Examkin

Soru

Zorluk: Çok zorSocial Engineering Attacks and Vectors

A cybersecurity analyst at a software development firm is investigating an incident where unauthorized code was introduced into a production build pipeline. The incident response log indicates two distinct actions taken by the threat actor: first, developers received bogus IT support tickets directing them to re-authenticate at an external single-sign-on domain (`login-company-auth.com`) that mimicked the company's internal portal; second, the attacker uploaded malicious software libraries to a public package repository using names with subtle typographical variations of legitimate internal dependencies (e.g., `core-utils-lib` vs. `core-utiis-lib`). Which of the following social engineering attack techniques were directly executed in this scenario? (Select TWO.)

  1. Pretexting by creating a fabricated IT support scenario to trick developers into disclosing credentials on a rogue authentication portalCevap
  2. Typosquatting by registering public package names that visually mimic legitimate internal library names to trick developers into pulling malicious dependenciesCevap
  3. C
    Vishing by making automated interactive voice calls to developer smartphones to intercept multi-factor authentication codes
  4. D
    Watering hole attack by compromising a popular public tech news forum frequently visited by company engineers to deliver browser exploits

Cevap

The threat actor leveraged pretexting by creating a false IT support scenario to capture credentials, and typosquatting by publishing lookalike software library packages to trick developers during code compilation.
Pretexting is demonstrated by the attacker creating a believable IT support scenario to coerce authentication on a fake portal. Typosquatting is demonstrated by registering public software packages with names that closely mirror legitimate internal libraries to deceive developers during dependency resolution.

Adım Adım Çözüm

1
Analyze the first phase of the incident involving fake IT support tickets.
The creation of an false role and scenario (an IT support request requiring authentication) to trick users into performing an action is defined as pretexting.
Pretexting relies on establishing a believable story or context to manipulate targets into providing confidential information or credentials.
2
Analyze the second phase of the incident involving software dependency names.
Registering public dependencies with subtle spelling variations of legitimate internal packages (`core-utils-lib` vs `core-utiis-lib`) is defined as typosquatting (or typosquatting-based supply chain attack).
Typosquatting exploits user typing errors or subtle visual oversights to redirect users or software build scripts to malicious resources.
3
Evaluate and eliminate incorrect social engineering vectors.
Vishing is eliminated because no voice channel was used. Watering hole attacks are eliminated because the attacker did not infect a legitimate public website.
Matching attack vector definitions strictly to the transmission medium and attack method described in the incident logs confirms the correct answers.

Anahtar Kavram

Differentiating social engineering vectors including pretexting, typosquatting, vishing, and watering hole attacks in enterprise scenarios.
Bu soruyu puanla

Konular

Social Engineering Attacks and Vectors

Bu konudan daha fazla soru