Between-the-Lines, Trapdoor - Backdoor, and Social Engineering Attacks
3 slides · 2 min read · Domain 8
Other Common Software Attack Vectors
Text on this slide
Between-the-Lines, Trapdoor/Backdoor and Social Engineering Attacks
SCLE
"script" )[ s/code s";
torn.clai forn.quez ript? AsCript type
Between-the-Lines Attack
A similar attack to the above is called a between-the- lines entry. This occurs when the telecommunication lines used by an authorized user are tapped into and data falsely inserted or injected.
Trapdoor/Backdoor
A trapdoor or backdoor is a hidden mechanism that bypasses access control measures. It is an entry point into an architecture or system that is inserted in software, typically by developers, during the program's development to provide a method of gaining access into the program for modification and support reasons. This may be useful if the access control mechanism fails or malfunctions and the developer needs access quickly. In many cases, this type of activity may also be called a maintenance hook.
To avoid this, the telecommunication lines should be physically secured so that they cannot be accessed by unauthorized individuals, and users should not leave telecommunication lines open when they finished with them and those lines are not being used anymore.
The problem of trapdoors and backdoors is when they still exist once the application or system has been placed in production. Security needs to take great care in making sure trapdoor, backdoor, and maintenance hooks don't exist in production.
Social Engineering
Last but certainly not least on the list of attack vectors are those involving social engineering techniques. These typically use deception and intimidation to influence, guide, or persuade someone in the organization to provide information they should not disclose to someone that should not have it, which can subsequently be used by attackers to circumvent security controls.
Some of the ways in which attackers can try to use social influence over users to subvert normal processes and technical controls for their own gain may also include subtle intimidation, pulling rank, exploiting guilt, pleading for special treatment, or exploiting the victim's natural desire to be helpful.
End-user awareness and training are the first and best line of defense against social engineering attacks.
Organizations must recognize, too, that these attacks can involve much more than the common email phishing attack vector.
Organizational policies, training, and awareness efforts should help people recognize possible social engineering attacks while they are occurring - and just as importantly, provide them the knowledge and skills to take the right actions to deal with such attacks when not "if" - they happen.