Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

1
vote
1answer
41 views

Could I counter SiteKey MitM attack with user-agent identification?

I find it very strange that bank use service like SiteKey without user-agent identification. This still makes them very vulnerable to MitM attack which is exactly what they are trying to protect ...
32
votes
5answers
5k views

Are there actions taken against websites that deliver malware?

There are serious tools and services such as Google Safe Browsing for malicious and phishing websites, and others fully dedicated to phishing websites such as Phishing.org. What is done against these ...
1
vote
1answer
51 views

Prevent someone from using your site for phishing?

So I have a site where users can create online surveys and send them out to whomever they like. Over the past few months we have seen an uptick in one particular user who creates an account, then ...
2
votes
1answer
211 views

Is this Facebook email real or phishing?

I received this email from what is supposedly Facebook today. Here's a screenshot: I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate ...
0
votes
0answers
103 views

Apple ID phishing lead to my router infected?

For future visitors, I will try to be as general as possible, but I must include details to give you a full picture. As my Apple ID's security email address belongs to my brother, he forwarded an ...
2
votes
2answers
60 views

Anti-phishing educational resources for users?

I'm am looking into conducting a phishing campaign to gauge how susceptible my workplace is to phishing attacks. Part of this will involve guiding "duped" users to materials or resources that will ...
2
votes
2answers
123 views

Is my PC safe? need help

About 6 days ago my parents who aren't great with PCs got phished on gmail, and the account started spreading spam. It had been hacked on an Argentinian IP, and then logged in from IMAP and SMTP from ...
2
votes
1answer
100 views

How to detect if a user is logged in to a specific website?

I just learn about tabnabbing. Tabnabbing is a computer exploit and phishing attack, which persuades users to submit their login details and passwords to popular websites by impersonating ...
1
vote
4answers
112 views

What to do after a co-worker has been phished?

One of our co-workers followed a phishing link and entered their Google for Business account credentials. We have reset their password, is there anything else we need to do? (We also used this as a ...
0
votes
2answers
93 views

website hacked - phishing form

My Drupal 7.28 site has been hacked through the the tmp dir which was not protected by .htaccess file. The hacker managed to delete the main .htaccess file and upload some bogus google docs 2014 ...
2
votes
1answer
66 views

Is asking for credentials from a separate trusted domain an acceptable practice?

I know of at least two pages that I would have just assumed were a phishing scheme if I didn't know any better. Serverfault.com is a stack exchange site on a different domain, however if you click to ...
0
votes
2answers
109 views

PayPal phishing attempt?

[This is a "soft" question and as such I'm not sure it's appropriate for this site. However, it does involve information security.] I have an email address, me@gmail.com that is not associated with ...
0
votes
1answer
61 views

How can clicking a link in a Facebook users news feed compromise their account [closed]

I've been confused about how it is possible to compromise a Facebook user's account simply if that user clicks a link. Recently a friend of mine on Facebook posted a series of links to what appeared ...
0
votes
2answers
56 views

Pionee Red: Is this a Phishing attack? What should we do?

I have just received an email from a close friend, which had "Pionee Red" as the subject, and the following body: you've a new private message from your friend Click To View The Full Message As I ...
2
votes
1answer
79 views

Crawling for Phishing Websites

OBJECTIVE: We have a requirement to run active scan for detecting and monitor phishing websites for a particular brand. We want to be as real-time as possible. That would mean that using sites like ...
0
votes
3answers
158 views

Next steps to get rid of malware?

My father in law just had a problem,He clicked on a link in an email (he was using gmail on the version 35.0.1916.114m of Chrome), and suddenly the computer sort of went black, and possibly something ...
5
votes
1answer
183 views

What can happen if someone gets a hold of a scan of someone else's passport?

Or: "Do I need to be concerned about emailing people scans of my passport if they want to verify my identity?" Is there anything anyone can do with the information on the main page of the passport ...
-2
votes
2answers
66 views

What is this site? [closed]

I was reading an article which included an anecdote of someone who had nearly fallen for a phishing attack which: established a mock Halifax.co.uk website which replaced forward slashes in the ...
41
votes
3answers
8k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from service@intl.paypal.com, with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
1
vote
2answers
335 views

Phishing with links to real site (facebook) - what could they possibly gain? [closed]

I was sent an innocuous and genuine looking e-mail with "Welcome back to Facebook" from the address "notification+mnqx54sr@facebookmail.com". I deactivated my account long ago, so was a tad surprised. ...
1
vote
2answers
109 views

How does anti-phishing software work to identify phishing sites?

To clarify, my question isn't on how to protect myself from phishing. What I'm curious about is how exactly software can identify whether or not a website is designed for phishing, ignoring word ...
1
vote
1answer
197 views

how secure is javascript based oauth2.0

Javascript based oauth exposes the client id of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a dns hijack(or a virus affecting ...
1
vote
0answers
85 views

Preventing access to my public REST api from my trusted client application

I own a set of REST APIs and some of them don't require users to be authenticated. Example could be: api/items/index of an e-commerce". Currently, I use Cookie-based tokens from my application, but ...
1
vote
1answer
190 views

How can this be possible? (malware autoinstall on chrome)

I have a website, using an ads service (qadabra). Yesterday some users reported me that the ads service sometimes redirects to a site containing malware. the url is this: PLEASE DON'T OPEN IT, IT ...
3
votes
2answers
141 views

How can users be sure the browser's URL bar is not faked?

For a user to defend against something like Don't understand how my mum's Gmail account was hacked , they should pay attention to URL bar before typing their credentials. But how can you make ...
122
votes
9answers
24k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
152
votes
3answers
20k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
3
votes
1answer
61 views

Google Chrome Apps phishing

What prevents an attacker from copying and pasting a Chrome packaged app (which is just a zipped web app) then distributing it on the Chrome webstore under a slightly different name?
12
votes
3answers
4k views

Apparently PayPal-affiliated site with very suspect security

History I got an email this afternoon to my gmail from "paypal@e.paypal.com" with mailed-by: na.e.paypal.com and signed-by: e.paypal.com. Gmail did not report it as spam/phishing/suspicious and it ...
0
votes
2answers
179 views

How do fake emailers work?

Our University recently had a case where some notorious fellows used a fake emailing service to send an email to all students on behalf of the administration. Although most good email services (like ...
-3
votes
1answer
97 views

Meaning of webpage link containing www23 [closed]

I have come across a number of websites which include links such as www32.example.com and also www2.example.com. Why is there a number in the www part of the link? Are these sites not legitimate? ...
-1
votes
2answers
152 views

Hotmail security

Recently I've been receiving in my SPAM folder, SPAM mails sent "by me". With "By me" I mean, that I am not sure if those are really sent from me. It has been happening since December, at around one ...
8
votes
4answers
286 views

Best practice for informing a website they've been compromised?

I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek ...
3
votes
1answer
311 views

I accidentally installed an adware filled Firefox [solved]

I installed Firefox using a download site, rather than the correct site. After running and installing Firefox I noticed my Chrome had an addon called swift browser added to it by a third party. After ...
0
votes
1answer
201 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
4
votes
1answer
171 views

Is this a phishing attempt? if yes where to report?

I received strange email from co-worker, asking me to click the link. I did eventually follow the link, but thought putting in my gmail user/pass wasn't wise. What do you think? is this phishing ...
1
vote
3answers
241 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
0
votes
2answers
181 views

Can you trust the URL shown when 'hovering' on a link? [duplicate]

When using a modern web browser, if you hover on a link, the browser will show you the link in a little display on the bottom left corner of the browser screen. Can I trust this? Can this display be ...
1
vote
3answers
185 views

Are subdomains a cure for phishing?

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
-1
votes
1answer
71 views

Subdomains a possible defense against phishing [duplicate]

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
0
votes
2answers
333 views

Exploiting an Open Redirect in POST body?

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after ...
3
votes
1answer
2k views

A “new domain registration” spam?

About 6 days ago I purchased a new domain under .org TLD from a local registrar. Few days later, I have received this strange message (which BTW fell to Gmail spam bin), which looks like some kind of ...
4
votes
5answers
703 views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
3
votes
2answers
483 views

URL & address bar spoofing, only possible on rogue access point

Have been playing around with the whole DNS spoofing thing. How can a rogue/phishing URL be masked with a legitimate URL in the address bar (without using images)? I was under the impression that this ...
6
votes
1answer
264 views

Google Chrome & Spear-phishing

I've been trying to find some information on how Google Chrome detects phishing pages that are not already in their blacklists. The most relevant information that I've found from Google itself, ...
2
votes
1answer
368 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
0
votes
2answers
92 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
2
votes
2answers
12k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
21
votes
4answers
732 views

Security seals and the “perception of safety”?

I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...
1
vote
3answers
320 views

Anti-Phishing Campaign Objective

At every office I have worked, links and files, both internal and external, are shared in emails. Is the objective of an anti-phishing campaign that users never click on blind, or otherwise ...