This might seem like a dumb question, but in light of a recent presidential candidate's campaign falling for a phishing attack, I wanted to ask how does phishing work in the real world as an attack vector?
From what I know, a phishing attack requires the end user to physically download and double click on an .exe file and grant it permission to run. Unless the end user has negative IQ, I don't see this realistically happening. That being said, how does an average organization get compromised by a malicious link or attachment?
I would think this has to do with more complicated things such as Drive-By Downloads and exploiting Zero Days in browsers and apps like Microsoft Outlook, but those seem to be very hard to come by. Even if that is the case, the downloaded malware script doesn't get executed. If that's the case, is there a sample attack code I could poke around with and look into to see how this stuff works?
[link] [comments]
from hacking: security in practice https://ift.tt/U2xskeO
Comments
Post a Comment