Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

0
votes
2answers
542 views

PayPal phishing attempt?

[This is a "soft" question and as such I'm not sure it's appropriate for this site. However, it does involve information security.] I have an email address, me@gmail.com that is not associated with ...
0
votes
1answer
101 views

How can clicking a link in a Facebook users news feed compromise their account [closed]

I've been confused about how it is possible to compromise a Facebook user's account simply if that user clicks a link. Recently a friend of mine on Facebook posted a series of links to what appeared ...
1
vote
2answers
205 views

Pionee Red: Is this a Phishing attack? What should we do?

I have just received an email from a close friend, which had "Pionee Red" as the subject, and the following body: you've a new private message from your friend Click To View The Full Message As I ...
2
votes
1answer
122 views

Crawling for Phishing Websites

OBJECTIVE: We have a requirement to run active scan for detecting and monitor phishing websites for a particular brand. We want to be as real-time as possible. That would mean that using sites like ...
1
vote
3answers
204 views

Next steps to get rid of malware? [duplicate]

My father in law just had a problem,He clicked on a link in an email (he was using gmail on the version 35.0.1916.114m of Chrome), and suddenly the computer sort of went black, and possibly something ...
44
votes
3answers
8k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from service@intl.paypal.com, with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
-2
votes
2answers
69 views

What is this site? [closed]

I was reading an article which included an anecdote of someone who had nearly fallen for a phishing attack which: established a mock Halifax.co.uk website which replaced forward slashes in the ...
2
votes
2answers
594 views

Phishing with links to real site (facebook) - what could they possibly gain? [closed]

I was sent an innocuous and genuine looking e-mail with "Welcome back to Facebook" from the address "notification+mnqx54sr@facebookmail.com". I deactivated my account long ago, so was a tad surprised. ...
1
vote
2answers
256 views

How does anti-phishing software work to identify phishing sites?

To clarify, my question isn't on how to protect myself from phishing. What I'm curious about is how exactly software can identify whether or not a website is designed for phishing, ignoring word ...
1
vote
0answers
221 views

Preventing access to my public REST api from my trusted client application

I own a set of REST APIs and some of them don't require users to be authenticated. Example could be: api/items/index of an e-commerce". Currently, I use Cookie-based tokens from my application, but ...
1
vote
1answer
327 views

How can this be possible? (malware autoinstall on chrome)

I have a website, using an ads service (qadabra). Yesterday some users reported me that the ads service sometimes redirects to a site containing malware. the url is this: PLEASE DON'T OPEN IT, IT ...
3
votes
2answers
207 views

How can users be sure the browser's URL bar is not faked?

For a user to defend against something like Don't understand how my mum's Gmail account was hacked , they should pay attention to URL bar before typing their credentials. But how can you make ...
7
votes
3answers
3k views

If someone bought the .local TLD could that be a security risk?

Now that the ICANN is allowing custom Top Level Domain names and often corporate IT workers like to use .local as the TLD for internal networks, if someone does buy the .local TLD what are some ...
3
votes
1answer
3k views

A “new domain registration” spam?

About 6 days ago I purchased a new domain under .org TLD from a local registrar. Few days later, I have received this strange message (which BTW fell to Gmail spam bin), which looks like some kind of ...
9
votes
3answers
1k views

Is SiteKey a valid defense against Phishing?

As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. (This is a scheme where the user is shown a personalized image (each user has their own ...
3
votes
1answer
71 views

Google Chrome Apps phishing

What prevents an attacker from copying and pasting a Chrome packaged app (which is just a zipped web app) then distributing it on the Chrome webstore under a slightly different name?
0
votes
2answers
357 views

How do fake emailers work?

Our University recently had a case where some notorious fellows used a fake emailing service to send an email to all students on behalf of the administration. Although most good email services (like ...
-3
votes
1answer
172 views

Meaning of webpage link containing www23 [closed]

I have come across a number of websites which include links such as www32.example.com and also www2.example.com. Why is there a number in the www part of the link? Are these sites not legitimate? ...
8
votes
4answers
303 views

Best practice for informing a website they've been compromised?

I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek ...
-1
votes
2answers
179 views

Hotmail security

Recently I've been receiving in my SPAM folder, SPAM mails sent "by me". With "By me" I mean, that I am not sure if those are really sent from me. It has been happening since December, at around one ...
20
votes
5answers
1k views

Are address bars unphishable?

I've taken, out of curiosity, the Phishing Quiz by OpenDNS that tries to teach the general public about detecting phishing: Ever wonder how good you are at telling the difference between a ...
5
votes
6answers
18k views

Is update@em.facebookmail.com legitimate?

I'm having a hard time figuring out whether this email a friend of mine got is legit or a scam. The weird thing is there's only one link to facebook.com, which is the one about facebook terms. All the ...
3
votes
1answer
423 views

I accidentally installed an adware filled Firefox [solved]

I installed Firefox using a download site, rather than the correct site. After running and installing Firefox I noticed my Chrome had an addon called swift browser added to it by a third party. After ...
0
votes
1answer
316 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
2
votes
2answers
425 views

when you are phished, what do they get?

Lets say I was foolish enough to press on a YouTube video on Facebook that ended up being what I suspect is a phishing link. What can they potentially get? I had three tabs open: (1) my phpMyAdmin ...
4
votes
1answer
197 views

Is this a phishing attempt? if yes where to report?

I received strange email from co-worker, asking me to click the link. I did eventually follow the link, but thought putting in my gmail user/pass wasn't wise. What do you think? is this phishing ...
-1
votes
1answer
81 views

Subdomains a possible defense against phishing [duplicate]

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
1
vote
3answers
272 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
0
votes
2answers
234 views

Can you trust the URL shown when 'hovering' on a link? [duplicate]

When using a modern web browser, if you hover on a link, the browser will show you the link in a little display on the bottom left corner of the browser screen. Can I trust this? Can this display be ...
1
vote
3answers
216 views

Are subdomains a cure for phishing?

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
0
votes
2answers
642 views

Exploiting an Open Redirect in POST body?

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after ...
1
vote
2answers
220 views

Is there guidance that says all sessions to be logged off when a user changes their password?

Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active. Is ...
4
votes
5answers
1k views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
3
votes
2answers
770 views

URL & address bar spoofing, only possible on rogue access point

Have been playing around with the whole DNS spoofing thing. How can a rogue/phishing URL be masked with a legitimate URL in the address bar (without using images)? I was under the impression that this ...
6
votes
1answer
341 views

Google Chrome & Spear-phishing

I've been trying to find some information on how Google Chrome detects phishing pages that are not already in their blacklists. The most relevant information that I've found from Google itself, ...
2
votes
1answer
537 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
0
votes
2answers
94 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
22
votes
4answers
775 views

Security seals and the “perception of safety”?

I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...
3
votes
2answers
492 views

Is Yahoo SignIn Seal effective at phishing prevention? [duplicate]

Possible Duplicate: Effectiveness of Security Images Information about the efficacy of Yahoo's SignIn Seal is scarce, the best I could find was this section on Wikipedia's entry on ...
27
votes
3answers
916 views

What is this authentication method/approach called?

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
7
votes
1answer
5k views

Looking for URL Blacklists of Malicious Websites [closed]

Is there a maintained list of URLs that contain malicious content. These URLs may be involved in Phishing, Scams, Viri, or other Malware. Please indicate in your answer if the list is freely ...
1
vote
3answers
484 views

Anti-Phishing Campaign Objective

At every office I have worked, links and files, both internal and external, are shared in emails. Is the objective of an anti-phishing campaign that users never click on blind, or otherwise ...
2
votes
3answers
650 views

Report an email address being used by a phisher

A close friend fell for a phishing scam earlier today. His account's all squared up now, but I decided to do a bit of investigation. The website he fell for was a very poor imitation of a Remax site ...
2
votes
4answers
2k views

Yahoo Email Keeps Getting Phished

I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
3
votes
3answers
301 views

I stupidly responded to an email from a hacker posing as a friend

I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...
8
votes
3answers
1k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
8
votes
4answers
17k views

Reminder: Reset your password - phishing or genuine Facebook email?

An email claiming to be from facebook had the following content: Hi Andrew, You recently requested a new password for your Facebook account. It looks like we sent you an email with a link to ...
11
votes
6answers
668 views

What are effective ways to prevent targeted phishing?

Phishing is a very serious problem that we face. Popular banks are often the biggest targets. What methods can a bank website use to protect its self from phishing attacks? What security systems ...
0
votes
2answers
251 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
6
votes
2answers
2k views

Will reporting phishing emails cause problems for the victim?

On GMail, I've received a phishing email from someone I know, and the email has been sent to other people the victim knows. One of the emails is claiming to be from their GMail address, while the ...