PDF p.43
In progress
Impersonation and Pretexting
Summary
PDF p.43Impersonation involves pretending to be someone else to deceive a target, often using persuasive or coercive tactics. Pretexting is the use of a fabricated story to make the impersonation more convincing, typically requiring privileged information about the organization.
In plain words
Supplementary — not from your PDFImpersonation is pretending to be someone else. Pretexting is the made-up story that makes it believable. Attackers either act friendly and ordinary, or they pile on pressure and urgency.
Detailed explanation
PDF p.43-
Impersonation
- Definition: Pretending to be someone else.
- Context: Effective when the target cannot easily verify the attacker's identity (e.g., phone, email).
-
Approaches
- Persuasive/Consensus/Liking: Convince the target that the request is natural and should not be refused.
- Coercion/Threat/Urgency: Intimidate the target with a bogus appeal to authority or urgency.
-
Pretexting
- Definition: Using a carefully crafted story to support the impersonation.
- Purpose: Make the impersonation more convincing by using details that charm or intimidate the target.
- Example: Impersonating IT support to get a user to reveal their password.
-
Reconnaissance
- Purpose: Gather intelligence to make impersonation more effective.
- Methods: Obtain seemingly innocuous information (e.g., employee lists, job titles, phone numbers) to support the pretext.
Important terms
taken from the text above- Impersonation
- Pretending to be someone else.
- Context
- Effective when the target cannot easily verify the attacker's identity (e.g., phone, email).
- Persuasive/Consensus/Liking
- Convince the target that the request is natural and should not be refused.
- Coercion/Threat/Urgency
- Intimidate the target with a bogus appeal to authority or urgency.
- Pretexting
- Using a carefully crafted story to support the impersonation.
Examples & real-world scenarios
Supplementary — not from your PDF- Posing as IT support to ask for a password (pretext: 'we're fixing your mailbox').
- Posing as a senior executive demanding an urgent favour.
- Using names and job titles found online to sound genuine.
Scenario
A caller says: 'Hi, it's Sam from the IT service desk. Your manager Priya asked us to move your mailbox tonight, I just need you to confirm your login.' Reconnaissance supplied the names; the story is the pretext; the request for credentials is the giveaway.
Common mistakes
Supplementary — not from your PDF- Trusting caller ID or the email display name as proof of identity.
- Assuming the attacker won't know inside details. Reconnaissance is part of the attack.
Practical skills
Supplementary — not from your PDF- Verify identity out-of-band before acting on unusual requests.
What I should remember
Key Points PDF p.43-
Impersonation
- Definition: Pretending to be someone else.
- Approaches: Persuasive (natural request), coercive (intimidation).
-
Pretexting
- Definition: Fabricated story to support impersonation.
- Purpose: Convincing details to charm or intimidate.
-
Reconnaissance
- Purpose: Gather intelligence for effective impersonation.
- Methods: Obtain organizational details (e.g., employee lists, phone numbers).