Deck 6: Computer Fraud and Abuse Techniques

Question 1

Individuals who use telephone lines to commit fraud and other illegal acts are typically called

A)phreakers.
B)crackers.
C)phishers.
D)hackers.

Answer 1

A

Question 2

The deceptive method by which a perpetrator gains access to the system by pretending to be an authorized user is called

A)masquerading.
B)bluebugging.
C)eavesdropping.
D)podslurping.

Answer 2

A

Question 3

Using a small device with storage capacity (iPod,Flash drive)to download unauthorized data from a computer is called

A)masquerading.
B)bluebugging.
C)eavesdropping.
D)podslurping.

Answer 3

D

Question 4

Gaining control of somebody's computer without their knowledge and using it to carry out illicit activities is known as

A)hacking.
B)spamming.
C)posing.
D)hijacking.

Question 5

A hacker who changed the voice mail greeting of a company to say that it is offering free products by asking customers to dial a different phone number to claim their gifts is engaging in

A)diddling.
B)phreaking
C)phishing.
D)hacking.

Question 6

________ consists of the unauthorized copying of company data.

A)Phishing
B)Masquerading
C)Data leakage
D)Eavesdropping

Question 7

What is a dictionary attack?

A)It is an attack when the perpetrator is inserting malicious query in input such that it is passed to and executed by an application program.
B)It is an attack when the perpetrator is inputting so much data that the input buffer overflows. The overflow contains code that takes control of the company's computer.
C)It is an attack when the perpetrator uses software to guess company's addresses, send employees blank e-mails, and add unreturned messages to spammer e-mail list.
D)It is an attacked when the perpetrator sends hundreds of messages from randomly generated false addresses, overloading an Internet service provider's e-mail server.

Question 8

Tapping into a communications line and then entering the system by accompanying a legitimate user without their knowledge is called

A)superzapping.
B)tabnapping.
C)pretexting.
D)piggybacking.

Question 9

Sending an unsolicited message to many people at the same time is known as

A)hacking.
B)spamming.
C)posing.
D)hijacking.

Question 10

Taking control of a phone to make calls,send text messages,listen to calls,or read text messages is called

A)masquerading.
B)bluebugging.
C)eavesdropping.
D)podslurping.

Question 11

Secretly changing an already open browser tab using JavaScript is called

A)superzapping.
B)tabnapping.
C)pretexting.
D)piggybacking.

Question 12

Using special software to bypass system controls and perform illegal acts is called

A)superzapping.
B)tabnapping.
C)pretexting.
D)piggybacking.

Question 13

Acting under false pretenses to gain confidential information is called

A)superzapping.
B)tabnapping.
C)pretexting.
D)piggybacking.

Question 14

Creating a seemingly legitimate business,collecting personal data while making a sale,and never delivering items sold is known as

A)hacking.
B)spamming.
C)posing.
D)hijacking.

Question 15

What is a SQL injection attack?

A)It is an attack when the perpetrator is inserting malicious query in input such that it is passed to and executed by an application program.
B)It is an attack when the perpetrator is inputting so much data that the input buffer overflows. The overflow contains code that takes control of the company's computer.
C)It is an attack when the perpetrator uses software to guess company's addresses, send employees blank e-mails, and add unreturned messages to spammer e-mail list.
D)It is an attacked when the perpetrator sends hundreds of messages from randomly generated false addresses, overloading an Internet service provider's e-mail server.

Question 16

What is a buffer overflow attack?

A)It is an attack when the perpetrator is inserting malicious query in input such that it is passed to and executed by an application program.
B)It is an attack when the perpetrator is inputting so much data that the input buffer overflows. The overflow contains code that takes control of the company's computer.
C)It is an attack when the perpetrator uses software to guess company's addresses, send employees blank e-mails, and add unreturned messages to spammer e-mail list.
D)It is an attacked when the perpetrator sends hundreds of messages from randomly generated false addresses, overloading an Internet service provider's e-mail server.

Question 17

What is a denial of service attack?

A)It is an attack when the perpetrator is inserting malicious query in input such that it is passed to and executed by an application program.
B)It is an attack when the perpetrator is inputting so much data that the input buffer overflows. The overflow contains code that takes control of the company's computer.
C)It is an attack when the perpetrator uses software to guess company's addresses, send employees blank e-mails, and add unreturned messages to spammer e-mail list.
D)It is an attacked when the perpetrator sends hundreds of messages from randomly generated false addresses, overloading an Internet service provider's e-mail server.

Question 18

Listening to private voice or data transmissions is called

A)masquerading.
B)bluebugging.
C)eavesdropping.
D)podslurping.

Question 19

Unauthorized access,modification,or use of an electronic device or some element of a computer system is known as

A)hacking.
B)spamming.
C)posing.
D)hijacking.

Question 20

Which of the following is not a method of identity theft?

A)Scavenging
B)Phishing
C)Shoulder surfing
D)Phreaking

Question 21

A fraud technique that allows a hacker to place himself or herself between a client and a host to intercept network traffic is called the ________ technique.

A)Trojan horse
B)man-in-the-middle
C)salami
D)trap door

Question 22

Voice phishing,in which e-mail recipients are asked to call a phone number that asks them to divulge confidential data is known as

A)pharming.
B)cyber-bullying.
C)hacking.
D)vishing.

Question 23

Carding is

A)verifying credit card validity; buying and selling stolen credit cards.
B)inserting a sleeve into an ATM so that it will not eject the victim's card, pretending to help the victim as a means of obtaining his PIN, and using the card and PIN to drain the account.
C)a technique that tricks a person into disclosing confidential information.
D)changing data before, during, or after it is entered into the system in order to delete, alter, or add key system data.

Question 24

During a routine audit,a review of cash receipts and related accounting entries revealed discrepancies.Upon further analysis,it was found that figures had been entered correctly and then subsequently changed,with the difference diverted to a fictitious customer account.This is an example of

A)kiting.
B)data diddling.
C)data leakage.
D)phreaking.

Question 25

A wireless network with the same name as another wireless access point is referred to as

A)sniffers.
B)zombies.
C)botsquats.
D)evil twins.

Question 26

Social engineering is

A)verifying credit card validity; buying and selling stolen credit cards.
B)inserting a sleeve into an ATM so that it will not eject the victim's card, pretending to help the victim as a means of obtaining his PIN, and using the card and PIN to drain the account.
C)a technique that tricks a person into disclosing confidential information.
D)changing data before, during, or after it is entered into the system in order to delete, alter, or add key system data.

Question 27

Inspecting information packets as they travel across computer networks are referred to as

A)sniffers.
B)zombies.
C)botsquats.
D)evil twins.

Question 28

A fraud technique that uses unauthorized codes in an authorized and properly functioning program is called the ________ technique.

A)Trojan horse
B)man-in-the-middle
C)salami
D)trap door

Question 29

After graduating from college,Rob Johnson experienced some difficulty in finding full-time employment.He free-lanced during the summer as a writer and then started a blog in the fall.Shortly thereafter he was contacted by SitePromoter Incorporated,who offered to pay him to promote their clients in his blog.He set up several more blogs for this purpose and is now generating a reasonable level of income.He is engaged in

A)splogging.
B)Bluesnarfing.
C)vishing.
D)typosquatting.

Question 30

Lebanese looping is

A)verifying credit card validity; buying and selling stolen credit cards.
B)inserting a sleeve into an ATM so that it will not eject the victim's card, pretending to help the victim as a means of obtaining his PIN, and using the card and PIN to drain the account.
C)a technique that tricks a person into disclosing confidential information.
D)changing data before, during, or after it is entered into the system in order to delete, alter, or add key system data.

Question 31

A fraud technique that slices off tiny amounts from many projects is called the ________ technique.

A)Trojan horse
B)man-in-the-middle
C)salami
D)trap door

Question 32

Computers that are part of a botnet and are controlled by a bot herder are referred to as

A)sniffers.
B)zombies.
C)botsquats.
D)evil twins.

Question 33

After graduating from college,Rob Johnson experienced some difficulty in finding full-time employment.Trying to make ends meet,Rob used all of his saving to buy a significant number of shares in small,low-priced,thinly traded penny stocks.He then uses spam e-mails and blog postings to disseminate overly optimistic information about the company in hope to drives up the company's stock price.He is waiting to sell his shares to investors and pocket a profit.He is engaged in

A)internet pump-and-dump.
B)Bluesnarfing.
C)vishing.
D)typosquatting.

Question 34

Redirecting traffic to a spoofed website to obtain confidential information is known as

A)pharming.
B)cyber-bullying.
C)hacking.
D)vishing.

Question 35

Using computer technology to harm another person is known as

A)pharming.
B)cyber-bullying.
C)hacking.
D)vishing.

Question 36

In the 1960s,techniques were developed that allowed individuals to fool the phone system into providing free access to long distance phone calls.The people who use these methods are referred to as

A)phreakers.
B)hackers.
C)hijackers.
D)superzappers.

Question 37

A fraud technique that uses a back door into a system that bypasses normal system controls is called the ________ technique.

A)Trojan horse
B)man-in-the-middle
C)salami
D)trap door

Question 38

LOLer was chatting online with l33ter."I can't believe how lame some people are! :)I can get into any system by checking out the company website to see how user names are defined and who is on the employee directory.Then,all it takes is brute force to find the password." LOLer is a ________,and the fraud he is describing is ________.

A)hacker; social engineering
B)phreaker; dumpster diving
C)hacker; password cracking
D)phreaker; the salami technique

Question 39

The unauthorized access to,or use of,a computer system is known as

A)pharming.
B)cyber-bullying.
C)hacking.
D)vishing.

Question 40

Data diddling is

A)verifying credit card validity; buying and selling stolen credit cards.
B)inserting a sleeve into an ATM so that it will not eject the victim's card, pretending to help the victim as a means of obtaining his PIN, and using the card and PIN to drain the account.
C)a technique that tricks a person into disclosing confidential information.
D)changing data before, during, or after it is entered into the system in order to delete, alter, or add key system data.

Question 41

Zeus is an example of a

A)virus.
B)worm.
C)Trojan horse.
D)war dialing.

Question 42

Mircea Vasilescu maintains an online brokerage account.In early March,Mircea received an e-mail from the firm that explained that there had been a computer error and asked Mircea to call a phone number to verify his customer information.When Mircea called the number,a recording asked that he enter the code from the e-mail,his account number,and his social security number.After he did so,he was told that he would be connected with a customer service representative,but the connection was terminated.He contacted the brokerage company and was informed that they had not sent the e-mail.Mircea was a victim of

A)Bluesnarfing.
B)vishing.
C)splogging.
D)typosquatting.

Question 43

Ashley Baker has been the webmaster for Berryhill Finance only ten days when Berryhill's website was flooded with access attempts.Ashley shut down the site and only opened it to Web addresses which she specifically identified as legitimate.As a result,many of Berryhill's customers were unable to obtain loans,causing Berryhill to lose a significant amount of business.Berryhill Finance suffered from a

A)denial-of-service attack.
B)zero-day attack.
C)phreaking attack.
D)cyber-extortion attack.

Question 44

Describe the various form of spoofing.Select one type of spoofing and search for an actual case about the spoofing.Discuss what has happened and provide recommendations as to how the spoofing could have been prevented.

Question 45

On the weekends,Mary Andersen climbs into her Toyota Camry and drives around the city of Las Vegas looking for unprotected wireless networks to exploit.Mary is most likely engaging in

A)snarfing.
B)Wi-pilfering.
C)war driving.
D)data slurping.

Question 46

Hunter Carr is an accountant with AcctSmart.The firm has a very strict policy of requiring all users to change their passwords every sixty days.In early March,Hunter received an e-mail claiming that there had been an error updating his password and it provided Hunter with a link to a website with instructions for re-updating his password.Something about the e-mail made Hunter suspicious,so he called AcctSmart's information technology department and found that the e-mail was fictitious.The e-mail was an example of

A)social engineering.
B)piggybacking.
C)spamming.
D)phishing.

Question 47

Jim Cooper decided to do some Christmas shopping online.He visited Amazon.com,found a perfect gift for his daughter,and placed his order.It was only later when he noticed that the website's URL that he had placed the order was actually Amazom.com and not Amazon.com.Jim was a victim of

A)Bluesnarfing.
B)splogging.
C)vishing.
D)typosquatting.

Question 48

Illegally obtaining and using confidential information about a person for economic gain is known as

A)eavesdropping.
B)identity theft.
C)packet sniffing.
D)piggybacking.

Question 49

Which method of fraud is physical in its nature rather than electronic?

A)cracking
B)hacking
C)eavesdropping
D)scavenging

Question 50

Ashley Baker has been the webmaster for Berryhill Finance only ten days when Berryhill's website was scheduled for a routine security patch update.Unbeknown to Ashley,cybercrooks found out the timing of the patch update and launched attacks right before Berryhill's update from a remote location miles away.As a result of the attack,Berryhill lost a significant amount of clients' private information.Berryhill Finance suffered from a

A)hacking attack.
B)zero-day attack.
C)identity theft attack.
D)cyber-extortion attack.

Question 51

Jerry Schneider was able to amass operating manuals and enough technical data to steal $1 million of electronic equipment by

A)scavenging.
B)skimming.
C)Internet auction fraud.
D)cyber extortion.

Question 52

Recall that students used Facebook and VKontakte to identify Russian money laundering mules.What fraud case did these students help foil?

A)Zeus
B)Trident Breach
C)Nigerian Banking
D)InfraGard

Question 53

Which of the following is the easiest method for a computer criminal to steal output without ever being on the premises?

A)dumpster diving
B)use of a Trojan horse
C)using a telescope to peer at paper reports
D)electronic eavesdropping on computer monitors

Question 54

Ashley Baker has been the webmaster for Berryhill Finance only ten days when she received an e-mail that threatened to shut down Berryhill's website unless Ashley wired payment to an overseas account.Ashley was concerned that Berryhill Finance would suffer huge losses if its website went down,so she wired money to the appropriate account.The author of the e-mail successfully committed

A)a denial-of-service attack.
B)Internet terrorism.
C)hacking.
D)cyber-extortion.

Question 55

It was late on a Friday afternoon when Chloe Pike got a call at the help desk for Taggart Corp.A man with an edge of panic in his voice was on the phone."I'm really in a bind and I sure hope that you can help me." He identified himself as Joe Andrew from the accounting department of Taggart Corp.He told Chloe that he had to work on a report that was due on Monday morning and that he had forgotten to bring a written copy of his new password home with him.Chloe knew that Taggart's new password policy required that passwords be at least fifteen characters long,must contain letters and numbers,and must be changed every sixty days,had created problems for many users.Consequently,Chloe provided the password to Joe.The caller turned out not to be Joe Andrew,and Chloe was a victim of

A)phreaking.
B)war dialing.
C)identity theft.
D)social engineering.

Question 56

When a computer criminal gains access to a system by searching through discarded records,this is referred to as

A)data diddling.
B)dumpster diving.
C)eavesdropping.
D)data squatting.

Question 57

Offering a free website,then charging the phone bills of the individuals who signed up for the free website is known as

A)snarfing.
B)web cramming.
C)podpounding.
D)e-scraping.

Question 58

Describe at least six computer attacks and abuse techniques.

Question 59

Ashley Baker works in the information technology department of Core Company.On Monday morning,she arrived at work,scanned her identity card,and entered her access code.At that moment,a man in a delivery uniform came up behind Ashley with a bunch of boxes.Although Ashley held the door for the delivery man,she later wondered if the man was engaged in

A)pretexting.
B)piggybacking.
C)posing.
D)spoofing.

Question 60

Maureen Boyd was arrested in Kansas City for running an online business that specialized in buying and reselling stolen credit card information.Maureen was charged with

A)typosquatting.
B)carding.
C)pharming.
D)phishing.

Question 61

On a Friday evening you use a bar's ATM to withdraw $50 from your bank account.However,as you complete your withdrawal,your card gets jammed in the ATM machine.The individual waiting in line behind you approaches you and suggests re-entering your PIN number.You do.However,your card remains jammed.You leave the bar to call your bank to report the incident.However,after you left the individual who offered to help you removed a sleeve he inserted in the ATM to jam your card.He now has your ATM card and PIN number.You just fell victim to a ________ fraud.

A)tabnapping
B)Lebanese looping
C)phishing
D)pharming

Question 62

A ________ is similar to a ________,except that it is a program rather than a code segment hidden in a host program.

A)worm; virus
B)Trojan horse; worm
C)worm; Trojan horse
D)virus; worm

Question 63

What is social engineering? Provide an example.

Question 64

Which of the following is not an example of social engineering?

A)Developing phony websites with names and URL addresses very similar to legitimate websites in order to obtain confidential information.
B)Setting up a computer that allows the user to use a next door neighbor's unsecured wireless network
C)Using e-mail to request others into revealing their user IDs and passwords.
D)Obtaining another person's credit card number without consent.

Question 65

A set of unauthorized computer instructions in an otherwise properly functioning program is known as a

A)logic bomb.
B)spyware.
C)trap door.
D)Trojan horse.

Question 66

Changing data before or during entry into a computer system to delete,alter,add,or incorrectly update data is called a

A)virus.
B)logic bomb.
C)trap door.
D)data diddle.

Question 67

Executable code that attaches itself to software,replicates itself,and spreads to other systems or files.When triggered,it makes unauthorized alterations to the way a system operates,which is called a

A)virus.
B)logic bomb.
C)trap door.
D)data diddle.

Question 68

Identify theft has always been a federal crime.

Question 69

A back door into a system that bypasses normal system controls is called a

A)virus.
B)logic bomb.
C)trap door.
D)data diddle.

Question 70

Which of the following websites likely poses the most fraud and security risk?

A)Your school's website
B)A file sharing website
C)A social media website
D)Your personal website

Question 71

Describe ways to help minimize social engineering.

Question 72

A fraud technique that allows a perpetrator to bypass normal system controls and enter a secured system is called

A)superzapping.
B)data diddling.
C)using a trap door.
D)piggybacking.

Question 73

Which of the following is not a human trait social engineers take advantage of to entice people to reveal information they should keep confidential?

A)Compassion
B)Sloth
C)Sex Appeal
D)Authority

Question 74

Pretexting is best described as a social engineering technique that uses

A)text messages to gain sensitive information.
B)an invented scenario to gain sensitive information.
C)threat of physical force to gain sensitive information.
D)impersonation of somebody you know to gain sensitive information.

Question 75

Spyware is

A)software that tells the user if anyone is spying on his computer.
B)software that monitors whether spies are looking at the computer.
C)software that monitors computing habits and sends the data it gathers to someone else.
D)none of the above

Question 76

A part of a program that remains idle until a specified date or event activates it to cause havoc is called a

A)virus.
B)logic bomb.
C)trap door.
D)data diddle.

Question 77

The unauthorized use of special program that bypass regular system controls to perform illegal acts is called

A)a Trojan horse.
B)a trap door.
C)the salami technique.
D)superzapping.

Question 78

Computer fraud perpetrators that modify programs during systems development,allowing access into the system that bypasses normal system controls are using

A)a Trojan horse.
B)a trap door.
C)the salami technique.
D)superzapping.

Question 79

Someone knocked on your door on a Friday afternoon.When you answered the door,a man dressed in a city official uniform approached you and introduced himself to you.The man said,"Hi,I am Andrew from the city public work department.We are updating our system and would like to obtain just a few piece of information from you." He proceeded to ask you several questions and obtained your driver license information and the last 4 digits of your social security number.As the man left your front porch,you saw that he was getting into his car which does not bear the city official logo.You later called the city public work department and found that they have no knowledge of a worker named Andrew and that they did not send anyone out to collect your information.You just fell victim to a ________ fraud.

A)pretexting
B)pharming
C)phishing
D)posing

Question 80

Describe at least four social engineering techniques.Provide an example for one of the techniques.