In this lesson,
we're going to discuss various surveillance techniques
that threat actors might use to gather information
or gain unauthorized access to your systems.
These techniques include surveillance, eavesdropping,
shoulder surfing, and dumpster diving.
It's important as a penetration tester
or security professional to understand these methods
so you can develop strategies
to better mitigate these threats too.
Now, first we have surveillance,
and surveillance involves monitoring a target
to gather information without their knowledge.
This can include physical surveillance
where an attacker observes a person or a location
to learn about routines, security measures,
and potential vulnerabilities.
For example, an attacker might watch an office building
to note the times when employees arrive and leave,
the security procedures at the entrances,
and any weaknesses in physical security
such as unguarded doors or windows.
Second, we have eavesdropping.
Now, eavesdropping is the act of secretly listening
to private conversations
usually in order to gain information
that is not intended for public knowledge.
This can be done through various means,
including bugging devices, intercepting phone calls,
or even positioning oneself close enough
to overhear a conversation.
For instance, an attacker might place a hidden microphone
in a conference room to listen in
on confidential business discussions
while they're hoping to gather sensitive information
such as financial data or strategic plans.
Third, we have shoulder surfing.
Now, shoulder surfing involves
looking over somebody's shoulder
to see information on their screen
or when they're entering sensitive information like a PIN
or password on the keyboard.
Now, this can happen in public places like cafes, airports,
or even within an office.
A great example of shoulder surfing
is when an attacker sits close enough to somebody
at a coffee shop
and watches them type in their logging credentials
onto their laptop.
This is a simple, yet effective technique
that can really provide an attacker with access
to personal accounts or corporate systems
if you're not careful.
Fourth, we have dumpster diving.
Now, dumpster diving is the practice of searching
through the trash to find discarded items
that could be valuable, such as documents, hardware,
or other materials that contain sensitive information.
Attackers often target dumpsters
outside of office buildings,
and they're looking for items
like printed emails, memos, financial statements,
or even old computers and storage devices.
For example, an attacker might find an old hard drive
in a trash can that contains unencrypted customer data,
and they can then use that to further exploit
that company or its customers.
So remember, there are lots of different types
of surveillance techniques, including eavesdropping,
shoulder surfing, and dumpster diving,
and these are commonly used by attackers
to gather information and exploit your vulnerabilities.
By being aware of these methods,
you're going to be able to take proactive steps
to secure your environment,
such as implementing stricter access controls,
regularly training your employees
on best security practices,
and ensuring sensitive information
is properly being destroyed.
By being vigilant against these surveillance techniques,
you can help to protect your organization's sensitive data
and better maintain its overall security.