Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

5
votes
1answer
65 views

SMS: Apple has detected multiple failed login attempts

I have just got a SMS message (text message) on my phone saying: Apple has detected multiple failed login attempts Given I don't have (and have never had) an iPhone, I expect it is some sort of ...
2
votes
1answer
37 views

How could we provide certainty to users that education material on phishing, isn't phishing itself?

This is a problem that has been bothering me somewhat. I am able to run a phishing simulation campaign against users across the organisation. If the user clicks on a bad link they are directed and ...
5
votes
4answers
3k views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
5
votes
5answers
3k views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
5
votes
2answers
92 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
10
votes
6answers
1k views

Is this “security update” from security-update@amazon.com an advanced phishing scam or a real security measure from Amazon?

I just got either a helpful security update from Amazon or an advanced phishing attempt by an Amazon impersonator falsifying the email origin. The title is "Your Amazon password has been changed". ...
4
votes
1answer
87 views

Sites that allow user-generated content

Is there a way to identify which popular sites will host arbitrary user-generated content? I am doing some analysis to detect phishing sites. It would be nice to use the popularity of a website as a ...
2
votes
2answers
34 views

LDAP allows conveniently centralised authentication - but can this lead to complacent security practises?

Say you work for LargeCorp, you have a LDAP login to access your desktop, access various internal applications etc. It's convienient because you don't have to independantly manage authentication for ...
0
votes
1answer
64 views

Is pull inherently more secure than push?

Users of a service are waiting for something to happen - a money transfer for example. An attacker might forge an email notification, that executes an XSRF attack. Alternatively, I could leave it up ...
3
votes
3answers
97 views

How does Single Sign On limit phishing risk

I was reading this article about SSO benefits and this sentence intrigues me : Can reduce phishing – Phishing, a fraudulent process where victims are tricked into giving away sensitive user ...
0
votes
1answer
44 views

Why are the domains https.lk , ftp.lk and http.lk restricted on the Sri Lanka domain registry

I found http://nic.lk which is the domain registry for .lk domains (I am in Sri Lanka).I typed in https.lk and it said 'https.lk' Domain name you searched is restricted. Why is this done. Is it ...
5
votes
3answers
1k views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
6
votes
2answers
442 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
0
votes
3answers
440 views

Email from supposedly Apple (mycloud.ssl.com)

I got an email where it says that Apple recently failed to validate my payment information and therefore they need to ask me to complete a short verification process in order to verify my account. At ...
8
votes
2answers
653 views

Did scammers take control of a subdomain to host phishing site?

This morning I received a text message (ostensibly) from my bank: We need to contact you. Please visit https://paymentassistance.nationwide.co.uk for more information My spidey sense immediately ...
0
votes
2answers
122 views

Was GMail hacked?

I was logging in to my gmail and this phising alert screen showed. Is safe to continue? I know that is very rare that this shows when opening GMail, but I prefer to be safe. It seems that this ...
2
votes
1answer
104 views

How to identify coded content in a phishing page [closed]

First of all, I'm a completely dummy in information security. Today morning I've received an email that make me curious. It was a kind of phishing page which was not detected by the Gmail's spam ...
1
vote
1answer
61 views

Unexpected phishing attempt by SMS

I just received this text message (screenshot), which claims to be from the national postal service, informing me that I have a package waiting for me. I have a user account on their website, so them ...
1
vote
2answers
72 views

Who do I inform when a website is compromised

I often receive phishing emails claiming to be big companies like PayPal. When I check the link I remove anything which could be used to confirm that it was me who clicked and open the link in a ...
8
votes
3answers
276 views

Is it enough to look at the sender's email address?

I use Gmail. When I receive an email, Gmail displays the sender's email address. So far I've always looked at this address when receiving sensitive mails, to avoid phishing. For example, I know by ...
1
vote
2answers
203 views

Is this a legitimate Microsoft email or is this a Phishing email and how can I tell?

I am a mobile application developer using Microsoft Azure with my MSDN subscription to develop my back-end of the application. Today I got the following email: So given my above background this ...
4
votes
1answer
49 views

How can I safely view the code of a VBA macro?

I have received a phishing email with the usual bogus bill in the form of a Word document. I am curious about what the probable virus wants to do so I would like to inspect the code. At the moment ...
2
votes
0answers
37 views

Something phishy going on with email [duplicate]

I own my own domain. For a month or so I've been getting emails from addresses I don't know with "see attached image" or "find the attached invoice", with a zip/rar file attached. Of course, I ...
1
vote
2answers
83 views

Unsolicited opt-out from data brokers

I received several automated emails at an early hour from several data brokers (e.g., Spokeo) asking me to confirm an opt-out for my email address and name. I did not request these, but did so about ...
16
votes
2answers
1k views

Ongoing Executive Impersonation Attack

A friend of mine runs a small business that was recently targeted by a relatively sophisticated "executive impersonation" wire transfer spearphishing attack. The attacker registered a domain that was ...
0
votes
1answer
89 views

What are these links that have been sent to me multiple times on facebook?

2 friends of mine have sent me very suspicious links on facebook, which ask me for credentials on an external site. Entering hello@example.com in the username, and 1234 for the password let me in, and ...
3
votes
1answer
55 views

One of my open files turned into a list of URLs and codes after clicking a link on a phishing email?

So I received a non-filtered email earlier today supposedly from Itunes under my email address with an invoice for Netflix subscription. Some of the links were genuine, but ultimately I clicked on a ...
4
votes
1answer
102 views

Databases with spam, phishing email examples [duplicate]

I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc). I order to do this I need to have a ...
2
votes
1answer
135 views

Unable to Spoof DNS in Kali

I am new to Kali But not new to Information Security. Warming up with Kali, I tried to dns_spoof. But that didn't quite work. Here is what I did. Tampered ip_forward to 1 in /proc/sys/net/ipv4 ...
3
votes
2answers
195 views

“fake” phishing mails from CST

I work in the computer security team of my company and my team leader ask me to send "fake" phishing mails to my colleagues. The mails intended to lure them into clicking on the embedded links (the ...
0
votes
1answer
176 views

Does it Matter That Universal Windows Platform (UWP) is Open to Phishing Attacks?

A few years ago (a little over three now to be exact), I brought up what I consider to be a rather obvious (and serious) security issue with the Universal Windows Platform (UWP): The ability to use ...
31
votes
2answers
4k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
1
vote
0answers
158 views

Attackers on sc.imp.live.com [closed]

"Deceptive site ahead Attackers on sc.imp.live.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone ...
5
votes
4answers
133 views

How does a CSRF logout pose a potential threat to a website?

Websites like SuperLogout logs the user out from several websites at one go. I want to know in what way does this pose a potential threat to the users of the website? How can this be combined with a ...
7
votes
4answers
3k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
2
votes
1answer
175 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
18
votes
4answers
5k views

Is there a way to download a PHP file without it being executed?

I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with .php at the ...
0
votes
1answer
235 views

SETOOL Kit:Error: “Unable to Clone the site. Check your network connection”

I have to tried to check whether a site is vulnerable to Phishing attack or not using "Setool kit" in Kali Linux. But when I tried to clone a site using this Setool Kit in Kali Linux, I got an error ...
1
vote
1answer
100 views

Spear Phishing attempt, how to respond? [closed]

I'm a software developer for a software development company responsible for multiple products, and I typically handle our IT needs as we're quite a small company. We had a suspicious incident today ...
3
votes
2answers
154 views

Why can't my email server automatically identify spoofed addresses?

I get this question from business stakeholders a lot, and I have tried to solve this problem on my own. I have a potential approach, but I want to challenge my assumptions. In my mind, it should be ...
5
votes
1answer
79 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
5
votes
1answer
68 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
129 views

Phishing Gmail account [duplicate]

I received a mail from a friend who I was playing together in a multiplayer game. And it had a link to phishing page which would ask to login to view the file that the sent me. And my antivirus found ...
3
votes
3answers
170 views

Does this concept attack work to harvest credentials and 2FA using offline fake site?

My concept is this: Client connects to Malicious\Eviltwin AP Client connects to www.facebook.com but this one is a fake offline site by the fake dns server Client enters user and password ---> ...
-2
votes
2answers
63 views

User's submitted ID in URLs, can it open some vulnerability? [closed]

On the website I'm building users can submit links to various of their personal page: YouTube accounts, Twitter, Facebook and a lot more. When he does so he furnishes the ID to his account. For ...
5
votes
1answer
15k views

Is this Facebook email real or phishing?

I received this email from what is supposedly Facebook today. Here's a screenshot: I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate ...
7
votes
1answer
117 views

fake website used for phishing purposes

Our real web site is www.abc.com. Recently Intel notified us of another web site www.fake.com having some parts of the site appearing the same as our real site. This is obviously a phishing site. Not ...
0
votes
1answer
103 views

“Secure” emails from unfamiliar source(s)

The context is long, so I'll ask my question first. If an encrypted message is received from an unfamiliar sender and it's spam, how can I avoid receiving further messages of the same sort? If it's ...
1
vote
2answers
1k views

Liliane Bettencourt scam? [closed]

I got a text message from an Elizabeth.Zamora@Bridgeportct.gov sub; RE: donations!!! "donation was made to you by Mrs. Liliane Betterncourtm, contact her at: lilianebettencour@163.com" for ...
2
votes
1answer
108 views

Should we trust online banks with our credit card information?

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out ...