Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

6
votes
1answer
52 views

Does iPhone home button act as Secure Attention Key?

On an iPhone, does pressing the home button act as a Secure Attention Sequence? The home button is a physical button. You can press the home button whereever you are and go back to the home screen. ...
0
votes
1answer
15 views

Unsolicited opt-out from data brokers

I received several automated emails at an early hour from several data brokers (e.g., Spokeo) asking me to confirm an opt-out for my email address and name. I did not request these, but did so about ...
3
votes
4answers
112 views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
1
vote
0answers
27 views

Extraneus message about security risk when I open a new Chrome tab [migrated]

Today I start getting in Chrome a message saying: "I SEE YOU ARE A XXXXX CUSTOMER are you concerned that your Linux computer may have a potential security risk.... Please call toll free for ...
18
votes
4answers
2k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
1
vote
2answers
66 views

Suspicious SMS getting received on selected browsing

I am receiving several suspicious SMS messages with links telling me that I have requested subscription to their services (which I have not) asking me to confirm subscription. These SMS appear only ...
2
votes
0answers
25 views

Information on the Elderwood Project/Platform [closed]

I've read Symantec's whitepaper on the Elderwood Project and the blog update on the Elderwood Platform. They both make for a very interesting read, especially in the zero-day exploit meta-analysis ...
1
vote
1answer
61 views

Email phishing scam asking customers for card details

I work for a small ecommerce company and over the weekend we received a few emails from customers claiming to have received an email asking them to confirm their card details to process their orders. ...
1
vote
2answers
55 views

Difference between DNS spoofing and phishing [closed]

I am writing a bachelor thesis and I am having a hard time figuring out the difference between phishing and DNS spoofing. From what I understand, DNS spoofing is a way to achieve a succesfull phishing ...
1
vote
1answer
51 views

I think i might have accidentally clicked a phishing link, how can i be sure? [closed]

Long story short I might have accidentaly clicked a phishing link is there any kind of test I can do or anything I can do to check?
16
votes
3answers
2k views

Can malware change the website visited by browser?

I heard in a security talk today (I didn't have the opportunity to ask questions): The speaker mentioned that he observed (2 years ago) that a possible malware on a given computer was behaving such ...
2
votes
2answers
120 views

Wordpress blog hacked?

There is a Wordpress blog running on Wordpress 4.0. Anyone having the company webmail can signup to the blog using their Google+ account and submit blog posts. Once posted they will be sent to some ...
28
votes
2answers
2k views

I have registered a .com domain and received an e-mail from domainadmin.com

I have registered a .com domain and received an e-mail from domainadmin.com, it looks extremely like a phishing e-mail, but after a research I am ultimately confused whether this thing is legitimate ...
1
vote
1answer
138 views

This facebook page looks different - phishing attempt?

After logging on to a public wifi, I was redirected to this page appearing to be from facebook, and being done via https: which looks markedly different from my normal facebook page I understand ...
0
votes
0answers
26 views

Security Flaw in all “logging by” system - phishing opportunity

We all face such popups. How can you assure that it's NOT phishing, if It's not in the browser. UIWebView (View that displays this logging view) is controlled by application we really don't even ...
2
votes
2answers
165 views

Hack: anymonous URL on my Joomla Website[Resolve] [closed]

My website has been hacked again. There are many foreign URLs such as here. I've checked the database and there is nothing strange in my database. Does anyone know what kind of hack attack is like ...
34
votes
5answers
5k views

Are there actions taken against websites that deliver malware?

There are serious tools and services such as Google Safe Browsing for malicious and phishing websites, and others fully dedicated to phishing websites such as Phishing.org. What is done against these ...
3
votes
1answer
137 views

Phishing email from Avast - Headers look totally legit?

Below is the email with headers. I never registered on the site, so it's clearly phishing, but the links in the email point to the real Avast site. The delivery path also looks legit since both IP ...
0
votes
1answer
64 views

Is there a “how to” about Gmail fraud, updated at least once per week?

My Gmail account has just been cracked and many of my contacts are receiving fake emails, claiming that I'm in troubles and requesting money. Searching for advice, using Google, about what actions ...
4
votes
1answer
343 views

How secure is JavaScript based OAuth 2.0

JavaScript based OAuth exposes the client ID of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a DNS hijack (or a virus affecting ...
0
votes
2answers
73 views

Phishing email sent to me within a few hours after a related incident, what should I do?

A few hours ago I was helping a family member pay for something on a government website with one of his credit cards, but for whatever reason it didn't go through, so we used another card and it ...
5
votes
4answers
368 views

Can someone steal cookie contents via a phishing attack?

If someone successfully set up a phishing website on a fake wireless network for say, bankofamerica.com, and lets pretend that SSL was not used, would they be able to run a script on the server that ...
12
votes
4answers
9k views

Apparently PayPal-affiliated site with very suspect security

History I got an email this afternoon to my gmail from "paypal@e.paypal.com" with mailed-by: na.e.paypal.com and signed-by: e.paypal.com. Gmail did not report it as spam/phishing/suspicious and it ...
-1
votes
2answers
120 views

Fake Microsoft Security Department [duplicate]

some Indian man called home saying that he's calling from some Windows Security Department, and there are about 16 other people connected to my computer and the're doing illegal things on my computer. ...
0
votes
1answer
70 views

Have i been phished? [closed]

I recently opened a link from a "friend", while I was on my workplace. It was some really simple stupid game "Super Mario" type. I opened it, played for 10 seconds and closed the link. What felt ...
0
votes
0answers
36 views

Application of digital watermarking for session hijack

I know digital watermarking can protect the media from man-in-middle and replay attack. Is it good also for session hijack attack or phishing attack?
6
votes
1answer
759 views

What can happen if someone gets a hold of a scan of someone else's passport?

Or: "Do I need to be concerned about emailing people scans of my passport if they want to verify my identity?" Is there anything anyone can do with the information on the main page of the passport ...
4
votes
1answer
67 views

phishing message in Outlook signature?

One of my organization's users just showed us an interesting problem: every message they tried to send (in OWA 365) contained the following scary text: Your mailbox has exceeded one or more size ...
8
votes
5answers
469 views

Is there anything I can do about IDN homograph attacks?

I have been reading about IDN homograph attacks, and I cannot think of any better way than Tell my users not to trust emails asking for passwords, etc Buy all domains similar to mine (expensive and ...
2
votes
3answers
181 views

Strange unsolicited email sent to almost never used email address

What initially looked like typical spam now seems extra odd and is bugging me (only figuratively I hope). Ostensibly, a sales rep from DomainNameSales.com (DNS), which I'd never heard of, sent an ...
5
votes
8answers
462 views

Checking “return” parameter in login page

My login page accepts the "return" parameter, which should contain URI to redirect user if he wasn't logged in and tried to access page which isn't accessible by unauthenticated users. It could be ...
1
vote
0answers
87 views

Open redirection unique token bypass

I am currently analyzing one job portal web application in which there is an open redirect vulnerability. Vulnerability description is as follows: Request type: GET Vulnerable Parameter: dest ...
2
votes
1answer
209 views

What does this potentially malicious code do?

While reading a website called 4chan/b/ someone posted this code snippet, i was wondering what it does when executed? it appears to be C code, how harmful is it? This is the full post: Run a live ...
0
votes
1answer
143 views

Clicked link on fake email which appeared to be from friend [duplicate]

I receieved an e-mail which at first glance appeared to be from a friend, I clicked on the link provided without thinking as we would often exchance links to sites. The link went nowhere i.e page not ...
131
votes
9answers
55k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
-6
votes
1answer
147 views

how to back track a phishing attach? (without being infected) [closed]

This morning i received this funky looking email from Cerys Evans about a private message he sent my way. First and foremost I want to mention the lack of design talents this attack employed and ...
2
votes
1answer
4k views

Is this Facebook email real or phishing?

I received this email from what is supposedly Facebook today. Here's a screenshot: I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate ...
-4
votes
3answers
259 views

Why doesn't Google Safe Browsing block the IP addresses of malicious websites?

If you visit a blocked domain name like www.thelotbet.cn from Google Chrome, Opera or Firefox, you will get a warning from Google Safe Browsing that this is a malicious website. But if you visit the ...
2
votes
1answer
101 views

Could I counter SiteKey MitM attack with user-agent identification?

I find it very strange that bank use service like SiteKey without user-agent identification. This still makes them very vulnerable to MitM attack which is exactly what they are trying to protect ...
0
votes
2answers
131 views

How did an attacker spoof (or add to) this myspace's login form?

In the attack detailed here, I see that a hacker has actually added a malicious post link. What I do not understand is how the attacker added it to the actual myspace.comdomain. Obviously this is an ...
2
votes
1answer
137 views

Anti-phishing educational resources for users?

I'm am looking into conducting a phishing campaign to gauge how susceptible my workplace is to phishing attacks. Part of this will involve guiding "duped" users to materials or resources that will ...
0
votes
1answer
81 views

which password was paired with my gmail address

Recently media have reported that a file of about 5 million gmail address and password pairs was published on a Russian Bitcoin forum. A media article on the leak Other media have reported that the ...
1
vote
1answer
73 views

Suspicious phone call claiming MS Office not updated lately

I recently received two phone calls where the caller indicated that according to their log activity, MS Office has not been updated lately. They offered to help me get those updates. What kinds of ...
1
vote
3answers
103 views

Prevent someone from using your site for phishing?

So I have a site where users can create online surveys and send them out to whomever they like. Over the past few months we have seen an uptick in one particular user who creates an account, then ...
3
votes
2answers
269 views

How browser detects Phishing Pages?

I want to know how browsers detect phishing pages.And also what methodology browsers use to detect phishing pages?
2
votes
1answer
105 views

Is asking for credentials from a separate trusted domain an acceptable practice?

I know of at least two pages that I would have just assumed were a phishing scheme if I didn't know any better. Serverfault.com is a stack exchange site on a different domain, however if you click to ...
2
votes
2answers
175 views

Is my PC safe? need help

About 6 days ago my parents who aren't great with PCs got phished on gmail, and the account started spreading spam. It had been hacked on an Argentinian IP, and then logged in from IMAP and SMTP from ...
3
votes
1answer
145 views

How to detect if a user is logged in to a specific website?

I just learn about tabnabbing. Tabnabbing is a computer exploit and phishing attack, which persuades users to submit their login details and passwords to popular websites by impersonating ...
2
votes
2answers
25k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
166
votes
3answers
26k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...