ITPEC FE Morning October 2022 Question 41
An attacker calls a corporate help desk, masquerading as an employee who has forgotten his password. The help desk staff resets the password to the company default “password1.” The attacker then uses this password to access the company network and information on the server. What is this type of attack called?
Explanation
Social engineering — the attacker gets the password by deceiving a person, not by breaking any technology.
The caller pretends to be an employee who forgot his password, and the help desk, trusting the story without verifying who is calling, resets it to a known default. No software flaw is exploited: the weak point is the human who hands over the access. Pretexting over the phone, impersonating staff, and looking for passwords in rubbish (dumpster diving) are typical forms.
Answer (d)
Why not others:
- •(a) Buffer overflow attack — sends input longer than a program's buffer to overwrite memory and run code; it attacks software, and no one is deceived
- •(b) Denial-of-Service attack — floods a server or network to make the service unavailable; it aims at availability, not at obtaining a password
- •(c) Shoulder surfing — watches over someone's shoulder as they type a password; it needs physical proximity, not a phone call with a false identity
Key rule: When an attack succeeds because a person was tricked into giving access or information, it is social engineering; the countermeasure is procedure, such as verifying the caller's identity before any password reset.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.