The parcel text
Your phone buzzes. "Your parcel is waiting. Pay 1.99 pounds now to get it." There is a link.
You were not waiting for a parcel. But you might be. You nearly tap the link.
This is not a clever computer attack. It is a trick on a person.
Key words
| Word | What it means | Example |
|---|---|---|
| Social engineering | Tricking people so that they give you secrets or access. | a fake call from "the bank" |
| Malware | Software made to cause harm. | a virus |
| Authentication | Proving that you are who you say you are. | a password |
| Phishing | A fake message that tries to make you click a link or share a secret. | a fake email from a bank |
| Spear phishing | Phishing aimed at one person, using facts about them. | an email using your boss's name |
| Smishing | Phishing by text message (SMS). | the parcel text |
| Vishing | Phishing by voice call. | a "bank" phone call |
| Pharming | Sending you to a fake website even when you type the right address. | a fake bank site |
| Watering hole attack | Infecting a website that your group visits often. | a fan site that spreads malware |
| USB baiting | Leaving an infected USB stick where someone will find and plug it in. | a stick with the label "Pay" |
The cells students fill in are left blank in this preview.
Quick check: which channel?
Have a go
Quick check: which channel?
3 questionsHave a go: your answers are marked here and then forgotten. Sign in if you would like your score kept, and to pick up where you left off.Sign in to keep your score
Your answers are marked here and are not kept. A college account keeps every student’s marks.
Seven social engineering attacks
| Attack | How it reaches you | The trick | What it can cost |
|---|---|---|---|
| Phishing | A fake message sent to thousands of people | Stolen logins. Money lost | |
| Spear phishing | Email, aimed at you | Uses your name, job or friends to look real | A big payment goes to a criminal. Secrets are stolen |
| Smishing | Text message | A short urgent text with a link | Stolen card details. Malware on a phone |
| Vishing | Phone call | A calm voice says it is your bank or the IT help desk | Stolen money or codes |
| Pharming | A fake website | You type the right address but land on a fake page | A stolen login on a fake page |
| Watering hole | A trusted website | The site your group visits is infected | Malware on many devices at once |
| USB baiting | A USB stick | Someone is curious and plugs in a stick they found | Malware inside the company's computers |
The cells students fill in are left blank in this preview.
Pause and check
data-callouts.tip.label
Attackers want you to hurry. A real company will wait. Stop. Look at the address. Then call the real number from the back of your card, not the one in the message.
Try it: read a web address
address = "https://bank.co.uk.evil.com/login"
# The site name is the part before the first / after https://
rest = address.replace("https://", "")
site = rest.split("/")[0]
print(site)
# Is this the real bank? Compare the WHOLE site name.
print(site == "bank.co.uk")
# Change the address to https://bank.co.uk/login and run it again.