Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

24
votes
4answers
4k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
25
votes
5answers
2k views

Are address bars unphishable?

I've taken, out of curiosity, the Phishing Quiz by OpenDNS that tries to teach the general public about detecting phishing: Ever wonder how good you are at telling the difference between a ...
19
votes
4answers
3k views

“Phishing” red flags and countermeasures

Given the recent spate of intrusions into various networks which have included compromise of subscriber identity and contact information, I figured it would be good for us to have a thread on how to ...
12
votes
3answers
2k views

Is SiteKey a valid defense against Phishing?

As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. (This is a scheme where the user is shown a personalized image (each user has their own ...
31
votes
2answers
4k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
5
votes
1answer
72 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
8
votes
1answer
12k views

Looking for URL Blacklists of Malicious Websites [closed]

Is there a maintained list of URLs that contain malicious content. These URLs may be involved in Phishing, Scams, Viri, or other Malware. Please indicate in your answer if the list is freely ...
7
votes
4answers
3k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
174
votes
3answers
30k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
3
votes
2answers
295 views

Spear phishing data set

Are there any existing data sets of spear phishing emails available? I've found a bunch of data sets of phishing emails, but that's not what I'm looking for. I'm not looking for mass phishing ...
140
votes
9answers
115k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
12
votes
6answers
905 views

What are effective ways to prevent targeted phishing?

Phishing is a very serious problem that we face. Popular banks are often the biggest targets. What methods can a bank website use to protect its self from phishing attacks? What security systems ...
36
votes
5answers
5k views

Are there actions taken against websites that deliver malware?

There are serious tools and services such as Google Safe Browsing for malicious and phishing websites, and others fully dedicated to phishing websites such as Phishing.org. What is done against these ...
27
votes
3answers
1k views

What is this authentication method/approach called?

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
4
votes
1answer
128 views

Databases with spam, phishing email examples [duplicate]

I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc). I order to do this I need to have a ...
1
vote
3answers
281 views

Are subdomains a cure for phishing?

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
0
votes
2answers
1k views

Exploiting an Open Redirect in POST body?

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after ...
59
votes
8answers
13k views

Risks of giving developers admin rights to their own PCs

I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain ...
73
votes
6answers
14k views

Why do phishing emails have spelling and grammar mistakes?

Are the spelling and grammar mistakes in phishing emails done on purpose? Is there some wisdom behind it? Or they are simply indicative of the fact that they've been written by someone who does not ...
72
votes
8answers
10k views

How to distinguish between a scam and a genuine call?

My bank called me the other day and the person who spoke to me failed to give me a single evidence that he is calling from my bank. The bank number is hidden just like many other companies maybe ...
7
votes
1answer
426 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
14
votes
1answer
2k views

Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?

I can't believe it happened to me but I entered Gmail account's user-name and password into a website as part of a phishing scam. I use Gmail's 2-step verification and have changed my password. Is ...
10
votes
3answers
5k views

If someone bought the .local TLD could that be a security risk?

Now that the ICANN is allowing custom Top Level Domain names and often corporate IT workers like to use .local as the TLD for internal networks, if someone does buy the .local TLD what are some ...
23
votes
2answers
1k views

A phone call hack

The other day, I got a call from a relative with an email problem. After a bit more discussion, it turns out that two days previously, a man phoned my relative: stated he was from microsoft; asked ...
5
votes
6answers
24k views

Is update@em.facebookmail.com legitimate?

I'm having a hard time figuring out whether this email a friend of mine got is legit or a scam. The weird thing is there's only one link to facebook.com, which is the one about facebook terms. All the ...
1
vote
1answer
454 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
1
vote
1answer
118 views

Suspicious phone call claiming MS Office not updated lately

I recently received two phone calls where the caller indicated that according to their log activity, MS Office has not been updated lately. They offered to help me get those updates. What kinds of ...
-5
votes
1answer
1k views

how to back track a phishing attach? (without being infected) [closed]

This morning i received this funky looking email from Cerys Evans about a private message he sent my way. First and foremost I want to mention the lack of design talents this attack employed and ...
10
votes
6answers
1k views

Is this “security update” from security-update@amazon.com an advanced phishing scam or a real security measure from Amazon?

I just got either a helpful security update from Amazon or an advanced phishing attempt by an Amazon impersonator falsifying the email origin. The title is "Your Amazon password has been changed". ...
7
votes
2answers
60k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
6
votes
3answers
980 views

Phishing virus found on server

I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
6
votes
1answer
2k views

What can happen if someone gets a hold of a scan of someone else's passport?

Or: "Do I need to be concerned about emailing people scans of my passport if they want to verify my identity?" Is there anything anyone can do with the information on the main page of the passport ...
4
votes
1answer
4k views

A “new domain registration” spam?

About 6 days ago I purchased a new domain under .org TLD from a local registrar. Few days later, I have received this strange message (which BTW fell to Gmail spam bin), which looks like some kind of ...
3
votes
1answer
625 views

Phishing email from Avast - Headers look totally legit?

Below is the email with headers. I never registered on the site, so it's clearly phishing, but the links in the email point to the real Avast site. The delivery path also looks legit since both IP ...
1
vote
1answer
162 views

Email phishing scam asking customers for card details

I work for a small ecommerce company and over the weekend we received a few emails from customers claiming to have received an email asking them to confirm their card details to process their orders. ...
0
votes
2answers
443 views

Can a man engaged in phishing be prosecuted if I know his IP?

My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
0
votes
1answer
111 views

“Secure” emails from unfamiliar source(s)

The context is long, so I'll ask my question first. If an encrypted message is received from an unfamiliar sender and it's spam, how can I avoid receiving further messages of the same sort? If it's ...
0
votes
1answer
136 views

Phishing Gmail account [duplicate]

I received a mail from a friend who I was playing together in a multiplayer game. And it had a link to phishing page which would ask to login to view the file that the sent me. And my antivirus found ...