Elvis Wiki - User contributions [en]

Social Engineering & Phishing Platform

2024-04-04T12:02:25Z

DMansy:

== Social Engineering ==

'''Social Engineering''' is a kind of cyber attack that influences a person to take an action that may or may not be in their best interests, according to Hadnagy. It relies on psychological manipulation with the goal of making individuals perform actions or share confidential information.

=== Social Engineering Attack Cycle ===

Social engineering is a process that requires a deep understanding of psychology, keen senses, and tons of research in order to gain trust and access. The cycle typically involves the following stages:
;Research
: Gathering information about the target before initiating any communication. This includes studying freely accessible websites, social media profiles, and other public sources.
;Developing a Relationship
: Applying the information from the "research" stage to establish trust or authority with the target. The goal is to convince the target to provide information or grant access seemingly of their own free will.
;Exploiting the Connection
: Asking for the desired action or information while maintaining the target's trust to avoid suspicion.
;Utilizing Information
: Reusing gathered information or access in following attacks until the original objective is achieved.

== Social Engineering Attack Methods ==

Social engineering encompasses various methods, including physical and psychological tactics, to gain unauthorized access.

===Physical Attacks===
;Tailgating:
:Gaining access to restricted areas by following authorized personnel.
;Shoulder Surfing:
:Secretly observing confidential information, such as passwords or PINs, by watching individuals operate devices.
;Dumpster Diving:
:Sorting through discarded materials to obtain valuable information like passwords, customer numbers, or contracts.

===Psychological Attacks===
;Reciprocity:
: Offering favors to create a sense of obligation to reciprocate.
;Obligation:
: Evoking a feeling of duty or cooperation to comply with requests.
;Free Information:
: Extracting seemingly harmless information through casual conversation.
;Authority:
: Exploiting the perceived authority of figures to compel compliance.
;Desire to Help:
: Faking distress to evoke sympathy and manipulate individuals into offering assistance.

==Phishing==
Phishing is a subfield of social engineering, which includes multiple strategies and methods aimed to gain personal information from targets.
These attacks can be executed through various mediums such as Mail, text messages, or phone calls, and can be customized to the individual or sent out on a larger scale. In the following paragraphs multiple methods are shown.

;Mail Phishing:
: Mail phishing is a well-known method; attackers impersonate legitimate sources and send emails to a wide range of Mail addresses. These often contain links or forms to fill out. These emails typically create a sense of urgency to prompt action.
;Spear Phishing:
: Spear phishing involves a more targeted approach; these Mails are tailored to specific individuals or companies. Attackers make use of personal information to create an illusion of trustworthiness and legitimacy, increasing the likelihood of success.
;Whaling:
: Whaling is similar to spear phishing. The significant difference is that in this method targets of a high-profile such as CEOs or public figures are the focus. It requires extensive research to gather information for a successful spoof.
;Baiting:
: Baiting attacks offer baits such as random USB sticks, email attachments, or links to invoke curiosity or offer desirable goods for free. They often use offers or a sense of urgency, like last-minute sales, to prompt action quickly.
;Scareware:
: Scareware exploits the tendency to act rashly when someone feels threatened. By staging a threat and offering a solution to unsuspecting victims. This can be done in the form of emails, pop-ups, or SMS that lead to malware or fake websites collecting sensitive information.

==Mail Phishing Exercise==
The exercise "Mail Phishing" is designed to educate users about the risks associated with freely available personal information. The exercise serves as a demonstration of how social engineers can exploit personal details to execute phishing attacks, thus highlighting the necessity for cautious communication in work environments.

[[File:Mail.PNG]]
===Purpose===

;Raise Awareness:
: By simulating a phishing scenario using social media information, the exercise aims to raise awareness about the potential threats of sharing personal details online.
;Educate about Phishing:
: Through experiencing the attacker's perspective, participants learn about the tactics used by cybercriminals.
;Promote Alertness:
: The exercise highlights the importance of exercising caution when sharing online.

===Scenario===
The exercise aims to personalize an email to an employee, faking familiarity. It begins with users being prompted to access publicly available social media data to gather information about the fictional individual.
Upon gathering the necessary information, participants are instructed to complete an email addressed to Cameron, impersonating a colleague named Sarah from the accounting department. The email requests Cameron's employee ID and department. The email seems urgent thanks to faking a system failure, exploiting the familiarity implied by the shared personal details.
If participants successfully fill in Cameron's employee ID, they "win" the exercise. In the case of a successful spoof, the user receives a short text explaining the tactics behind this attack, highlighting the potential risks associated with sharing personal information online and the importance of verifying requests for sensitive data in professional contexts.

===Lessons===
#Recognizing the risks associated with freely available personal information on social media.
#Understanding the tactics employed in phishing attacks and how they exploit human psychology.
#Developing critical thinking skills to discern legitimate communication from potential phishing attempts.
#Implementing best practices for safeguarding sensitive information in online interactions.
== Shoulder Surfing Exercise ==
The exercise "Shoulder Surfing" is designed to educate on the potential risks associated with unauthorized access to sensitive information. Furthermore, it should highlight the importance of good password hygiene. Participants engage in a simulated scenario where they attempt to uncover a coworker's password and user.

[[File:Shoulder.PNG]]
=== Purpose ===
; Highlighting the Simplicity of Shoulder Surfing:
: By simulating a scenario where participants attempt to obtain a coworker's password through observation, the exercise underscores the risks associated with shoulder surfing and unauthorized access to sensitive information.
; Promoting Good Password Hygiene:
: Participants learn about the importance of using strong, unique passwords and avoiding the use of easily guessable information, such as details found in one's surroundings.
; Raising Awareness about Password Complexity:
: The exercise encourages participants to consider their password choices.

=== Scenario ===
The exercise aims to figure out the identity of a coworker by "hacking" a web page. It begins with participants suspecting a coworker of stealing a project and needing evidence to confirm their suspicions. Participants are tasked with extracting information based on the work environment and a shoulder surfing snapshot. Using the observed information, participants attempt to access the coworker's given data on the site. Once participants successfully "hack" the profile, they uncover personal information about the coworker, effectively confirming their identity and involvement in the scenario.

===Learning Objectives===
#Understanding the risks associated with shoulder surfing and unauthorized access to sensitive information.
#The importance of using strong, unique passwords to protect personal and professional accounts.
#Developing critical thinking skills to identify potential security vulnerabilities in password practices.
#Promoting a culture of security awareness and personal responsibility in safeguarding sensitive data.

==The Project==
[https://git.fh-campuswien.ac.at/c2010475112/Phishing-Platform ProjectGit]

== References ==

* C. Hadnagy, Social Engineering: The Science of Human Hacking. Wiley, 2010.
* K. D. Mitnick, The Art of Deception. Wiley, 2002.
* N. Y. Conteh and P. J. Schmick, “Cybersecurity:risks, vulnerabilities and countermeasures to prevent social engineering attacks,” 2016. [Online]. Available: https://api.semanticscholar.org/CorpusID:70178926
* R. B. Cialdini, Influence: The Psychology of Persuasion. HarperBusiness, 2006.
* R. Salama, F. Al-Turjman, S. Bhatla, and S. P. Yadav, “Social engineering attack types and prevention techniques- a survey,” in 2023 International Conference on Computational Intelligence, Communication Technology and Networking CICTN), 2023, pp.817–820.

[[Category:Documentation]]

Social Engineering & Phishing Platform

2024-04-04T12:00:23Z

DMansy:

Social Engineering & Phishing Platform

2024-04-04T11:47:28Z

DMansy:

== Social Engineering ==

'''Social Engineering''' is a kind of cyber attack that influences a person to take an action that may or may not be in their best interests, according to Hadnagy. It relies on psychological manipulation with the goal of making individuals perform actions or share confidential information.

=== Social Engineering Attack Cycle ===

Social engineering is a process that requires a deep understanding of psychology, keen senses, and tons of research in order to gain trust and access. The cycle typically involves the following stages:
;Research
: Gathering information about the target before initiating any communication. This includes studying freely accessible websites, social media profiles, and other public sources.
;Developing a Relationship
: Applying the information from the “research” stage, to establish trust or authority with the target. The goal is to convince the target to provide information or grant access seemingly of their own free will.
;Exploiting the Connection
: Asking for the desired action or information while maintaining the target's trust to avoid suspicion.
;Utilizing Information
: Reusing gathered information or access in following attacks until the original objective is achieved.

== Social Engineering Attack Methods ==

Social engineering encompasses various methods, including physical and psychological tactics, to gain unauthorized access.

===Physical Attacks===
;Tailgating:
:Gaining access to restricted areas by following authorized personnel.
;Shoulder Surfing:
:Secretly observing confidential information, such as passwords or PINs, by watching individuals operate devices.
;Dumpster Diving:
:Sorting through discarded materials to obtain valuable information like passwords, customer numbers, or contracts.

===Psychological Attacks===
;Reciprocity:
: Offering favours to create a sense of obligation to reciprocate.
;Obligation
: Evoking a feeling of duty or cooperation to comply with requests.
;Free Information
: Extracting seemingly harmless information through casual conversation.
;Authority
: Exploiting the perceived authority of figures to compel compliance.
;Desire to Help
:Faking distress to evoke sympathy and manipulate individuals into offering assistance.

==Phishing==
Phishing is a subfield of social engineering, which includes multiple strategies and methods aimed to gain personal information from targets.
These attacks can be executed through various mediums such as Mail, text messages, or phone calls, and can be customized to the individual or sent out on a larger scale. In the following paragraphs multiple methods are shown.

;Mail Phishing
: Mail phishing is a well-known method, attackers impersonate legitimate sources and send emails to a wide range of Mail addresses. These often contain links or forms to fill out. These emails typically create a sense of urgency to prompt action.
;Spear Phishing
: Spear phishing involves a more targeted approach, these Mails are tailored to specific individuals or companies. Attackers make use of personal information to create an illusion of trustworthiness and legitimacy, increasing the likelihood of success.
;Whaling
: Whaling is similar to spear phishing. The significant difference is that in this method targets of a high-profile such as CEOs or public figures are the focus. It requires extensive research, to gather information for a successful spoof.
;Baiting
: Baiting attacks offer baits such as random USB sticks, email attachments, or links to invoke curiosity or offer desirable goods for free. They often use offers or a sense of urgency, like last-minute sales, to quickly needed action.
;Scareware
: Scareware exploits the tendency to act rash when someone feels threatened. By staging a threat and offering a solution to unsuspecting victims. This can be done in the form of emails, pop-ups, or SMS that lead to malware or fake websites collecting sensitive information.

==Mail Phishing Exercise==
The exercise "Mail Phishing" is designed to educate users about the risks about freely available personal information. The exercise serves as a demonstration of how social engineers can exploit personal details to execute phishing attacks. Also underlining the necessity for cautious communication in work environments.

[[File:Mail.PNG]]
===Purpose===

;Raise Awareness
: By simulating a phishing scenario using social media information, the exercise aims to raise awareness about the potential threats of sharing personal details online.
;Educate about Phishing
: Through experiencing the attackers perspective, participants learn about the tactics used by Cybercriminals.
;Promote Alertness
: The exercise shows importance of exercising caution when sharing online.
===Scenario===
The exercises aim is to personalize a Mail to a employee, faking familiarity. It begins with Users are prompted to access publicly available social media data to gather information about the fictional individual.
Upon gathering the necessary information, participants are instructed to complete an email addressed to Cameron, impersonating a colleague named Sarah from the accounting department. The email requests Cameron's employee ID and department. The Mail seems urgent thanks to faking a system failure, exploiting the familiarity implied by the shared personal details.
If participants successfully fill in Cameron's employee ID t, they "win" the exercise. In the case of a successful spoof, the User gets a short text explaining the tactics behind this attack. Highlighting the potential risks associated with sharing personal information online and the importance of verifying requests for sensitive data in professional contexts.

===Lessons===
#Recognizing the risks associated with freely available personal information on social media.
#Understanding the tactics employed in phishing attacks and how they exploit human psychology.
#Developing critical thinking skills to discern legitimate communication from potential phishing attempts.
#Implementing best practices for safeguarding sensitive information in online interactions.

==Shoulder Surfing Exercise==
The Exercise "Shoulder Surfing" is designed to educate on the potential risks associated with unauthorized access to sensitive information. Furthermore, it should highlight the importance of good password hygiene. Participants engage in a simulated scenario where they attempt to uncover a coworker's password and User.

[[File:Shoulder.PNG]]
===Purpose===
;Highlighting the Simplicity of Shoulder Surfing
: By simulating a scenario where participants attempt to obtain a coworker's password through observation, the exercise underscores the risks associated with shoulder surfing and unauthorized access to sensitive information.
;Promote Good Password Hygiene
: Participants learn about the importance of using strong, unique passwords and avoiding the use of easily guessable information, such as details found in one's surroundings.
;Raise Awareness about Password complexity
: The exercise encourages participants to consider their password choices.

===Scenario===
The exercise aims to figure out the identity of a coworker by “hacking” a web page. It begins with they suspect a coworker of stealing a project and need evidence to confirm their suspicions. Participants are tasked with extricating information’s based on the work environment and a shoulder surfing snapshot.
Using the observed information, participants attempt to get into the coworker's given data on the site.
Once participants successfully “hack” the Profile, they uncover personal information about the coworker, effectively confirming their identity and involvement in the scenario.

===Learning Objectives===
#Understanding the risks associated with shoulder surfing and unauthorized access to sensitive information.
#The importance of using strong, unique passwords to protect personal and professional accounts.
#Developing critical thinking skills to identify potential security vulnerabilities in password practices.
#Promoting a culture of security awareness and personal responsibility in safeguarding sensitive data.

==The Project==
[https://git.fh-campuswien.ac.at/c2010475112/Phishing-Platform ProjectGit]

== References ==

* C. Hadnagy, Social Engineering: The Science of Human Hacking. Wiley, 2010.
* K. D. Mitnick, The Art of Deception. Wiley, 2002.
* N. Y. Conteh and P. J. Schmick, “Cybersecurity:risks, vulnerabilities and countermeasures to prevent social engineering attacks,” 2016. [Online]. Available: https://api.semanticscholar.org/CorpusID:70178926

[[Category:Documentation]]

Social Engineering & Phishing Platform

2024-04-04T11:31:26Z

DMansy:

== Social Engineering ==

'''Social Engineering''' is a kind of cyber attack that influences a person to take an action that may or may not be in their best interests, according to Hadnagy. [1] It relies on psychological manipulation with the goal of making individuals perform actions or share confidential information.

=== Social Engineering Attack Cycle ===

Social engineering is a process that requires a deep understanding of psychology, keen senses, and tons of research in order to gain trust and access. [2] The cycle typically involves the following stages:
;Research
: Gathering information about the target before initiating any communication. This includes studying freely accessible websites, social media profiles, and other public sources.
;Developing a Relationship
: Applying the information from the “research” stage, to establish trust or authority with the target. The goal is to convince the target to provide information or grant access seemingly of their own free will.
;Exploiting the Connection
: Asking for the desired action or information while maintaining the target's trust to avoid suspicion.
;Utilizing Information
: Reusing gathered information or access in following attacks until the original objective is achieved. [2]

== Social Engineering Attack Methods ==

Social engineering encompasses various methods, including physical and psychological tactics, to gain unauthorized access.

===Physical Attacks===
;Tailgating:
:Gaining access to restricted areas by following authorized personnel.
;Shoulder Surfing:
:Secretly observing confidential information, such as passwords or PINs, by watching individuals operate devices.
;Dumpster Diving:
:Sorting through discarded materials to obtain valuable information like passwords, customer numbers, or contracts.

===Psychological Attacks===
;Reciprocity:
: Offering favours to create a sense of obligation to reciprocate.
;Obligation
: Evoking a feeling of duty or cooperation to comply with requests.
;Free Information
: Extracting seemingly harmless information through casual conversation.
;Authority
: Exploiting the perceived authority of figures to compel compliance.
;Desire to Help
:Faking distress to evoke sympathy and manipulate individuals into offering assistance.

==Phishing==
Phishing is a subfield of social engineering, which includes multiple strategies and methods aimed to gain personal information from targets.
These attacks can be executed through various mediums such as Mail, text messages, or phone calls, and can be customized to the individual or sent out on a larger scale. In the following paragraphs multiple methods are shown. [3]

;Mail Phishing
: Mail phishing is a well-known method, attackers impersonate legitimate sources and send emails to a wide range of Mail addresses. These often contain links or forms to fill out. These emails typically create a sense of urgency to prompt action. [3]
;Spear Phishing
: Spear phishing involves a more targeted approach, these Mails are tailored to specific individuals or companies. Attackers make use of personal information to create an illusion of trustworthiness and legitimacy, increasing the likelihood of success. [3]
;Whaling
: Whaling is similar to spear phishing. The significant difference is that in this method targets of a high-profile such as CEOs or public figures are the focus. It requires extensive research, to gather information for a successful spoof. [3]
;Baiting
: Baiting attacks offer baits such as random USB sticks, email attachments, or links to invoke curiosity or offer desirable goods for free. They often use offers or a sense of urgency, like last-minute sales, to quickly needed action. [3]
;Scareware
: Scareware exploits the tendency to act rash when someone feels threatened. By staging a threat and offering a solution to unsuspecting victims. This can be done in the form of emails, pop-ups, or SMS that lead to malware or fake websites collecting sensitive information. [3]

==Mail Phishing Exercise==
The exercise "Mail Phishing" is designed to educate users about the risks about freely available personal information. The exercise serves as a demonstration of how social engineers can exploit personal details to execute phishing attacks. Also underlining the necessity for cautious communication in work environments.

[[File:Mail.PNG]]
===Purpose===

;Raise Awareness
: By simulating a phishing scenario using social media information, the exercise aims to raise awareness about the potential threats of sharing personal details online.
;Educate about Phishing
: Through experiencing the attackers perspective, participants learn about the tactics used by Cybercriminals.
;Promote Alertness
: The exercise shows importance of exercising caution when sharing online.
===Scenario===
The exercises aim is to personalize a Mail to a employee, faking familiarity. It begins with Users are prompted to access publicly available social media data to gather information about the fictional individual.
Upon gathering the necessary information, participants are instructed to complete an email addressed to Cameron, impersonating a colleague named Sarah from the accounting department. The email requests Cameron's employee ID and department. The Mail seems urgent thanks to faking a system failure, exploiting the familiarity implied by the shared personal details.
If participants successfully fill in Cameron's employee ID t, they "win" the exercise. In the case of a successful spoof, the User gets a short text explaining the tactics behind this attack. Highlighting the potential risks associated with sharing personal information online and the importance of verifying requests for sensitive data in professional contexts.

===Lessons===
#Recognizing the risks associated with freely available personal information on social media.
#Understanding the tactics employed in phishing attacks and how they exploit human psychology.
#Developing critical thinking skills to discern legitimate communication from potential phishing attempts.
#Implementing best practices for safeguarding sensitive information in online interactions.

==Shoulder Surfing Exercise==
The Exercise "Shoulder Surfing" is designed to educate on the potential risks associated with unauthorized access to sensitive information. Furthermore, it should highlight the importance of good password hygiene. Participants engage in a simulated scenario where they attempt to uncover a coworker's password and User.

[[File:Shoulder.PNG]]
===Purpose===
;Highlighting the Simplicity of Shoulder Surfing
: By simulating a scenario where participants attempt to obtain a coworker's password through observation, the exercise underscores the risks associated with shoulder surfing and unauthorized access to sensitive information.
;Promote Good Password Hygiene
: Participants learn about the importance of using strong, unique passwords and avoiding the use of easily guessable information, such as details found in one's surroundings.
;Raise Awareness about Password complexity
: The exercise encourages participants to consider their password choices.

===Scenario===
The exercise aims to figure out the identity of a coworker by “hacking” a web page. It begins with they suspect a coworker of stealing a project and need evidence to confirm their suspicions. Participants are tasked with extricating information’s based on the work environment and a shoulder surfing snapshot.
Using the observed information, participants attempt to get into the coworker's given data on the site.
Once participants successfully “hack” the Profile, they uncover personal information about the coworker, effectively confirming their identity and involvement in the scenario.

===Learning Objectives===
#Understanding the risks associated with shoulder surfing and unauthorized access to sensitive information.
#The importance of using strong, unique passwords to protect personal and professional accounts.
#Developing critical thinking skills to identify potential security vulnerabilities in password practices.
#Promoting a culture of security awareness and personal responsibility in safeguarding sensitive data.

==The Project==
[https://git.fh-campuswien.ac.at/c2010475112/Phishing-Platform ProjectGit]

== References ==

<references>
[1] C. Hadnagy, Social Engineering: The Science of Human Hacking. Wiley, 2010.
[2] K. D. Mitnick, The Art of Deception. Wiley, 2002.
[3]N. Y. Conteh and P. J. Schmick, “Cybersecurity:risks, vulnerabilities and countermeasures to prevent social engineering attacks,” 2016. [Online]. Available: https://api.semanticscholar.org/CorpusID:70178926

[[Category:Documentation]]

Social Engineering & Phishing Platform

2024-04-04T11:23:20Z

DMansy:

== Social Engineering ==

'''Social Engineering''' is a kind of cyber attack that influences a person to take an action that may or may not be in their best interests, according to Hadnagy. It relies on psychological manipulation with the goal of making individuals perform actions or share confidential information.

=== Social Engineering Attack Cycle ===

Social engineering is a process that requires a deep understanding of psychology, keen senses, and tons of research in order to gain trust and access. The cycle typically involves the following stages:
;Research
: Gathering information about the target before initiating any communication. This includes studying freely accessible websites, social media profiles, and other public sources.
;Developing a Relationship
: Applying the information from the “research” stage, to establish trust or authority with the target. The goal is to convince the target to provide information or grant access seemingly of their own free will.
;Exploiting the Connection
: Asking for the desired action or information while maintaining the target's trust to avoid suspicion.
;Utilizing Information
: Reusing gathered information or access in following attacks until the original objective is achieved.

== Social Engineering Attack Methods ==

Social engineering encompasses various methods, including physical and psychological tactics, to gain unauthorized access.

===Physical Attacks===
;Tailgating:
:Gaining access to restricted areas by following authorized personnel.
;Shoulder Surfing:
:Secretly observing confidential information, such as passwords or PINs, by watching individuals operate devices.
;Dumpster Diving:
:Sorting through discarded materials to obtain valuable information like passwords, customer numbers, or contracts.

===Psychological Attacks===
;Reciprocity:
: Offering favours to create a sense of obligation to reciprocate.
;Obligation
: Evoking a feeling of duty or cooperation to comply with requests.
;Free Information
: Extracting seemingly harmless information through casual conversation.
;Authority
: Exploiting the perceived authority of figures to compel compliance.
;Desire to Help
:Faking distress to evoke sympathy and manipulate individuals into offering assistance.

==Phishing==
Phishing is a subfield of social engineering, which includes multiple strategies and methods aimed to gain personal information from targets.
These attacks can be executed through various mediums such as Mail, text messages, or phone calls, and can be customized to the individual or sent out on a larger scale. In the following paragraphs multiple methods are shown.

;Mail Phishing
: Mail phishing is a well-known method, attackers impersonate legitimate sources and send emails to a wide range of Mail addresses. These often contain links or forms to fill out. These emails typically create a sense of urgency to prompt action.
;Spear Phishing
: Spear phishing involves a more targeted approach, these Mails are tailored to specific individuals or companies. Attackers make use of personal information to create an illusion of trustworthiness and legitimacy, increasing the likelihood of success.
;Whaling
: Whaling is similar to spear phishing. The significant difference is that in this method targets of a high-profile such as CEOs or public figures are the focus. It requires extensive research, to gather information for a successful spoof.
;Baiting
: Baiting attacks offer baits such as random USB sticks, email attachments, or links to invoke curiosity or offer desirable goods for free. They often use offers or a sense of urgency, like last-minute sales, to quickly needed action.
;Scareware
: Scareware exploits the tendency to act rash when someone feels threatened. By staging a threat and offering a solution to unsuspecting victims. This can be done in the form of emails, pop-ups, or SMS that lead to malware or fake websites collecting sensitive information.

==Mail Phishing Exercise==
The exercise "Mail Phishing" is designed to educate users about the risks about freely available personal information. The exercise serves as a demonstration of how social engineers can exploit personal details to execute phishing attacks. Also underlining the necessity for cautious communication in work environments.

[[File:Mail.PNG]]
===Purpose===

;Raise Awareness
: By simulating a phishing scenario using social media information, the exercise aims to raise awareness about the potential threats of sharing personal details online.
;Educate about Phishing
: Through experiencing the attackers perspective, participants learn about the tactics used by Cybercriminals.
;Promote Alertness
: The exercise shows importance of exercising caution when sharing online.
===Scenario===
The exercises aim is to personalize a Mail to a employee, faking familiarity. It begins with Users are prompted to access publicly available social media data to gather information about the fictional individual.
Upon gathering the necessary information, participants are instructed to complete an email addressed to Cameron, impersonating a colleague named Sarah from the accounting department. The email requests Cameron's employee ID and department. The Mail seems urgent thanks to faking a system failure, exploiting the familiarity implied by the shared personal details.
If participants successfully fill in Cameron's employee ID t, they "win" the exercise. In the case of a successful spoof, the User gets a short text explaining the tactics behind this attack. Highlighting the potential risks associated with sharing personal information online and the importance of verifying requests for sensitive data in professional contexts.

===Lessons===
#Recognizing the risks associated with freely available personal information on social media.
#Understanding the tactics employed in phishing attacks and how they exploit human psychology.
#Developing critical thinking skills to discern legitimate communication from potential phishing attempts.
#Implementing best practices for safeguarding sensitive information in online interactions.

==Shoulder Surfing Exercise==
The Exercise "Shoulder Surfing" is designed to educate on the potential risks associated with unauthorized access to sensitive information. Furthermore, it should highlight the importance of good password hygiene. Participants engage in a simulated scenario where they attempt to uncover a coworker's password and User.

[[File:Shoulder.PNG]]
===Purpose===
;Highlighting the Simplicity of Shoulder Surfing
: By simulating a scenario where participants attempt to obtain a coworker's password through observation, the exercise underscores the risks associated with shoulder surfing and unauthorized access to sensitive information.
;Promote Good Password Hygiene
: Participants learn about the importance of using strong, unique passwords and avoiding the use of easily guessable information, such as details found in one's surroundings.
;Raise Awareness about Password complexity
: The exercise encourages participants to consider their password choices.

===Scenario===
The exercise aims to figure out the identity of a coworker by “hacking” a web page. It begins with they suspect a coworker of stealing a project and need evidence to confirm their suspicions. Participants are tasked with extricating information’s based on the work environment and a shoulder surfing snapshot.
Using the observed information, participants attempt to get into the coworker's given data on the site.
Once participants successfully “hack” the Profile, they uncover personal information about the coworker, effectively confirming their identity and involvement in the scenario.

===Learning Objectives===
#Understanding the risks associated with shoulder surfing and unauthorized access to sensitive information.
#The importance of using strong, unique passwords to protect personal and professional accounts.
#Developing critical thinking skills to identify potential security vulnerabilities in password practices.
#Promoting a culture of security awareness and personal responsibility in safeguarding sensitive data.

==The Project==
[https://git.fh-campuswien.ac.at/c2010475112/Phishing-Platform ProjectGit]

== References ==

<references>

[[Category:Documentation]]

Social Engineering & Phishing Platform

2024-04-04T11:03:42Z

DMansy:

== Social Engineering ==

'''Social Engineering''' is a kind of cyber attack that influences a person to take an action that may or may not be in their best interests, according to Hadnagy. It relies on psychological manipulation with the goal of making individuals perform actions or share confidential information.

=== Social Engineering Attack Cycle ===

Social engineering is a process that requires a deep understanding of psychology, keen senses, and tons of research in order to gain trust and access. The cycle typically involves the following stages:
;Research
: Gathering information about the target before initiating any communication. This includes studying freely accessible websites, social media profiles, and other public sources.
;Developing a Relationship
: Applying the information from the “research” stage, to establish trust or authority with the target. The goal is to convince the target to provide information or grant access seemingly of their own free will.
;Exploiting the Connection
: Asking for the desired action or information while maintaining the target's trust to avoid suspicion.
;Utilizing Information
: Reusing gathered information or access in following attacks until the original objective is achieved.

== Social Engineering Attack Methods ==

Social engineering encompasses various methods, including physical and psychological tactics, to gain unauthorized access.

===Physical Attacks===
;Tailgating:
:Gaining access to restricted areas by following authorized personnel.
;Shoulder Surfing:
:Secretly observing confidential information, such as passwords or PINs, by watching individuals operate devices.
;Dumpster Diving:
:Sorting through discarded materials to obtain valuable information like passwords, customer numbers, or contracts.

===Psychological Attacks===
;Reciprocity:
: Offering favours to create a sense of obligation to reciprocate.
;Obligation
: Evoking a feeling of duty or cooperation to comply with requests.
;Free Information
: Extracting seemingly harmless information through casual conversation.
;Authority
: Exploiting the perceived authority of figures to compel compliance.
;Desire to Help
:Faking distress to evoke sympathy and manipulate individuals into offering assistance.

==Phishing==
Phishing is a subfield of social engineering, which includes multiple strategies and methods aimed to gain personal information from targets.
These attacks can be executed through various mediums such as Mail, text messages, or phone calls, and can be customized to the individual or sent out on a larger scale. In the following paragraphs multiple methods are shown.

;Mail Phishing
: Mail phishing is a well-known method, attackers impersonate legitimate sources and send emails to a wide range of Mail addresses. These often contain links or forms to fill out. These emails typically create a sense of urgency to prompt action.
;Spear Phishing
: Spear phishing involves a more targeted approach, these Mails are tailored to specific individuals or companies. Attackers make use of personal information to create an illusion of trustworthiness and legitimacy, increasing the likelihood of success.
;Whaling
: Whaling is similar to spear phishing. The significant difference is that in this method targets of a high-profile such as CEOs or public figures are the focus. It requires extensive research, to gather information for a successful spoof.
;Baiting
: Baiting attacks offer baits such as random USB sticks, email attachments, or links to invoke curiosity or offer desirable goods for free. They often use offers or a sense of urgency, like last-minute sales, to quickly needed action.
;Scareware
: Scareware exploits the tendency to act rash when someone feels threatened. By staging a threat and offering a solution to unsuspecting victims. This can be done in the form of emails, pop-ups, or SMS that lead to malware or fake websites collecting sensitive information.

==Mail Phishing Exercise==
The exercise "Mail Phishing" is designed to educate users about the risks about freely available personal information. Especially focusing on social media platforms. The exercise serves as a demonstration of how social engineers can exploit personal details to execute phishing attacks. Also underlining the necessity for cautious communication in work environments.

[[File:Mail.PNG]]
===Purpose===

;Raise Awareness
: By simulating a phishing scenario using social media information, the exercise aims to raise awareness about the potential threats of sharing personal details online.
;Educate about Phishing
: Through experiencing the attackers perspective, participants learn about the tactics used by Cybercriminals.
;Promote Alertness
: The exercise shows importance of exercising caution when sharing online.
===Scenario===
The exercises aim is to personalize a Mail to a employee, faking familiarity. It begins with Users are prompted to access publicly available social media data to gather information about the fictional individual.
Upon gathering the necessary information, participants are instructed to complete an email addressed to Cameron, impersonating a colleague named Sarah from the accounting department. The email requests Cameron's employee ID and department. The Mail seems urgent thanks to faking a system failure, exploiting the familiarity implied by the shared personal details.
If participants successfully fill in Cameron's employee ID t, they "win" the exercise. In the case of a successful spoof, the User gets a short text explaining the tactics behind this attack. Highlighting the potential risks associated with sharing personal information online and the importance of verifying requests for sensitive data in professional contexts.

===Lessons===
#Recognizing the risks associated with freely available personal information on social media.
#Understanding the tactics employed in phishing attacks and how they exploit human psychology.
#Developing critical thinking skills to discern legitimate communication from potential phishing attempts.
#Implementing best practices for safeguarding sensitive information in online interactions.

==Shoulder Surfing Exercise==
The Exercise "Shoulder Surfing" is designed to educate on the potential risks associated with unauthorized access to sensitive information. Furthermore, it should highlight the importance of good password hygiene. Participants engage in a simulated scenario where they attempt to uncover a coworker's password and User.

[[File:Shoulder.PNG]]
===Purpose===
;Highlighting the Simplicity of Shoulder Surfing
: By simulating a scenario where participants attempt to obtain a coworker's password through observation, the exercise underscores the risks associated with shoulder surfing and unauthorized access to sensitive information.
;Promote Good Password Hygiene
: Participants learn about the importance of using strong, unique passwords and avoiding the use of easily guessable information, such as details found in one's surroundings.
;Raise Awareness about Password complexity
: The exercise encourages participants to consider their password choices.

===Scenario===
The exercise aims to figure out the identity of a coworker by “hacking” a web page. It begins with they suspect a coworker of stealing a project and need evidence to confirm their suspicions. Participants are tasked with extricating information’s based on the work environment and a shoulder surfing snapshot.
Using the observed information, participants attempt to get into the coworker's given data on the site.
Once participants successfully “hack” the Profile, they uncover personal information about the coworker, effectively confirming their identity and involvement in the scenario.

===Learning Objectives===
#Understanding the risks associated with shoulder surfing and unauthorized access to sensitive information.
#The importance of using strong, unique passwords to protect personal and professional accounts.
#Developing critical thinking skills to identify potential security vulnerabilities in password practices.
#Promoting a culture of security awareness and personal responsibility in safeguarding sensitive data.

==The Project==
[https://git.fh-campuswien.ac.at/c2010475112/Phishing-Platform ProjectGit]

[[Category:Documentation]]

Privacy Focused Operating Systems

2024-03-02T14:30:53Z

DMansy: Created page with "== Introduction == Privacy-focused operating systems aim to safeguard user privacy and security through advanced features such as encryption, anonymization, and strict data access control. In contrast to traditional operating systems, these privacy-centric alternatives prioritize minimizing privacy risks and thwarting unauthorized data collection, tracking, and surveillance. === Overview of Main Problems === ==== Data Breaches and Unauthorized Access ==== Traditional..."

== Introduction ==

Privacy-focused operating systems aim to safeguard user privacy and security through advanced features such as encryption, anonymization, and strict data access control. In contrast to traditional operating systems, these privacy-centric alternatives prioritize minimizing privacy risks and thwarting unauthorized data collection, tracking, and surveillance.

=== Overview of Main Problems ===

==== Data Breaches and Unauthorized Access ====

Traditional operating systems are vulnerable to hacking attempts, leading to unauthorized access and data loss. Privacy-focused operating systems, exemplified by Qubes OS, address these concerns by implementing innovative security measures.

==== Data Tracking and Profiling ====

Many operating systems and applications engage in intrusive data collection for various purposes, resulting in targeted advertising and profiling. Privacy-focused OS like Tails counteract this by limiting data collection, ensuring user consent is a primary focus.

==== Lack of Transparency ====

Standard operating systems often lack transparency regarding data collection and utilization. Privacy-focused OS, such as Whonix, strive to provide clear information on data usage, fostering trust between the OS and its users.

=== Security and Privacy Features ===

==== Qubes OS ====

Qubes OS, first released in 2012, employs compartmentalization and isolation through "qubes" or virtual machines. This innovative security architecture ensures that even if one application is compromised, it cannot affect others, minimizing the probability of data breaches.

==== Advantages and Benefits ====

# Enhanced Security: Qubes OS sets a new standard by isolating compromised sections, minimizing potential damage from cyber attacks.
# Privacy and Anonymity: Users can categorize security levels based on needs, ensuring customizable security configurations.
# Challenges and Limitations: High hardware requirements and a learning curve, making it less accessible to average users.
# Architecture: Qubes OS categorizes security levels as 'work,' 'personal,' or 'untrusted,' allowing users to customize security configurations. The architecture utilizes controlled channels for communication between qubes, ensuring user-defined communication.
# Unique Features: Qubes OS offers throw-away VMs for extra security, allowing users to discard virtual machines after use, reducing the risk of compromise.

==== Tails ====

Tails, first released in 2009, introduces the concept of "digital amnesia," ensuring a high level of anonymity by erasing all traces in each session. It operates as a live OS, leaving no digital footprint, and prioritizes privacy and anonymity through the use of the Tor network.

==== Advantages and Benefits ====

# Strong Privacy Emphasis: Tails ensures no traces are left behind, promoting a high level of privacy and anonymity.
# Amnesic Design: Each session starts fresh, enhancing user privacy by not retaining data from older sessions.
# Challenges and Limitations: Potential performance limitations, persistent storage challenges, and a learning curve for new users.
# Architecture: Tails operates as a live OS, running from a USB stick or DVD without installing anything on the client. It prioritizes "digital amnesia," erasing traces after each session, and employs the Tor network for enhanced privacy.
# Security Tools: Tails includes pre-installed security tools like KeePassXC for password management and VeraCrypt for disk encryption, enhancing overall system security.

==== Whonix ====

Whonix, first released in 2012, enhances user anonymity and security by combining two virtual machines – a Gateway and a Workstation. The Gateway manages Tor connections, routing all traffic through the Tor network, while the Workstation provides a secure environment for user interactions.

==== Advantages and Benefits ====

# Enhanced Anonymity and Privacy: Whonix channels all traffic through the Tor network, obscuring user identity and online activities.
# Isolation of Applications: Whonix employs two virtual machines, preventing direct communication between applications and the internet.
# Challenges and Limitations: Potential learning curve, resource-intensive operation, and initial setup complexity.
# Architecture: Whonix operates on a dual VM design with a Gateway and Workstation, ensuring user anonymity by routing all traffic through the Tor network. The separation of Gateway and Workstation enhances security by isolating applications from direct internet communication.
# Protection Against Malware: Whonix's isolated environment reduces the risk of malware infections, providing enhanced security against various cyber-attacks.

== References ==

<references>
Nie, Xiao-wei; Feng, Deng-guo; Che, Jian-jun; Wang, Xin-pu (2006). "Design and implementation of security operating system based on trusted computing." In: 2006 International Conference on Machine Learning and Cybernetics, pages 2776–2781.</ref>

The Tails Project. (2023). "Tails OS Architecture." [https://tails.net/doc/index.en.html]</ref>

Whonix Project. (2023). "Whonix OS Architecture." [https://www.whonix.org/wiki/About]</ref>

Qubes OS Project. (2023). "Qubes OS: A reasonably secure operating system." [https://www.qubes-os.org/]</ref>
Information Technology and Privacy. "https://plato.stanford.edu/entries/it-privacy/". Accessed on: December 15, 2023.</ref>

Yile, Fan. (2016). "Research on the security problem in windows 7 operating system." In: 2016 Eighth International Conference on Measuring Technology and Mechatronics Automation (ICMTMA), pages 568–571.</ref>
</references>

Social Engineering & Phishing Platform

2024-02-29T16:52:47Z

DMansy: Created page with "== Social Engineering == '''Social Engineering''' is a kind of cyber attack that influences a person to take an action that may or may not be in their best interests, according to Hadnagy. It relies on psychological manipulation with the goal of making individuals perform actions or share confidential information. === Social Engineering Attack Cycle === Social engineering is a process that requires a deep understanding of psychology, keen senses, and tons of research..."

== Social Engineering ==

'''Social Engineering''' is a kind of cyber attack that influences a person to take an action that may or may not be in their best interests, according to Hadnagy. It relies on psychological manipulation with the goal of making individuals perform actions or share confidential information.

=== Social Engineering Attack Cycle ===

Social engineering is a process that requires a deep understanding of psychology, keen senses, and tons of research in order to gain trust and access. The cycle typically involves the following stages:
;Research
: Gathering information about the target before initiating any communication. This includes studying freely accessible websites, social media profiles, and other public sources.
;Developing a Relationship
: Applying the information from the “research” stage, to establish trust or authority with the target. The goal is to convince the target to provide information or grant access seemingly of their own free will.
;Exploiting the Connection
: Asking for the desired action or information while maintaining the target's trust to avoid suspicion.
;Utilizing Information
: Reusing gathered information or access in following attacks until the original objective is achieved.

== Social Engineering Attack Methods ==

Social engineering encompasses various methods, including physical and psychological tactics, to gain unauthorized access.

===Physical Attacks===
;Tailgating:
:Gaining access to restricted areas by following authorized personnel.
;Shoulder Surfing:
:Secretly observing confidential information, such as passwords or PINs, by watching individuals operate devices.
;Dumpster Diving:
:Sorting through discarded materials to obtain valuable information like passwords, customer numbers, or contracts.

===Psychological Attacks===
;Reciprocity:
: Offering favours to create a sense of obligation to reciprocate.
;Obligation
: Evoking a feeling of duty or cooperation to comply with requests.
;Free Information
: Extracting seemingly harmless information through casual conversation.
;Authority
: Exploiting the perceived authority of figures to compel compliance.
;Desire to Help
:Faking distress to evoke sympathy and manipulate individuals into offering assistance.

==Phishing==
Phishing is a subfield of social engineering, which includes multiple strategies and methods aimed to gain personal information from targets.
These attacks can be executed through various mediums such as Mail, text messages, or phone calls, and can be customized to the individual or sent out on a larger scale. In the following paragraphs multiple methods are shown.

;Mail Phishing
: Mail phishing is a well-known method, attackers impersonate legitimate sources and send emails to a wide range of Mail addresses. These often contain links or forms to fill out. These emails typically create a sense of urgency to prompt action.
;Spear Phishing
: Spear phishing involves a more targeted approach, these Mails are tailored to specific individuals or companies. Attackers make use of personal information to create an illusion of trustworthiness and legitimacy, increasing the likelihood of success.
;Whaling
: Whaling is similar to spear phishing. The significant difference is that in this method targets of a high-profile such as CEOs or public figures are the focus. It requires extensive research, to gather information for a successful spoof.
;Baiting
: Baiting attacks offer baits such as random USB sticks, email attachments, or links to invoke curiosity or offer desirable goods for free. They often use offers or a sense of urgency, like last-minute sales, to quickly needed action.
;Scareware
: Scareware exploits the tendency to act rash when someone feels threatened. By staging a threat and offering a solution to unsuspecting victims. This can be done in the form of emails, pop-ups, or SMS that lead to malware or fake websites collecting sensitive information.

==Mail Phishing Exercise==
The exercise "Mail Phishing" is designed to educate users about the risks about freely available personal information. Especially focusing on social media platforms. The exercise serves as a demonstration of how social engineers can exploit personal details to execute phishing attacks. Also underlining the necessity for cautious communication in work environments.

*[[File:Mail.PNG]]
===Purpose===

;Raise Awareness
: By simulating a phishing scenario using social media information, the exercise aims to raise awareness about the potential threats of sharing personal details online.
;Educate about Phishing
: Through experiencing the attackers perspective, participants learn about the tactics used by Cybercriminals.
;Promote Alertness
: The exercise shows importance of exercising caution when sharing online.
===Scenario===
The exercises aim is to personalize a Mail to a employee, faking familiarity. It begins with Users are prompted to access publicly available social media data to gather information about the fictional individual.
Upon gathering the necessary information, participants are instructed to complete an email addressed to Cameron, impersonating a colleague named Sarah from the accounting department. The email requests Cameron's employee ID and department. The Mail seems urgent thanks to faking a system failure, exploiting the familiarity implied by the shared personal details.
If participants successfully fill in Cameron's employee ID t, they "win" the exercise. In the case of a successful spoof, the User gets a short text explaining the tactics behind this attack. Highlighting the potential risks associated with sharing personal information online and the importance of verifying requests for sensitive data in professional contexts.

===Lessons===
#Recognizing the risks associated with freely available personal information on social media.
#Understanding the tactics employed in phishing attacks and how they exploit human psychology.
#Developing critical thinking skills to discern legitimate communication from potential phishing attempts.
#Implementing best practices for safeguarding sensitive information in online interactions.

==Shoulder Surfing Exercise==
The Exercise "Shoulder Surfing" is designed to educate on the potential risks associated with unauthorized access to sensitive information. Furthermore, it should highlight the importance of good password hygiene. Participants engage in a simulated scenario where they attempt to uncover a coworker's password and User.

*[[File:Shoulder.PNG]]
===Purpose===
;Highlighting the Simplicity of Shoulder Surfing
: By simulating a scenario where participants attempt to obtain a coworker's password through observation, the exercise underscores the risks associated with shoulder surfing and unauthorized access to sensitive information.
;Promote Good Password Hygiene
: Participants learn about the importance of using strong, unique passwords and avoiding the use of easily guessable information, such as details found in one's surroundings.
;Raise Awareness about Password complexity
: The exercise encourages participants to consider their password choices.

===Scenario===
The exercise aims to figure out the identity of a coworker by “hacking” a web page. It begins with they suspect a coworker of stealing a project and need evidence to confirm their suspicions. Participants are tasked with extricating information’s based on the work environment and a shoulder surfing snapshot.
Using the observed information, participants attempt to get into the coworker's given data on the site.
Once participants successfully “hack” the Profile, they uncover personal information about the coworker, effectively confirming their identity and involvement in the scenario.

===Learning Objectives===
#Understanding the risks associated with shoulder surfing and unauthorized access to sensitive information.
#The importance of using strong, unique passwords to protect personal and professional accounts.
#Developing critical thinking skills to identify potential security vulnerabilities in password practices.
#Promoting a culture of security awareness and personal responsibility in safeguarding sensitive data.

==The Project==
[https://git.fh-campuswien.ac.at/c2010475112/Phishing-Platform ProjectGit]

File:Mail.PNG

2024-02-29T16:46:48Z

DMansy:

File:Shoulder2.PNG

2024-02-29T16:40:29Z

DMansy:

File:Shoulder.PNG

2024-02-29T16:40:18Z

DMansy: