GoalRecognise spear phishing, pretexting and baiting and their warning signs.
New words
spear phishing · a message made just for you, using details the sender collected about youpretexting · an invented story told to get information or an actionbaiting · offering something tempting, such as a free USB drive, that carries harmful softwarewarning sign · a clue that a message may be a trick
Explanation
Last week you learned that social engineering tricks people. Here are three advanced tricks. Spear phishing is a message made just for you. The sender collected details about you, for example your club or your teacher’s name, so that the message looks real. Pretexting is an invented story: “I am from technical support, I must fix your account.” Some books call it “impersonation”, but the key idea is the made-up story to get information. Baiting offers something tempting, like a free USB drive left on a desk, which actually holds harmful software. The warning signs are the same: hurry, a secret, a request for a password or a code, an odd sender, and a promise that is too good to be true. Whenever you see one of these signs, stop and tell a grown-up.
Trick
What the attacker does
Invented example
Warning sign
Spear phishing
uses details collected about you
“Hi, I saw your club photo. Click to see it.”
a link and details that surprise you
Pretexting
tells an invented story
“I am from the help desk. Tell me the code.”
a request for a code
Baiting
offers something tempting
a free drive lying near the school gate
too good to be true
Worked examples
message knows the club name→it hurries her→she does not click→she shows her teacher
Salma’s club has an invented name: Robots Club. A message arrives: “Dear member of the Robots Club, your trip photo is here, click quickly!” The sender knew the club’s name, so the message looks real, but it is odd and hurries her. She shows it to her teacher.
A story told by a friend: a stranger said, “I am from the school help desk. Tell me your login so I can fix your account.” Real helpers never ask a student for a login in this way. This is pretexting: an invented story to get information.
Class activity
Write a made-up message for each trick (no real names, no real places). Under each, underline the warning signs. Swap with a classmate and see if they find the same ones.
Practice
1
What is special about spear phishing?
It is made for one person, using details collected about that person.
2
Explain pretexting in your own words.
The attacker tells an invented story to get information or make you act.
3
A free USB drive lies near the school gate. What do you do?
Do not plug it in; give it to a teacher.
4
Name three warning signs.
For example hurry, a secret, a request for a password or code (also an odd sender, too good to be true).
