IPA IP 2022 Question 91

Using a password stolen by peeking over someone’s shoulder — social engineering obtains secrets through people’s carelessness or psychological weak points, not through technical attacks on the system.

Shoulder surfing, watching a person type a password or PIN, needs no technical skill at all: it exploits the fact that people enter secrets where others can see them. Other examples of social engineering are calling a help desk while posing as an employee to have a password reset, and searching thrown-away documents (trashing). Once the password is stolen, logging in as its owner is impersonation.

Answer (b)

Why not others:

• •(a) — trying every combination of characters mechanically is a brute force attack, a technical attack on the password itself
• •(c) — overloading a server with a flood of requests to stop its service is a DoS attack
• •(d) — writing data longer than the allocated area to run code illegitimately is a buffer overflow attack, which exploits a flaw in the program

Key rule: Social engineering attacks people, not machines: shoulder surfing, pretexting on the phone and trashing all obtain secrets without breaking into the system technically.

Security · AI-written, may contain errors