Physical Vulnerabilities and Attacks
Introduced| English | Meaning |
|---|---|
| piggybacking/ˈpɪɡɪbækɪŋ/ | piggybacking |
| tailgating/ˈteɪlɡeɪtɪŋ/ | tailgating |
| shoulder surfing/ˈʃəʊldə ˈsɜːfɪŋ/ | shoulder surfing |
| dumpster diving/ˈdʌmpstə ˈdaɪvɪŋ/ | dumpster diving |
| card cloning/kɑːd ˈkləʊnɪŋ/ | card cloning |
| keylogger/ˈkiːlɒɡə/ | Software or hardware that records keystrokes entered on a device. |
| foothold/ˈfʊthəʊld/ | An initial point of access or control that an attacker establishes within a target environment. |
Attacks that walk in
- Piggybacking 尾随（获许可）: tricking someone into holding a door open.
- Tailgating 尾随（未察觉）: slipping in behind someone without their knowledge.
- Shoulder surfing 肩窥: watching someone type a password.
More physical tricks
- Dumpster diving 翻垃圾搜集情报: searching trash for useful information.
- Card cloning 门禁卡复制: copying an access card to enter.
- With access, an adversary can steal data or plug in a keylogger 键盘记录器.
A padlock on a chain: physical security is the first layer— locks, doors and barriers matter
Name the physical attack
Piggybacking tricks a person into helping; tailgating is unnoticed; shoulder surfing watches; dumpster diving searches trash.
Slipping through a secured door behind someone WITHOUT their knowledge is...
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Tailgating = unnoticed; piggybacking = with consent.
Searching a target's trash for useful information is called dumpster ____.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Dumpster diving mines trash for clues.
Which physical attacks rely on social engineering? (Choose all)
Difficulty 2/5 · 140 coins + a small bonus on first completion today
A power surge is not social engineering.
Rating physical risk
- High: sensitive systems in a space with no controlled access.
- Moderate: an unimportant area that is a foothold 立足点 to reach more.
- Low: a worthless asset unlikely to be attacked.
The most careful digital security fails if an adversary can physically touch the device. Physical access lets them bypass firewalls, plug in malware, or simply carry the machine away.
A server with sensitive data in an unlocked, unmonitored room is what risk?
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Sensitive + no access control = high risk.
Physical access to a device can let an adversary bypass many digital controls.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Physical access defeats firewalls and more.
An attacker carries a large box to a locked office door. A helpful employee opens it for them — that is piggybacking. If the attacker instead slips in unseen behind the employee, it is tailgating.
Physical attacks often start with social engineering: piggybacking, tailgating, shoulder surfing, dumpster diving, card cloning. Rate risk high when sensitive systems lack access control and moderate when an area is a foothold to more.