Studyledge

Cyber Security and Digital Currency: Question 6

Syllabus 5.3

Multiple choice 1 mark

A customer always logs into their bank account by typing the bank's correct web address directly into the browser, exactly as they always have, and pressing enter. One day, after typing this same correct address, the page that loads looks identical to the bank's website but is actually a convincing fake, which asks the customer to re-enter their login details and card number. No email, text message or phone call was sent to the customer beforehand.

Which cyber security threat does this describe?

Choose an answer to check it, then compare with the worked solution below.
Show worked solution Hide worked solution

Worked solution

Step 1: Identify what each candidate threat requires

  • Phishing relies on a fake email, text message or other communication that tricks the user into clicking a link to a fraudulent site or handing over details in reply.
  • Social engineering relies on directly manipulating a person, for example through a phone call or a message pretending to be from someone trustworthy.
  • A brute-force attack is an automated attempt to guess a password by trying many possibilities in turn.
  • Pharming involves malicious code, or a compromised DNS record, that silently redirects a user to a fake website even when the user types the correct, genuine web address themselves.

Step 2: Match the scenario to the correct threat

The customer did not click a link or respond to any message, they typed the bank’s own correct address, exactly as always, and pressed enter. Despite this, they were taken to a fake copy of the site. This is the defining behaviour of pharming: the redirection happens automatically, regardless of the correct address being entered, with no email, text or call needed to trick the user into acting.

Step 3: Rule out the distractors

  • Not phishing: there is no fake message the customer responded to, they used the genuine address they always use.
  • Not social engineering: no person contacted the customer or manipulated them into anything; the redirection happened silently.
  • Not a brute-force attack: no password guessing is involved at all; the threat is about which website loads, not about breaking into an account by trying passwords.

Final answer

The threat described is pharming, option B.