Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.
2
votes
1answer
89 views
How Browsers prevents Malware and Phishing attacks
I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
1
vote
6answers
4k views
Is update@em.facebookmail.com legitimate?
I'm having a hard time figuring out whether this email a friend of mine got is legit or a scam. The weird thing is there's only one link to facebook.com, which is the one about facebook terms. All the ...
0
votes
2answers
69 views
How do I obtain user info from SET?
I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
7
votes
3answers
1k views
If someone bought the .local TLD could that be a security risk?
Now that the ICANN is allowing custom Top Level Domain names and often cooperate IT workers like to use .local as the TLD for internal networks, if someone does buy the .local TLD what are some ...
13
votes
4answers
410 views
Effectiveness of Security Images
Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater?
Per my understanding, if somebody is phishing your users, it's ...
0
votes
2answers
683 views
Spam that comes from names in my address book, but not their email addresses
I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be.
Specifically, the names -- but not the email ...
21
votes
4answers
643 views
Security seals and the “perception of safety”?
I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...
3
votes
2answers
168 views
Is Yahoo SignIn Seal effective at phishing prevention? [duplicate]
Possible Duplicate:
Effectiveness of Security Images
Information about the efficacy of Yahoo's SignIn Seal is scarce, the best I could find was this section on Wikipedia's entry on ...
26
votes
3answers
668 views
What is this authentication method/approach called?
Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
4
votes
3answers
236 views
Is SiteKey a valid defense against Phishing?
As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. The comments and answers indicate some issues with this approach, but that question wasn't ...
3
votes
1answer
330 views
Looking for URL Blacklists of Malicious Websites [closed]
Is there a maintained list of URLs that contain malicious content. These URLs may be involved in Phishing, Scams, Viri, or other Malware.
Please indicate in your answer if the list is freely ...
1
vote
3answers
103 views
Anti-Phishing Campaign Objective
At every office I have worked, links and files, both internal and external, are shared in emails.
Is the objective of an anti-phishing campaign that users never click on blind, or otherwise ...
2
votes
3answers
138 views
Report an email address being used by a phisher
A close friend fell for a phishing scam earlier today. His account's all squared up now, but I decided to do a bit of investigation.
The website he fell for was a very poor imitation of a Remax site ...
2
votes
4answers
319 views
Yahoo Email Keeps Getting Phished
I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
3
votes
3answers
253 views
I stupidly responded to an email from a hacker posing as a friend
I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...
7
votes
3answers
361 views
Is a mobile app more secure for mobile use than the “normal” website?
An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
5
votes
4answers
9k views
Reminder: Reset your password - phishing or genuine Facebook email?
An email claiming to be from facebook had the following content:
Hi Andrew,
You recently requested a new password for your Facebook account. It looks like we sent you an email with a link to ...
10
votes
6answers
369 views
What are effective ways to prevent targeted phishing?
Phishing is a very serious problem that we face. Popular banks are often the biggest targets. What methods can a bank website use to protect its self from phishing attacks? What security systems ...
0
votes
2answers
150 views
Security concern to implement a web based remote desktop
I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class.
I can configure the ...
6
votes
2answers
299 views
Will reporting phishing emails cause problems for the victim?
On GMail, I've received a phishing email from someone I know, and the email has been sent to other people the victim knows. One of the emails is claiming to be from their GMail address, while the ...
1
vote
1answer
130 views
Is there formal guidance that requires all sessions to be logged off when a user changes their password?
Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active.
Is ...
6
votes
3answers
2k views
Is it possible for a phishing link to install a major virus on a Mac?
My girlfriend recently had her university MS Exchange account hacked. The attacker took over her email account and started using it to send thousands of spam emails. After a while, her email account ...
5
votes
3answers
476 views
Phishing virus found on server
I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
2
votes
1answer
232 views
Why is a link posted to Facebook going through all redirects and showing info for final page only?
Today I read a post on a Facebook-group about a "problem" with links posted to Facebook.
Appearently when you post a link at Facebook, the sites goes through the redirect(s) that may be on the site ...
0
votes
1answer
301 views
Phishing attack stuck with jsp loginAction.do page? [closed]
I'm testing a phishing website on a staged replica of an jsp web-application. I'm doing the usual attack which involves changing the post and action field of source code to divert to my own written ...
1
vote
4answers
141 views
how to identify whether my page is phished or normal page?
Usually I differentiate phished page and normal web pages by seeing https before the address of the web page, as the lock symbol will help us to identify.
Are there any other methods to differentiate ...
4
votes
3answers
131 views
Best way to handle identity theft incident?
A user's email is hacked, contacts copied, and similar emails (look alike emails with minor spelling differences) are created by the attacker with the same name and avatar, sending relatively well ...
0
votes
2answers
261 views
Can a man engaged in phishing be prosecuted if I know his IP?
My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
6
votes
3answers
458 views
Is this phishing or the real PayPal?
This has all traits of phishing, apart from the extended validation SSL cert. Is this site run by the real PayPal?
39
votes
9answers
4k views
Risks of giving developers admin rights to their own PCs
I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
0
votes
2answers
92 views
Is Google a feasible tool for an organization to check if their name is being used in phishing sites?
Is it feasible for an organization to use Google and the available Google search operators (e.g. allinurl, etc) to find out if their organization name is being spoofed or used in phishing sites and ...
2
votes
2answers
218 views
when you are phished, what do they get?
Lets say I was foolish enough to press on a youtube video on facebook that ended up being what I suspect is a phishing link. What can they potentially get?
I had three tabs open: (1) my phpMyAdmin ...
1
vote
2answers
599 views
How to react on a message about a pending account ban on Facebook? [closed]
Are you getting this message on chat?
LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable ...
13
votes
5answers
530 views
Are address bars unphishable?
I've taken, out of curiosity, the Phishing Quiz by OpenDNS that tries to teach the general public about detecting phishing:
Ever wonder how good you are at telling the difference between a ...
3
votes
2answers
85 views
Automated browser-level countermeasures to look-alike login pages
For example, say an unsuspecting visitor gets a link security.stackexchange.com/.... Then it re-opens the login page, with or without an explanation as to why they have to log in again. (this is more ...
3
votes
2answers
1k views
Some questions about penetration testing distribution Backtrack 5
I know just the basics of backtrack and I want to ask some questions about it:
Can you attack an ftp server using backtrack? an email server?
I have a Centos virtual private server and backtrack is ...
8
votes
5answers
281 views
In what ways do some banks inadequately advise their customers on online security?
I'm looking for specific examples of things such as:
Misleading, but common advice
Advice which has backfired
Advice which is just, quite simply, incorrect
which have been circulated time and time ...
18
votes
2answers
663 views
A phone call hack
The other day, I got a call from a relative with an email problem. After a bit more discussion, it turns out that two days previously, a man phoned my relative:
stated he was from microsoft;
asked ...
10
votes
4answers
489 views
“Phishing” red flags and countermeasures
Given the recent spate of intrusions into various networks which have included compromise of subscriber identity and contact information, I figured it would be good for us to have a thread on how to ...
