Exercises: Scams and attacks on people

Explain what phishing is and what a phishing message almost always asks for in the end, regardless of the story it tells.

You receive this text message: 'Your package could not be delivered. Pay $\$0.99$ customs fees here: envios-aduana.info'. Point out at least two details in the message that should make you suspicious and explain what would probably happen if you paid.

The figure shows an email impersonating a bank, with three warning signs already highlighted and one more element marked with a question mark.

Explain why each of the three marked signs reveals the fraud and what you should check regarding the element marked with ? before clicking anything.

Why do phishing messages almost always imitate well-known brands (banks, delivery companies, streaming services)? Explain what the attacker achieves by disguising themselves as a brand people already trust.

Explain the difference between unsolicited email (advertising spam) and phishing, give a made-up example of each, and describe what should be done with each type of message.

Write a made-up example of a phishing message aimed at teenagers (on any topic you like: concerts, games, scholarships) and highlight in your own text the three traps you placed to trick the reader.

In a technical support chat, an 'agent' asks for your password 'to verify your identity'. Explain why no legitimate service ever asks for your password via chat, email, or phone, and write the response you would give.

Explain what a cloned account on a social network is, how one is created (same photo, name with an extra dot or hyphen), and two signs that reveal it is not your friend's original account.

An account with the name and photo of your cousin writes to you asking for urgent money due to a problem. Explain what checks you would carry out before responding and why the name and photo of an account do not guarantee who is behind it.

Define what social engineering is and apply it to this case: someone calls your home posing as a technician from the internet service provider and asks you to install a program "to fix the connection." Point out what persuasion techniques they use and how your family should act.

An email announces that you have won a cell phone in a prize drawing you do not remember entering; to "send it to you," they ask for your full name, address, and a photo of your ID card. Analyze what data they are trying to obtain, what it could be used for later, and what you should do with that email.

In a paid parking area in your town, the official sign has a QR code to pay, but someone has stuck a sticker with another code over it, as shown in the figure.

Explain the risk of paying by scanning the code marked with ?, how you would check which is the official payment system, and what secure alternative exists to pay without using that code.

You receive an email that appears to have been sent from your own address: it claims to have recorded you with your webcam and demands money to avoid spreading the video. Explain how it is possible to spoof an email sender, why this scam relies on fear and embarrassment, and what you should, and should not, do upon receiving it.

An influencer announces a 'giveaway' of headphones: to enter, you must follow several accounts, fill out a form with your details, and pay the 'shipping fees'. Analyze what three different objectives the organizer achieves with each requirement and why the prize probably does not exist.

Your mother receives a message: 'Mom, I lost my phone, this is my new number. I need you to make an urgent bank transfer to me'. Explain the 'child in distress' tactic, what check would instantly expose the scam, and what family rule (for example, an agreed code word) you would propose.

Compare the ultimate goal of three scams: bank phishing, a fake giveaway asking for a photo of a driver's license, and a cloned account asking your relatives for money. What does each attempt to achieve, and what do all three have in common in their initial contact phase?

In a company, the finance department receives this email: "Hello, Carlos. I'm in a meeting with clients and an unforeseen payment to a key supplier for 4,850.00 dollars has come up. Transfer it before 14:00 to this IBAN; I'll attach the invoice later. Don't call me because I can't answer the phone. Regards, Marta (Director)". The email comes from 'marta.directora@empresa-pagos.es' instead of 'marta@empresa.es'. Despite having up-to-date antivirus software on the computer, Carlos makes the payment.

1. a) Technically justify why no client-side antivirus could block this attack.
2. b) Design an administrative and technical payment authorization protocol (using out-of-band verification or two-factor authentication) that makes this scam unfeasible, ensuring that Carlos does not rely solely on his intuition.

Observe these four links received in a text message:

1. https://union-bank.security-access.com/login

2. https://www.unionbank.com/personal

3. https://www.uni0nbank.com/access

4. https://bit.ly/3xK9LqP (shortened link whose hidden real destination is http://unionbank.login.ru)

1. a) Break down the structure of link 1 (protocol, subdomain, main domain, and path) and demonstrate which real server the victim would connect to if they click on it.
2. b) Explain the exact technical procedure to check the real destination of link 4 without opening it, both in a desktop browser and on a cell phone.
3. c) Justify why link 3 is an example of 'typosquatting' and what added risk it poses on cell phone screens with condensed fonts.

In a school messaging group, the following message sent by a classmate goes viral: "They are giving away brand-name sneakers for their anniversary! Go to www.marca-promocion.com/regalo, answer 3 questions, and forward this to 5 groups to get your coupon". The website asks to authorize browser notifications and install a configuration profile on the cell phone to "validate the coupon".

1. a) Explain the social engineering mechanism that the attacker exploits so that the victims themselves organically distribute the fraud without having their accounts compromised.
2. b) Technically predict what risks a user takes by agreeing to install an unknown configuration profile on their cell phone.
3. c) Design a list of 3 technical filtering guidelines that any user should apply before forwarding a link received in a group, assessing the URL, incentives, and requested permissions.

Analyze the following timeline of a security incident:

• 10:15 h: The victim receives a text message from their bank ("ALERT: Unauthorized charge of 250.00 dollars. If you do not recognize it, cancel it urgently at https://banco.atencion-fraude.com").

• 10:17 h: They access the link (with an HTTPS padlock and a design identical to the real one) and enter their ID number and password.

• 10:19 h: The website asks them to enter a one-time code that they just received by text message to "cancel the fraudulent transaction".

1. a) Technically interpret what the attacker is doing between 10:17 h and 10:19 h in the real bank's systems using the data that the victim enters into the fake website.
2. b) Justify why the presence of the HTTPS padlock in no way guarantees that the website belongs to the legitimate bank.
3. c) Design the immediate contingency plan (3 actions ordered by priority) that the victim must execute if they realize the deception right at 10:20 h.