Physical social engineering: tailgating and baiting

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A stranger walks closely behind an employee and slips through a secure door before it closes. What is this called?

A Tailgating

B Phishing

2. Someone leaves an infected USB drive in a school car park, hoping a person will plug it in. What is this attack?

A Baiting

B Tailgating

3. Which is the safest thing to do with a USB drive you find on the ground?

A Plug it in to see who owns it

B Hand it to IT or security without plugging it in

4. A visitor says 'Can you hold the door? I forgot my pass.' What should you do?

A Hold the door open to be helpful

B Politely direct them to reception to be signed in

5. Which statement about tailgating and baiting is true?

A Both trick people into giving physical access

B Both only happen through email links

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1tailgating		AHolding the door open allows tailgating. The person should be sent to reception or asked to use their own pass.
2baiting with a USB drive		BUSB drive labelled 'Exam Results' left in car park
3An attacker who sees a student swipe a pass joins them at the door. This is how tailgating gives physical access.		CFollowing an authorised person through a secure door without using your own pass or key.
4An attacker wants someone to run malware, so they leave a USB drive labelled 'Exam Results' in the school car park.		Dwalk in behind the staff member before the door closes
5Found a USB drive in the car park, so plug it into a school computer to see who owns it.		EPlugging in an unknown USB drive could install malware. It should be handed to IT or security staff without being plugged in.
6A stranger says they forgot their pass, so hold the secure door open and let them follow you in.		FLeaving an infected USB drive somewhere obvious so a curious person plugs it into their computer.

Definitions

tailgating and baiting

Fill in the Blanks

Complete each line of code by filling in the missing parts.

if badgeValid ___ peopleThrough == 1: openDoor()

if usbSource __ "unknown": quarantine(usb)

___ person in behindMe: if person.watching: coverScreen()

usbFound = True if usbFound: _____("Hand it to IT. Do not plug in!")

caller = "IT support" if caller == "IT support" and ___ verified: refuseEntry()

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A badge ← scan(staff)

B door ← open

C stranger ← follow(staff)

D attack ← 'baiting'

Question 2

A usb ← infected_drive()

B leave(usb, car_park)

C staff ← pick_up(usb)

D plug_in(work_pc, charger)

Question 3

A stranger ← near(screen)

B IF stranger = true

C uncover(keypad)

D type(pin)

Question 4

A caller ← 'IT helper'

B story ← 'fix your account'

C give(victim, 'password')

D PRINT 'Pretexting'

Question 5

A visitor ← at(door)

B IF visitor has a badge

C call(reception)

Answer Key

Physical social engineering: tailgating and baiting

Section A: Quick Questions

A — Tailgating

A — Baiting

B — Hand it to IT or security without plugging it in

B — Politely direct them to reception to be signed in

A — Both trick people into giving physical access

Section B: Match the Pairs

tailgating → Following an authorised person through a secure door without using your own pass or key.

baiting with a USB drive → Leaving an infected USB drive somewhere obvious so a curious person plugs it into their computer.

An attacker who sees a student swipe a pass joins them at the door. This is how tailgating gives physical access. → walk in behind the staff member before the door closes

An attacker wants someone to run malware, so they leave a USB drive labelled 'Exam Results' in the school car park. → USB drive labelled 'Exam Results' left in car park

Found a USB drive in the car park, so plug it into a school computer to see who owns it. → Plugging in an unknown USB drive could install malware. It should be handed to IT or security staff without being plugged in.

A stranger says they forgot their pass, so hold the secure door open and let them follow you in. → Holding the door open allows tailgating. The person should be sent to reception or asked to use their own pass.

Section C: Definitions

tailgating and baiting — Tricks that gain physical access: tailgating follows an authorised person through a secure door, and baiting leaves an infected USB drive for someone to plug in.

Section D: Fill in the Blanks

if badgeValid and peopleThrough == 1:
    openDoor()

if usbSource == "unknown":
    quarantine(usb)

for person in behindMe:
    if person.watching:
        coverScreen()

usbFound = True
if usbFound:
    print("Hand it to IT. Do not plug in!")

caller = "IT support"
if caller == "IT support" and not verified:
    refuseEntry()

Section E: Spot the Error

D — A stranger who follows staff through a secure door is tailgating. Baiting uses a bait item such as an infected USB drive. The line should be attack ← 'tailgating'.

D — In baiting, the victim plugs in the infected USB drive. Plugging in a charger would not infect the computer. The line should be plug_in(work_pc, usb).

C — To stop shoulder surfing, you cover the keypad so nobody can see your PIN. Uncovering it helps the watcher. The line should be cover(keypad).

C — In pretexting the attacker uses a made-up story to ask the victim for information. The attacker asks for the password, not gives it. The line should be ask(victim, 'password').

B — The check should catch visitors with no badge so reception can confirm who they are. Checking for a badge calls reception for the wrong people. The line should be IF visitor has no badge.