Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

3
votes
2answers
601 views

URL & address bar spoofing, only possible on rogue access point

Have been playing around with the whole DNS spoofing thing. How can a rogue/phishing URL be masked with a legitimate URL in the address bar (without using images)? I was under the impression that this ...
6
votes
1answer
301 views

Google Chrome & Spear-phishing

I've been trying to find some information on how Google Chrome detects phishing pages that are not already in their blacklists. The most relevant information that I've found from Google itself, ...
2
votes
1answer
418 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
0
votes
2answers
93 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
2
votes
2answers
17k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
22
votes
4answers
752 views

Security seals and the “perception of safety”?

I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...
1
vote
3answers
406 views

Anti-Phishing Campaign Objective

At every office I have worked, links and files, both internal and external, are shared in emails. Is the objective of an anti-phishing campaign that users never click on blind, or otherwise ...
2
votes
3answers
403 views

Report an email address being used by a phisher

A close friend fell for a phishing scam earlier today. His account's all squared up now, but I decided to do a bit of investigation. The website he fell for was a very poor imitation of a Remax site ...
5
votes
6answers
16k views

Is update@em.facebookmail.com legitimate?

I'm having a hard time figuring out whether this email a friend of mine got is legit or a scam. The weird thing is there's only one link to facebook.com, which is the one about facebook terms. All the ...
7
votes
1answer
4k views

Looking for URL Blacklists of Malicious Websites [closed]

Is there a maintained list of URLs that contain malicious content. These URLs may be involved in Phishing, Scams, Viri, or other Malware. Please indicate in your answer if the list is freely ...
2
votes
4answers
2k views

Yahoo Email Keeps Getting Phished

I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
3
votes
2answers
427 views

Is Yahoo SignIn Seal effective at phishing prevention? [duplicate]

Possible Duplicate: Effectiveness of Security Images Information about the efficacy of Yahoo's SignIn Seal is scarce, the best I could find was this section on Wikipedia's entry on ...
9
votes
3answers
1k views

Is SiteKey a valid defense against Phishing?

As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. (This is a scheme where the user is shown a personalized image (each user has their own ...
27
votes
3answers
863 views

What is this authentication method/approach called?

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
0
votes
2answers
232 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
6
votes
2answers
2k views

Will reporting phishing emails cause problems for the victim?

On GMail, I've received a phishing email from someone I know, and the email has been sent to other people the victim knows. One of the emails is claiming to be from their GMail address, while the ...
1
vote
2answers
212 views

Is there guidance that says all sessions to be logged off when a user changes their password?

Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active. Is ...
2
votes
1answer
522 views

Why is a link posted to Facebook going through all redirects and showing info for final page only?

Today I read a post on a Facebook-group about a "problem" with links posted to Facebook. Appearently when you post a link at Facebook, the sites goes through the redirect(s) that may be on the site ...
3
votes
3answers
293 views

I stupidly responded to an email from a hacker posing as a friend

I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...
0
votes
1answer
564 views

Phishing attack stuck with jsp loginAction.do page? [closed]

I'm testing a phishing website on a staged replica of an jsp web-application. I'm doing the usual attack which involves changing the post and action field of source code to divert to my own written ...
16
votes
4answers
1k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
1
vote
4answers
161 views

how to identify whether my page is phished or normal page?

Usually I differentiate phished page and normal web pages by seeing https before the address of the web page, as the lock symbol will help us to identify. Are there any other methods to differentiate ...
6
votes
3answers
6k views

Is it possible for a phishing link to install a major virus on a Mac?

My girlfriend recently had her university MS Exchange account hacked. The attacker took over her email account and started using it to send thousands of spam emails. After a while, her email account ...
4
votes
3answers
196 views

Best way to handle identity theft incident?

A user's email is hacked, contacts copied, and similar emails (look alike emails with minor spelling differences) are created by the attacker with the same name and avatar, sending relatively well ...
0
votes
2answers
369 views

Can a man engaged in phishing be prosecuted if I know his IP?

My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
6
votes
3answers
783 views

Is this phishing or the real PayPal?

This has all traits of phishing, apart from the extended validation SSL cert. Is this site run by the real PayPal?
8
votes
4answers
16k views

Reminder: Reset your password - phishing or genuine Facebook email?

An email claiming to be from facebook had the following content: Hi Andrew, You recently requested a new password for your Facebook account. It looks like we sent you an email with a link to ...
1
vote
2answers
114 views

Is Google a feasible tool for an organization to check if their name is being used in phishing sites?

Is it feasible for an organization to use Google and the available Google search operators (e.g. allinurl, etc) to find out if their organization name is being spoofed or used in phishing sites and ...
49
votes
8answers
8k views

Risks of giving developers admin rights to their own PCs

I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
7
votes
3answers
2k views

If someone bought the .local TLD could that be a security risk?

Now that the ICANN is allowing custom Top Level Domain names and often corporate IT workers like to use .local as the TLD for internal networks, if someone does buy the .local TLD what are some ...
8
votes
3answers
883 views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
2
votes
2answers
393 views

when you are phished, what do they get?

Lets say I was foolish enough to press on a YouTube video on Facebook that ended up being what I suspect is a phishing link. What can they potentially get? I had three tabs open: (1) my phpMyAdmin ...
3
votes
2answers
101 views

Automated browser-level countermeasures to look-alike login pages

For example, say an unsuspecting visitor gets a link security.stackexchange.com/.... Then it re-opens the login page, with or without an explanation as to why they have to log in again. (this is more ...
20
votes
5answers
1k views

Are address bars unphishable?

I've taken, out of curiosity, the Phishing Quiz by OpenDNS that tries to teach the general public about detecting phishing: Ever wonder how good you are at telling the difference between a ...
1
vote
2answers
825 views

How to react on a message about a pending account ban on Facebook? [closed]

Are you getting this message on chat? LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable ...
2
votes
2answers
1k views

Some questions about penetration testing distribution Backtrack 5

I know just the basics of backtrack and I want to ask some questions about it: Can you attack an ftp server using backtrack? an email server? I have a Centos virtual private server and backtrack is ...
8
votes
5answers
319 views

In what ways do some banks inadequately advise their customers on online security?

I'm looking for specific examples of things such as: Misleading, but common advice Advice which has backfired Advice which is just, quite simply, incorrect which have been circulated time and time ...
19
votes
2answers
838 views

A phone call hack

The other day, I got a call from a relative with an email problem. After a bit more discussion, it turns out that two days previously, a man phoned my relative: stated he was from microsoft; asked ...
11
votes
6answers
552 views

What are effective ways to prevent targeted phishing?

Phishing is a very serious problem that we face. Popular banks are often the biggest targets. What methods can a bank website use to protect its self from phishing attacks? What security systems ...
5
votes
3answers
733 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
11
votes
4answers
887 views

“Phishing” red flags and countermeasures

Given the recent spate of intrusions into various networks which have included compromise of subscriber identity and contact information, I figured it would be good for us to have a thread on how to ...