Understanding Social Engineering · 理解社会工程学
| English | 中文 | Pinyin · 拼音 |
|---|---|---|
| person/ˈpɜːsn/ | 人 | rén |
| social engineering/ˈsəʊʃl ˌendʒɪˈnɪərɪŋ/ | 社会工程学 | shè huì gōng chéng xué |
| adversary/ˈædvəsəri/ | 对手 | duì shǒu |
| elicitation/ɪˌlɪsɪˈteɪʃn/ | 套取信息 | tào qǔ xìn xī |
| intimidation/ɪnˌtɪmɪˈdeɪʃn/ | 恐吓 | kǒng hè |
| urgency/ˈɜːdʒənsi/ | 紧迫感 | jǐn pò gǎn |
| impersonate/ɪmˈpɜːsəneɪt/ | 冒充 | mào chōng |
| one-time password/wʌn taɪm ˈpæswɜːd/ | 一次性密码 | yí cì xìng mì mǎ |
| malware/ˈmælweə/ | 恶意软件 | è yì ruǎn jiàn |
Fooling the human, not the code
- The weakest part of a system is often the person using it.
- Social engineering 社会工程学 tricks people into breaking security.
- The attacker — the adversary 对手 — fools a person instead of hacking the machine.
欺骗人，而不是代码
- 系统最薄弱的部分常常是使用它的人(person)。
- 社会工程学(social engineering)诱骗人们破坏安全。
- 攻击者——对手(adversary)——欺骗一个人,而不是攻破机器。
How it reaches you
- Most attacks come by email, text, or social media.
- The goal is elicitation 套取信息 — getting secrets out of you.
- It can also happen in person or over the phone.
它如何找到你
- 大多数攻击通过电子邮件(email)、短信或社交媒体到来。
- 目标是套取信息(elicitation)——从你那里获得秘密。
- 它也可能面对面或通过电话发生。
Which social-engineering tactic is it? · 这是哪种社会工程战术？
Intimidation threatens harm; urgency invents a deadline; consensus claims everyone else acted; authority borrows power. · 恐吓威胁伤害；紧迫性虚构截止日期；共识声称其他人已行动；权威借用权力。
What is the main goal of social engineering? · 社会工程学的主要目标是什么？
Social engineering targets the human, not the code. · 社会工程学针对的是人，而非代码。
"Reply in the next 10 minutes or lose access" mainly uses which tactic? · "在接下来10分钟内回复否则失去访问权"主要使用了哪种战术？
A tight deadline creates urgency. · 紧迫的截止日期制造紧迫感。
Which are common social-engineering pressure tactics? (Choose all) · 哪些是常见的社会工程施压战术？（多选）
Encryption is a defense, not a pressure tactic. · 加密是一种防御手段，不是施压战术。
Two powerful feelings
- Intimidation 恐吓 threatens a bad result so fear makes you obey.
- Urgency 紧迫感 invents a deadline so you act without thinking.
- Other tactics: authority, consensus, scarcity, familiarity.
两种强大的情绪
- 恐吓(intimidation)威胁坏结果,让恐惧使你服从。
- 紧迫感(urgency)编造一个截止时间,让你不加思考就行动。
- 其他手段:权威、从众、稀缺、熟悉感。
When a message makes you feel rushed or scared, slow down. That feeling is exactly the pressure an adversary wants — stop and check before you click or reply.
当一条消息让你感到匆忙或害怕时,请慢下来。那种感觉正是对手想要的压力——在点击或回复前先停下来核实。
Giving an adversary your pet's name and birthday could help them impersonate you. · 给攻击者你的宠物名字和生日可能帮助他们冒充你。
That info often answers security challenge questions. · 这些信息通常能回答安全挑战问题。
Secret software that steals data after you click a bad link is called . · 点击恶意链接后窃取数据的秘密软件称为。
Malware · 恶意软件 = malicious software. · 恶意软件 (Malware) = 恶意软件。
Match each tactic to its trick. · 将每种战术与其欺骗手段匹配。
Each tactic exploits a different human instinct. · 每种战术利用不同的人类本能。
What the victim loses
- They may reveal personal info used to impersonate 冒充 them.
- They may hand over a one-time password (OTP) 一次性密码.
- They may download malware 恶意软件 that steals data.
受害者会失去什么
- 他们可能泄露被用来冒充(impersonate)自己的个人信息。
- 他们可能交出一次性密码(one-time password)。
- 他们可能下载窃取数据的恶意软件(malware)。
An email says: "Your account will be locked in 1 hour — click here to verify." That single sentence uses urgency (1 hour) and intimidation (locked). Both push you to click before thinking.
一封邮件写道:"您的账户将在1小时内被锁定——点击此处验证。"这一句话同时使用了紧迫感(1小时)和恐吓(锁定)。两者都在推动你不加思考就点击。
Social engineering attacks the human with psychological pressure — mainly intimidation and urgency — to make a victim reveal secrets, hand over a password, or run malware. The defense is to slow down and verify.
社会工程学用心理压力攻击人——主要是恐吓和紧迫感——让受害者泄露秘密、交出密码或运行恶意软件。防御方法是慢下来并核实。