Examkin

Question

Difficulty: MediumSocial Engineering Attacks and Vectors

A corporate employee receives a customized USB flash drive in the mail labeled 'Confidential: Executive Salary Adjustments Q3' that appears to originate from the human resources department. Driven by curiosity, the employee connects the drive to a company workstation, which immediately triggers malicious code execution. Which social engineering attack vector did the attacker utilize in this scenario?

  1. BaitingAnswer
  2. B
    Watering hole attack
  3. C
    Spear phishing
  4. D
    Pretexting

Answer

Baiting is the social engineering technique used in this scenario.
Baiting is an attack vector in which an adversary promises or provides a physical medium (such as a USB drive) or a digital item enticed by curiosity or reward. When the target plugs the compromised device into an internal machine, malicious code executes.

Step-by-Step Solution

1
Analyze the attack vector and medium described in the scenario
The attacker delivered a physical storage device (USB flash drive) enticingly labeled to exploit curiosity.
Identifying the medium (physical USB drive vs. digital email or phone call) narrows down the social engineering classification.
2
Evaluate the psychological trigger used by the attacker
The label 'Executive Salary Adjustments' relies on curiosity and greed to induce the victim to plug in the drive.
Baiting specifically relies on offering something enticing or intriguing (the bait) to entice the user into taking an unsafe physical action.
3
Match the observed tactic to standard social engineering definitions
Leaving or sending malware-laden physical hardware for a victim to connect is the textbook definition of baiting.
This differentiates the attack from purely digital vector mechanisms such as email phishing or web compromises.

Key Concept

Baiting Social Engineering Vector
Rate this question

Topics

Social Engineering Attacks and Vectors

More questions from this topic