Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

131
votes
9answers
49k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
165
votes
3answers
26k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
3
votes
1answer
68 views

Google Chrome Apps phishing

What prevents an attacker from copying and pasting a Chrome packaged app (which is just a zipped web app) then distributing it on the Chrome webstore under a slightly different name?
12
votes
4answers
8k views

Apparently PayPal-affiliated site with very suspect security

History I got an email this afternoon to my gmail from "paypal@e.paypal.com" with mailed-by: na.e.paypal.com and signed-by: e.paypal.com. Gmail did not report it as spam/phishing/suspicious and it ...
0
votes
2answers
342 views

How do fake emailers work?

Our University recently had a case where some notorious fellows used a fake emailing service to send an email to all students on behalf of the administration. Although most good email services (like ...
-3
votes
1answer
158 views

Meaning of webpage link containing www23 [closed]

I have come across a number of websites which include links such as www32.example.com and also www2.example.com. Why is there a number in the www part of the link? Are these sites not legitimate? ...
-1
votes
2answers
175 views

Hotmail security

Recently I've been receiving in my SPAM folder, SPAM mails sent "by me". With "By me" I mean, that I am not sure if those are really sent from me. It has been happening since December, at around one ...
8
votes
4answers
300 views

Best practice for informing a website they've been compromised?

I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek ...
3
votes
1answer
414 views

I accidentally installed an adware filled Firefox [solved]

I installed Firefox using a download site, rather than the correct site. After running and installing Firefox I noticed my Chrome had an addon called swift browser added to it by a third party. After ...
0
votes
1answer
301 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
4
votes
1answer
193 views

Is this a phishing attempt? if yes where to report?

I received strange email from co-worker, asking me to click the link. I did eventually follow the link, but thought putting in my gmail user/pass wasn't wise. What do you think? is this phishing ...
1
vote
3answers
268 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
0
votes
2answers
223 views

Can you trust the URL shown when 'hovering' on a link? [duplicate]

When using a modern web browser, if you hover on a link, the browser will show you the link in a little display on the bottom left corner of the browser screen. Can I trust this? Can this display be ...
1
vote
3answers
210 views

Are subdomains a cure for phishing?

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
-1
votes
1answer
80 views

Subdomains a possible defense against phishing [duplicate]

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
0
votes
2answers
559 views

Exploiting an Open Redirect in POST body?

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after ...
3
votes
1answer
3k views

A “new domain registration” spam?

About 6 days ago I purchased a new domain under .org TLD from a local registrar. Few days later, I have received this strange message (which BTW fell to Gmail spam bin), which looks like some kind of ...
4
votes
5answers
1k views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
3
votes
2answers
731 views

URL & address bar spoofing, only possible on rogue access point

Have been playing around with the whole DNS spoofing thing. How can a rogue/phishing URL be masked with a legitimate URL in the address bar (without using images)? I was under the impression that this ...
6
votes
1answer
335 views

Google Chrome & Spear-phishing

I've been trying to find some information on how Google Chrome detects phishing pages that are not already in their blacklists. The most relevant information that I've found from Google itself, ...
2
votes
1answer
515 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
0
votes
2answers
94 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
2
votes
2answers
23k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
22
votes
4answers
774 views

Security seals and the “perception of safety”?

I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...
1
vote
3answers
476 views

Anti-Phishing Campaign Objective

At every office I have worked, links and files, both internal and external, are shared in emails. Is the objective of an anti-phishing campaign that users never click on blind, or otherwise ...
2
votes
3answers
610 views

Report an email address being used by a phisher

A close friend fell for a phishing scam earlier today. His account's all squared up now, but I decided to do a bit of investigation. The website he fell for was a very poor imitation of a Remax site ...
5
votes
6answers
18k views

Is update@em.facebookmail.com legitimate?

I'm having a hard time figuring out whether this email a friend of mine got is legit or a scam. The weird thing is there's only one link to facebook.com, which is the one about facebook terms. All the ...
7
votes
1answer
5k views

Looking for URL Blacklists of Malicious Websites [closed]

Is there a maintained list of URLs that contain malicious content. These URLs may be involved in Phishing, Scams, Viri, or other Malware. Please indicate in your answer if the list is freely ...
2
votes
4answers
2k views

Yahoo Email Keeps Getting Phished

I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
3
votes
2answers
479 views

Is Yahoo SignIn Seal effective at phishing prevention? [duplicate]

Possible Duplicate: Effectiveness of Security Images Information about the efficacy of Yahoo's SignIn Seal is scarce, the best I could find was this section on Wikipedia's entry on ...
9
votes
3answers
1k views

Is SiteKey a valid defense against Phishing?

As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. (This is a scheme where the user is shown a personalized image (each user has their own ...
27
votes
3answers
898 views

What is this authentication method/approach called?

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
0
votes
2answers
249 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
6
votes
2answers
2k views

Will reporting phishing emails cause problems for the victim?

On GMail, I've received a phishing email from someone I know, and the email has been sent to other people the victim knows. One of the emails is claiming to be from their GMail address, while the ...
1
vote
2answers
219 views

Is there guidance that says all sessions to be logged off when a user changes their password?

Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active. Is ...
2
votes
1answer
582 views

Why is a link posted to Facebook going through all redirects and showing info for final page only?

Today I read a post on a Facebook-group about a "problem" with links posted to Facebook. Appearently when you post a link at Facebook, the sites goes through the redirect(s) that may be on the site ...
3
votes
3answers
301 views

I stupidly responded to an email from a hacker posing as a friend

I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...
0
votes
1answer
601 views

Phishing attack stuck with jsp loginAction.do page? [closed]

I'm testing a phishing website on a staged replica of an jsp web-application. I'm doing the usual attack which involves changing the post and action field of source code to divert to my own written ...
17
votes
4answers
1k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
1
vote
4answers
170 views

how to identify whether my page is phished or normal page?

Usually I differentiate phished page and normal web pages by seeing https before the address of the web page, as the lock symbol will help us to identify. Are there any other methods to differentiate ...
6
votes
3answers
7k views

Is it possible for a phishing link to install a major virus on a Mac?

My girlfriend recently had her university MS Exchange account hacked. The attacker took over her email account and started using it to send thousands of spam emails. After a while, her email account ...
4
votes
3answers
201 views

Best way to handle identity theft incident?

A user's email is hacked, contacts copied, and similar emails (look alike emails with minor spelling differences) are created by the attacker with the same name and avatar, sending relatively well ...
0
votes
2answers
387 views

Can a man engaged in phishing be prosecuted if I know his IP?

My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
6
votes
3answers
835 views

Is this phishing or the real PayPal?

This has all traits of phishing, apart from the extended validation SSL cert. Is this site run by the real PayPal?
8
votes
4answers
17k views

Reminder: Reset your password - phishing or genuine Facebook email?

An email claiming to be from facebook had the following content: Hi Andrew, You recently requested a new password for your Facebook account. It looks like we sent you an email with a link to ...
1
vote
2answers
117 views

Is Google a feasible tool for an organization to check if their name is being used in phishing sites?

Is it feasible for an organization to use Google and the available Google search operators (e.g. allinurl, etc) to find out if their organization name is being spoofed or used in phishing sites and ...
50
votes
8answers
9k views

Risks of giving developers admin rights to their own PCs

I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
7
votes
3answers
3k views

If someone bought the .local TLD could that be a security risk?

Now that the ICANN is allowing custom Top Level Domain names and often corporate IT workers like to use .local as the TLD for internal networks, if someone does buy the .local TLD what are some ...
8
votes
3answers
1k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
2
votes
2answers
419 views

when you are phished, what do they get?

Lets say I was foolish enough to press on a YouTube video on Facebook that ended up being what I suspect is a phishing link. What can they potentially get? I had three tabs open: (1) my phpMyAdmin ...