ITPEC IP April 2023 Question 36

A false e-mail leading the recipient to a fake website to obtain personal information — that is phishing.

The attacker sends an e-mail posing as a bank, a shop or another trusted organisation, typically warning of a problem with an account and urging the recipient to click a link. The link opens a fake site imitating the real one, and the victim enters an ID, a password or a card number, which go straight to the attacker. Countermeasures: do not follow links in unexpected mail, open the site from a bookmark, check the URL and the server certificate, and use multi-factor authentication.

Answer (b)

Why not others:

• •(a) — a virus-infected computer controlled from outside through the network is a bot, one member of a botnet
• •(c) — embedding a malicious script through a page that displays user input as is exploits cross-site scripting (XSS)
• •(d) — a program secretly resident on the PC that collects file data or operation history is spyware

Key rule: Phishing attacks the person rather than the software: the victim is tricked into typing information into a fake site, so the defence is checking where a link really leads.

Security · AI-written, may contain errors