Physical Vulnerabilities and Attacks · 物理漏洞与攻击
| English | 中文 | Pinyin · 拼音 |
|---|---|---|
| piggybacking/ˈpɪɡɪbækɪŋ/ | 尾随（获许可） | wěi suí （ huò xǔ kě ） |
| tailgating/ˈteɪlɡeɪtɪŋ/ | 尾随（未察觉） | wěi suí （ wèi chá jué ） |
| shoulder surfing/ˈʃəʊldə ˈsɜːfɪŋ/ | 肩窥 | jiān kuī |
| dumpster diving/ˈdʌmpstə ˈdaɪvɪŋ/ | 翻垃圾搜集情报 | fān lā jī sōu jí qíng bào |
| card cloning/kɑːd ˈkləʊnɪŋ/ | 门禁卡复制 | mén jìn kǎ fù zhì |
| keylogger/ˈkiːlɒɡə/ | 键盘记录器 | jiàn pán jì lù qì |
| foothold/ˈfʊthəʊld/ | 立足点 | lì zú diǎn |
Attacks that walk in
- Piggybacking 尾随（获许可）: tricking someone into holding a door open.
- Tailgating 尾随（未察觉）: slipping in behind someone without their knowledge.
- Shoulder surfing 肩窥: watching someone type a password.
走进来的攻击
- 尾随(获许可)(piggybacking):诱骗某人为你把门开着。
- 尾随(未察觉)(tailgating):在某人不知情时跟在其后溜进去。
- 肩窥(shoulder surfing):偷看某人输入密码。
More physical tricks
- Dumpster diving 翻垃圾搜集情报: searching trash for useful information.
- Card cloning 门禁卡复制: copying an access card to enter.
- With access, an adversary can steal data or plug in a keylogger 键盘记录器.
更多物理伎俩
- 翻垃圾搜集情报(dumpster diving):在垃圾中搜寻有用信息。
- 门禁卡复制(card cloning):复制门禁卡以进入。
- 得手后,对手可以窃取数据或插入键盘记录器(keylogger)。
Name the physical attack · 命名该物理攻击
Piggybacking tricks a person into helping; tailgating is unnoticed; shoulder surfing watches; dumpster diving searches trash. · 搭便车欺骗人帮忙；尾随是不被察觉的；肩窥是偷看；翻找垃圾是搜索垃圾桶。
Slipping through a secured door behind someone WITHOUT their knowledge is... · 在未经对方知情的情况下紧跟某人穿过已锁的门是……
Tailgating = unnoticed; piggybacking = with consent. · 尾随 = 不被察觉；搭便车 = 经同意。
Searching a target's trash for useful information is called dumpster . · 在目标的垃圾桶中寻找有用信息称为翻找。
Dumpster diving mines trash for clues. · 翻找垃圾从垃圾桶中挖掘线索。
Which physical attacks rely on social engineering? (Choose all) · 哪些物理攻击依赖于社会工程学？（多选）
A power surge is not social engineering. · 电压浪涌不是社会工程学。
Rating physical risk
- High: sensitive systems in a space with no controlled access.
- Moderate: an unimportant area that is a foothold 立足点 to reach more.
- Low: a worthless asset unlikely to be attacked.
评定物理风险
- 高:敏感系统位于无受控访问的空间。
- 中:一个可作为立足点(foothold)进一步深入的不重要区域。
- 低:不太可能被攻击的无价值资产。
The most careful digital security fails if an adversary can physically touch the device. Physical access lets them bypass firewalls, plug in malware, or simply carry the machine away.
如果对手能物理接触设备,再谨慎的数字安全也会失效。物理访问让他们绕过防火墙、插入恶意软件,或直接把机器搬走。
A server with sensitive data in an unlocked, unmonitored room is what risk? · 存放敏感数据的服务器位于未上锁且无监控的房间，这是什么风险？
Sensitive + no access control = high · 高 risk. · 敏感 + 无访问控制 = 高风险。
Physical access to a device can let an adversary bypass many digital controls. · 对设备的物理访问可以让攻击者绕过许多数字控制措施。
Physical access defeats firewalls and more. · 物理访问可以击败防火墙等更多防护。
An attacker carries a large box to a locked office door. A helpful employee opens it for them — that is piggybacking. If the attacker instead slips in unseen behind the employee, it is tailgating.
攻击者抱着一个大箱子走到上锁的办公室门口。一位好心员工为他开了门——这是尾随(获许可)。如果攻击者反而在员工身后不被察觉地溜进去,那是尾随(未察觉)。
Physical attacks often start with social engineering: piggybacking, tailgating, shoulder surfing, dumpster diving, card cloning. Rate risk high when sensitive systems lack access control and moderate when an area is a foothold to more.
物理攻击常从社会工程学开始:尾随(获许可)、尾随(未察觉)、肩窥、翻垃圾、门禁卡复制。当敏感系统缺乏访问控制时评为高风险,当某区域是通往更多资源的立足点时评为中风险。