312-50 Question 222
Single answer▪ Identity TheftDuring an internal security assessment, a company reports that several employees received emails appearing to come from the HR department asking them to "re-verify payroll details" through a link to a cloned login page. Within hours, attackers used captured credentials and personal data to access the payroll portal and change direct-deposit information. As the ethical hacker documenting the attack chain, which technique most directly enabled the identity theft that led to the payroll fraud?
- A
Phishing with a spoofed HR message leading victims to a credential-harvesting site
- B
SQL injection against the payroll database to directly alter employee bank account records
- C
A denial-of-service attack against the HR portal to force employees to use backup procedures
- D
Wireless deauthentication followed by WPA cracking to capture payroll traffic in transit
Show answer and explanation
Correct answer: A
Explanation
The best answer is phishing with a spoofed HR message leading to a credential-harvesting site. In identity theft incidents, attackers commonly impersonate trusted internal departments such as HR, payroll, or IT support to convince users to disclose usernames, passwords, and personally identifiable information (PII). Once attackers possess both credentials and identifying details, they can impersonate victims in downstream systems, as occurred here when direct-deposit details were changed. This aligns with common guidance from NIST on digital identity and phishing-resistant practices, as well as CISA recommendations on recognizing and defending against phishing and credential theft. From a CEH perspective, the scenario tests recognition of how social engineering is used to facilitate identity theft in a real enterprise workflow, rather than focusing on unrelated technical attacks such as SQL injection, DoS, or wireless exploitation.
- A. Correct.
Correct. The scenario describes a classic phishing attack: users received a fraudulent message impersonating HR and were directed to a cloned login page where credentials and personal information were captured. That stolen identity information was then used to impersonate legitimate employees and access the payroll portal. In CEH terms, this is a social engineering technique directly tied to identity theft because the attacker obtained enough identifying and authentication data to act as the victims.
- B. Incorrect.
Incorrect. SQL injection can be used to manipulate backend data if an application is vulnerable, but the scenario specifically states that attackers used captured credentials and personal data after sending employees to a cloned login page. That indicates credential harvesting and impersonation rather than direct exploitation of the payroll application's database layer.
- C. Incorrect.
Incorrect. A denial-of-service condition may disrupt service availability, but it does not by itself explain how attackers obtained employee identities or credentials. This option is plausible because attackers sometimes combine disruption with deception, but the key technique in the scenario is impersonation of HR and harvesting user data, not service exhaustion.
- D. Incorrect.
Incorrect. Wireless deauthentication and WPA cracking are wireless attack techniques aimed at disrupting or gaining access to Wi-Fi networks. They do not match the described attack path of fraudulent emails, cloned portals, and stolen employee identity data. Someone might choose this if focusing on credential capture generally, but the scenario clearly points to email-based social engineering.