
Smishing refers specifically to phishing attacks conducted over Short Message Service (SMS) text messages. Baiting involves leaving physical media, such as flash drives, in locations where victims will pick them up out of curiosity. Both mechanisms match the attack vectors described in the scenario.
Step-by-Step Solution
Key Concept
Identification of Social Engineering Attack Vectors (Smishing vs. Baiting)