ITPEC IP April 2024 Question 41

Sending an e-mail that pretends to be from a financial institution, leading the user to a false website to acquire a password — that is phishing.

The phisher sends a message imitating a bank, card company or online shop, often with an urgent reason ("your account will be suspended"), and a link to a counterfeit site made to look like the real one. Whatever the victim types there (ID, password, PIN, credit card number) goes to the attacker. Defences are to reach the service from a bookmark or a typed URL rather than a link in a message, to check the domain name and the server certificate, and to use multi-factor authentication.

Answer (b)

Why not others:

• •(a) — sending commands over the network to an infected PC and making it run an illegal program is a bot, controlled from the attacker's C&C server
• •(c) — trying the strings of a list of likely passwords is a dictionary attack
• •(d) — flooding a server with packets from many computers until it stops working is a DDoS attack

Key rule: Phishing attacks the person, not the system: the message and the site are fakes and the victim hands over the secrets, so check where a link really leads before typing anything into the page.

Security · AI-written, may contain errors