Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

0
votes
3answers
109 views

How a professional hacker would penetrate a computer in a network?

Which kinds of vulnerabilities or security holes a hacker would use to penetrate and take over a computer in a network, like a normal PC in a default network (Wireless-LAN). I often hear that the ...
21
votes
5answers
5k views

What is the best way to respond to phishing emails sent from a government domain?

In the past day or so, I've received two emails from different .gov addresses that purport to be from Intuit and encourage me to click on a link to "restore access to your QuickBooks account." They ...
4
votes
1answer
96 views

Sites that allow user-generated content

Is there a way to identify which popular sites will host arbitrary user-generated content? I am doing some analysis to detect phishing sites. It would be nice to use the popularity of a website as a ...
2
votes
1answer
45 views

What are the disadvantages of Google Safe Browsing?

I'm currently undertaking my thesis regarding phishing detection. I understand that Google Safe Browsing relies on a constantly updated blacklist in order to classify webpages. Their blacklist does ...
0
votes
1answer
70 views

Is pull inherently more secure than push?

Users of a service are waiting for something to happen - a money transfer for example. An attacker might forge an email notification, that executes an XSRF attack. Alternatively, I could leave it up ...
1
vote
0answers
45 views

How often does a user type in the “last 4 digits of SSN” in the “last 4 digits of Phone”?

This may sound dumb to a Security pro, but this is about end-users and worst case interaction with a challenge-response. Background Many 2 factor authentication sites request verification of the ...
0
votes
1answer
76 views

Random persistent Gmail password requests from Google

I am trying to figure out something for my father in law. This persistent popup keeps interrupting anything anyone is doing on his desktop by requesting he put in his password. I told him not to. It ...
18
votes
5answers
5k views

Is there a way to download a PHP file without it being executed?

I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with .php at the ...
6
votes
2answers
453 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
5
votes
1answer
102 views

SMS: Apple has detected multiple failed login attempts

I have just got a SMS message (text message) on my phone saying: Apple has detected multiple failed login attempts Given I don't have (and have never had) an iPhone, I expect it is some sort of ...
3
votes
1answer
52 views

How could we provide certainty to users that education material on phishing, isn't phishing itself?

This is a problem that has been bothering me somewhat. I am able to run a phishing simulation campaign against users across the organisation. If the user clicks on a bad link they are directed and ...
5
votes
4answers
4k views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
5
votes
5answers
3k views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
5
votes
2answers
101 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
10
votes
6answers
1k views

Is this “security update” from security-update@amazon.com an advanced phishing scam or a real security measure from Amazon?

I just got either a helpful security update from Amazon or an advanced phishing attempt by an Amazon impersonator falsifying the email origin. The title is "Your Amazon password has been changed". ...
2
votes
2answers
37 views

LDAP allows conveniently centralised authentication - but can this lead to complacent security practises?

Say you work for LargeCorp, you have a LDAP login to access your desktop, access various internal applications etc. It's convienient because you don't have to independantly manage authentication for ...
3
votes
3answers
105 views

How does Single Sign On limit phishing risk

I was reading this article about SSO benefits and this sentence intrigues me : Can reduce phishing – Phishing, a fraudulent process where victims are tricked into giving away sensitive user ...
0
votes
1answer
46 views

Why are the domains https.lk , ftp.lk and http.lk restricted on the Sri Lanka domain registry

I found http://nic.lk which is the domain registry for .lk domains (I am in Sri Lanka).I typed in https.lk and it said 'https.lk' Domain name you searched is restricted. Why is this done. Is it ...
5
votes
3answers
1k views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
0
votes
3answers
468 views

Email from supposedly Apple (mycloud.ssl.com)

I got an email where it says that Apple recently failed to validate my payment information and therefore they need to ask me to complete a short verification process in order to verify my account. At ...
8
votes
2answers
688 views

Did scammers take control of a subdomain to host phishing site?

This morning I received a text message (ostensibly) from my bank: We need to contact you. Please visit https://paymentassistance.nationwide.co.uk for more information My spidey sense immediately ...
0
votes
2answers
129 views

Was GMail hacked?

I was logging in to my gmail and this phising alert screen showed. Is safe to continue? I know that is very rare that this shows when opening GMail, but I prefer to be safe. It seems that this ...
2
votes
1answer
119 views

How to identify coded content in a phishing page [closed]

First of all, I'm a completely dummy in information security. Today morning I've received an email that make me curious. It was a kind of phishing page which was not detected by the Gmail's spam ...
1
vote
1answer
63 views

Unexpected phishing attempt by SMS

I just received this text message (screenshot), which claims to be from the national postal service, informing me that I have a package waiting for me. I have a user account on their website, so them ...
1
vote
2answers
74 views

Who do I inform when a website is compromised

I often receive phishing emails claiming to be big companies like PayPal. When I check the link I remove anything which could be used to confirm that it was me who clicked and open the link in a ...
8
votes
3answers
292 views

Is it enough to look at the sender's email address?

I use Gmail. When I receive an email, Gmail displays the sender's email address. So far I've always looked at this address when receiving sensitive mails, to avoid phishing. For example, I know by ...
1
vote
2answers
215 views

Is this a legitimate Microsoft email or is this a Phishing email and how can I tell?

I am a mobile application developer using Microsoft Azure with my MSDN subscription to develop my back-end of the application. Today I got the following email: So given my above background this ...
4
votes
1answer
59 views

How can I safely view the code of a VBA macro?

I have received a phishing email with the usual bogus bill in the form of a Word document. I am curious about what the probable virus wants to do so I would like to inspect the code. At the moment ...
2
votes
0answers
37 views

Something phishy going on with email [duplicate]

I own my own domain. For a month or so I've been getting emails from addresses I don't know with "see attached image" or "find the attached invoice", with a zip/rar file attached. Of course, I ...
1
vote
2answers
83 views

Unsolicited opt-out from data brokers

I received several automated emails at an early hour from several data brokers (e.g., Spokeo) asking me to confirm an opt-out for my email address and name. I did not request these, but did so about ...
16
votes
2answers
1k views

Ongoing Executive Impersonation Attack

A friend of mine runs a small business that was recently targeted by a relatively sophisticated "executive impersonation" wire transfer spearphishing attack. The attacker registered a domain that was ...
0
votes
1answer
90 views

What are these links that have been sent to me multiple times on facebook?

2 friends of mine have sent me very suspicious links on facebook, which ask me for credentials on an external site. Entering hello@example.com in the username, and 1234 for the password let me in, and ...
3
votes
1answer
57 views

One of my open files turned into a list of URLs and codes after clicking a link on a phishing email?

So I received a non-filtered email earlier today supposedly from Itunes under my email address with an invoice for Netflix subscription. Some of the links were genuine, but ultimately I clicked on a ...
4
votes
1answer
144 views

Databases with spam, phishing email examples [duplicate]

I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc). I order to do this I need to have a ...
2
votes
1answer
173 views

Unable to Spoof DNS in Kali

I am new to Kali But not new to Information Security. Warming up with Kali, I tried to dns_spoof. But that didn't quite work. Here is what I did. Tampered ip_forward to 1 in /proc/sys/net/ipv4 ...
3
votes
2answers
196 views

“fake” phishing mails from CST

I work in the computer security team of my company and my team leader ask me to send "fake" phishing mails to my colleagues. The mails intended to lure them into clicking on the embedded links (the ...
0
votes
1answer
197 views

Does it Matter That Universal Windows Platform (UWP) is Open to Phishing Attacks?

A few years ago (a little over three now to be exact), I brought up what I consider to be a rather obvious (and serious) security issue with the Universal Windows Platform (UWP): The ability to use ...
31
votes
2answers
4k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
1
vote
0answers
158 views

Attackers on sc.imp.live.com [closed]

"Deceptive site ahead Attackers on sc.imp.live.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone ...
5
votes
4answers
138 views

How does a CSRF logout pose a potential threat to a website?

Websites like SuperLogout logs the user out from several websites at one go. I want to know in what way does this pose a potential threat to the users of the website? How can this be combined with a ...
7
votes
4answers
3k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
2
votes
1answer
178 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
0
votes
1answer
304 views

SETOOL Kit:Error: “Unable to Clone the site. Check your network connection”

I have to tried to check whether a site is vulnerable to Phishing attack or not using "Setool kit" in Kali Linux. But when I tried to clone a site using this Setool Kit in Kali Linux, I got an error ...
1
vote
1answer
109 views

Spear Phishing attempt, how to respond? [closed]

I'm a software developer for a software development company responsible for multiple products, and I typically handle our IT needs as we're quite a small company. We had a suspicious incident today ...
3
votes
2answers
165 views

Why can't my email server automatically identify spoofed addresses?

I get this question from business stakeholders a lot, and I have tried to solve this problem on my own. I have a potential approach, but I want to challenge my assumptions. In my mind, it should be ...
5
votes
1answer
82 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
5
votes
1answer
72 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
136 views

Phishing Gmail account [duplicate]

I received a mail from a friend who I was playing together in a multiplayer game. And it had a link to phishing page which would ask to login to view the file that the sent me. And my antivirus found ...
3
votes
3answers
171 views

Does this concept attack work to harvest credentials and 2FA using offline fake site?

My concept is this: Client connects to Malicious\Eviltwin AP Client connects to www.facebook.com but this one is a fake offline site by the fake dns server Client enters user and password ---> ...
-2
votes
2answers
63 views

User's submitted ID in URLs, can it open some vulnerability? [closed]

On the website I'm building users can submit links to various of their personal page: YouTube accounts, Twitter, Facebook and a lot more. When he does so he furnishes the ID to his account. For ...