Physical Vulnerabilities and Attacks
| English | Chinese | Pinyin |
|---|---|---|
| piggybacking | 尾随（获许可） | wěi suí （ huò xǔ kě ） |
| tailgating | 尾随（未察觉） | wěi suí （ wèi chá jué ） |
| shoulder surfing | 肩窥 | jiān kuī |
| dumpster diving | 翻垃圾搜集情报 | fān lā jī sōu jí qíng bào |
| card cloning | 门禁卡复制 | mén jìn kǎ fù zhì |
| keylogger | 键盘记录器 | jiàn pán jì lù qì |
| foothold | 立足点 | lì zú diǎn |
Attacks that walk in
- Piggybacking 尾随（获许可）: tricking someone into holding a door open.
- Tailgating 尾随（未察觉）: slipping in behind someone without their knowledge.
- Shoulder surfing 肩窥: watching someone type a password.
More physical tricks
- Dumpster diving 翻垃圾搜集情报: searching trash for useful information.
- Card cloning 门禁卡复制: copying an access card to enter.
- With access, an adversary can steal data or plug in a keylogger 键盘记录器.
Name the physical attack
Piggybacking tricks a person into helping; tailgating is unnoticed; shoulder surfing watches; dumpster diving searches trash.
Slipping through a secured door behind someone WITHOUT their knowledge is...
Tailgating = unnoticed; piggybacking = with consent.
Searching a target's trash for useful information is called dumpster ____.
Dumpster diving mines trash for clues.
Which physical attacks rely on social engineering? (Choose all)
A power surge is not social engineering.
Rating physical risk
- High: sensitive systems in a space with no controlled access.
- Moderate: an unimportant area that is a foothold 立足点 to reach more.
- Low: a worthless asset unlikely to be attacked.
The most careful digital security fails if an adversary can physically touch the device. Physical access lets them bypass firewalls, plug in malware, or simply carry the machine away.
A server with sensitive data in an unlocked, unmonitored room is what risk?
Sensitive + no access control = high risk.
Physical access to a device can let an adversary bypass many digital controls.
Physical access defeats firewalls and more.
An attacker carries a large box to a locked office door. A helpful employee opens it for them — that is piggybacking. If the attacker instead slips in unseen behind the employee, it is tailgating.
Physical attacks often start with social engineering: piggybacking, tailgating, shoulder surfing, dumpster diving, card cloning. Rate risk high when sensitive systems lack access control and moderate when an area is a foothold to more.