Exercises: Scams and attacks on people

Explain what phishing is and what a phishing message almost always asks for in the end, regardless of the story it tells.

You receive this SMS: 'Your parcel could not be delivered. Pay $0,99\ \text{€}$ customs fees here: envios-aduana.info'. Point out at least two details in the message that should make you suspicious and explain what would probably happen if you paid.

The figure shows an email impersonating a bank, with three warning signs already highlighted and one more element marked with a question mark.

Explain why each of the three marked signs reveals the fraud and what you should check regarding the element marked with ? before clicking anything.

Why do phishing messages almost always imitate well-known brands (banks, delivery companies, streaming services)? Explain what the attacker achieves by disguising themselves as a brand people already trust.

Explain the difference between unsolicited email (advertising spam) and phishing, give a made-up example of each, and describe what should be done with each type of message.

Write a made-up example of a phishing message aimed at teenagers (on any topic you like: concerts, games, scholarships) and highlight in your own text the three traps you placed to trick the reader.

In a technical support chat, an 'agent' asks for your password 'to verify your identity'. Explain why no legitimate service ever asks for your password via chat, email, or telephone, and write the response you would give.

Explain what a cloned account on a social network is, how one is created (same photo, name with an extra dot or hyphen), and two signs that reveal it is not your friend's original account.

An account with the name and photo of your cousin writes to you asking for urgent money due to a problem. Explain what checks you would carry out before responding and why the name and photo of an account do not guarantee who is behind it.

Define what social engineering is and apply it to this case: someone calls your home posing as a technician from the internet company and asks to install a program 'to fix the connection'. Point out what persuasion techniques they use and how your family should act.

An email announces that you have won a mobile phone in a prize draw you do not remember entering; to 'send it to you', they ask for your full name, address, and a photo of your ID card. Analyse what data they are trying to obtain, what it could be used for later, and what you should do with that email.

In a paid parking area in your town, the official sign has a QR code to pay, but someone has stuck a sticker with another code over it, as shown in the figure.

Explain the risk of paying by scanning the code marked with ?, how you would check which is the official payment system, and what secure alternative exists to pay without using that code.

You receive an email that appears to have been sent from your own address: it claims to have recorded you with your webcam and demands money to avoid spreading the video. Explain how it is possible to spoof an email sender, why this scam relies on fear and embarrassment, and what you should — and should not — do upon receiving it.

An influencer announces a 'giveaway' of headphones: to enter, you must follow several accounts, fill out a form with your details, and pay the 'postage fees'. Analyse what three different objectives the organizer achieves with each requirement and why the prize probably does not exist.

Your mother receives a message: 'Mum, I lost my phone, this is my new number. I need you to make an urgent bank transfer to me'. Explain the 'child in distress' tactic, what check would instantly expose the scam, and what family rule (for example, an agreed codeword) you would propose.

Compare the ultimate goal of three scams: bank phishing, a fake giveaway asking for a photo of an ID card, and a cloned account asking your relatives for money. What does each attempt to achieve, and what do all three have in common in their initial contact phase?

In a company, the financial department receives this email: "Hello, Carlos. I'm in a meeting with clients and an unforeseen payment to a key supplier for 4.850,00 € has come up. Transfer it before 14:00 to this IBAN; I'll attach the invoice later. Don't call me because I can't answer the phone. Regards, Marta (Director)". The email comes from 'marta.directora@empresa-pagos.es' instead of 'marta@empresa.es'. Despite having up-to-date antivirus software on the computer, Carlos makes the payment.

1. a) Technically justify why no client-side antivirus could block this attack.
2. b) Design an administrative and technical payment authorization protocol (using out-of-band verification or two-factor authentication) that makes this scam unfeasible, ensuring that Carlos does not rely solely on his intuition.

Analyze the following table showing three attacks suffered by the staff of an educational center:

1. SMS from the sender 'CORREOS' notifying about a detained package with the link 'bit.ly/paq-34'.

2. Call from an alleged technician from the Department of Education asking verbally for the SMS code that just arrived on the principal's mobile phone to "update the school's firewall".

3. Email from 'soporte@educa-madrid.org' (the official domain is 'educa.madrid.org') with an attachment 'actualizacion.pdf.exe'.

1. a) Explain what technical limitation of traditional telephony allows the caller ID (CLI) or the alphanumeric sender to be spoofed so easily in smishing and vishing compared to email.
2. b) Predict what would happen if the principal provides the code in case 2 and justify why SMS two-factor authentication (2FA) is bypassed in this social engineering attack.

Observe these four links received in an instant messaging text:

1. https://banco-santander.seguridad-acceso.com/login

2. https://www.bancosantander.es/es/particulares

3. https://www.banc0santander.es/acceso

4. https://bit.ly/3xK9LqP (shortened link whose hidden real destination is http://santander.login.ru)

1. a) Break down the structure of link 1 (protocol, subdomain, main domain, and path) and demonstrate which real server the victim would connect to if they click on it.
2. b) Explain the exact technical procedure to check the real destination of link 4 without opening it, both in a desktop browser and on a mobile phone.
3. c) Justify why link 3 is an example of 'typosquatting' and what added risk it poses on mobile screens with condensed fonts.

In a school messaging group, the following message sent by a classmate goes viral: "They are giving away brand-name sneakers for their anniversary! Go to www.marca-promocion.com/regalo, answer 3 questions, and forward this to 5 groups to get your coupon". The website asks to authorize browser notifications and install a configuration profile on the mobile phone to "validate the coupon".

1. a) Explain the social engineering mechanism that the attacker exploits so that the victims themselves organically distribute the fraud without having their accounts compromised.
2. b) Technically predict what risks a user takes by agreeing to install an unknown configuration profile on their mobile phone.
3. c) Design a list of 3 technical filtering guidelines that any user should apply before forwarding a link received in a group, assessing the URL, incentives, and requested permissions.

Analyze the following timeline of a security incident:

• 10:15 h: The victim receives an SMS from their bank ("ALERT: Unauthorized charge of 250,00 €. If you do not recognize it, cancel it urgently at https://banco.atencion-fraude.com").

• 10:17 h: They access the link (with an HTTPS padlock and a design identical to the real one) and enter their ID number and password.

• 10:19 h: The website asks them to enter a one-time code that they just received by SMS to "cancel the fraudulent transaction".

1. a) Technically interpret what the attacker is doing between 10:17 h and 10:19 h in the real bank's systems using the data that the victim enters into the fake website.
2. b) Justify why the presence of the HTTPS padlock in no way guarantees that the website belongs to the legitimate bank.
3. c) Design the immediate contingency plan (3 actions ordered by priority) that the victim must execute if they realize the deception right at 10:20 h.

Following a data breach at a computer store, a customer receives an email from 'pedidos@tienda-informatica.com' stating: "Dear Juan, regarding your purchase of the Gamer-X laptop on March 12, there was an error calculating the VAT (42,00 €). Download the attached revised invoice 'Factura_IVA.zip' or the order will be canceled".

1. a) Justify why antispam filters based on heuristic text analysis do not detect this message even though the sender is spoofed.
2. b) Explain the role of cryptographic email records (such as SPF, DKIM, or DMARC) in enabling the destination server to identify whether the email genuinely originates from the store's authorized server.
3. c) If Juan opens the file 'Factura_IVA.zip' and finds a file named 'Factura_IVA.pdf.exe', explain the concealment technique used and predict what would happen if the operating system has the default option "Hide file extensions for known file types" enabled.

In a cybersecurity drill at a 200-employee software company, the technical department sends two simulated phishing campaigns:

• Email A (Generic): "You have won a €100,00 gift voucher. Click here to redeem it". Sent on a Tuesday at 10:00.

• Email B (Contextualized): "Urgent: Synchronization error in the code repository before deployment. Confirm your credentials before 18:00 to avoid losing your changes". Sent on a Friday at 17:45.

Results: 2,5 % of the staff fell for email A; 38,0 % fell for email B, including senior engineers.

1. a) Interpret the obtained data: what cognitive, temporal, and contextual factors explain the huge difference in success between both emails?
2. b) Technically refute the statement of an executive who claims: "Training employees better is enough; it is the user's fault for not looking at the link closely".
3. c) Propose two system-level technical measures (such as FIDO2 keys or corporate password managers) that prevent account theft even if the user falls for the trap in email B.

A user types "banco nacional customer login" into a web search engine. The first sponsored result (ad) shows the title "Banco Nacional - Customer Login", but upon clicking, the browser bar displays: 'https://banc0naci0nal.es-web.net/login'.

1. a) Explain how this attack vector (malvertising and search engine poisoning) differs from traditional email phishing and why it generates a much higher deception rate.
2. b) The fraudulent website has a valid SSL/TLS certificate (it shows the closed padlock in green/gray). Justify the difference between connection encryption and authentication of the identity of the website owner.
3. c) Design two technical browsing habits for critical services (banking, institutional email) that completely neutralize this attack vector without relying on search engine results.