Social engineering is the act of manipulating people into performing actions or divulging confidential information.

learn more… | top users | synonyms

4
votes
5answers
414 views

Using unique email address for online signups?

After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security. We can only do so much too protect ourselves because at the ...
13
votes
4answers
3k views

Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 &...
0
votes
3answers
85 views

should I give the csrf token a descriptive name?

Personally I want to call the element _DO_NOT_give_this_security_thingy_to_anybody_ever. An example scenario is some clever social engineers want the user to run a malicious "add a friend" and find ...
1
vote
3answers
86 views

How can I mitigate attacks that rely on poisoned data as a developer?

A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the ...
0
votes
2answers
91 views

Is “user education” actually doable?

I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all. Are there any amazing success (or horrible ...
-2
votes
1answer
79 views

Voicemail PIN reset - what is a DDN? [closed]

Here is a recording of Glenn Mulcaire using social engineering to reset the PINs to voice mailboxes to which he did not have authorised access. (At least, that's my understanding.) He appears to say ...
0
votes
2answers
201 views

Malicious capabilities of Social Botnets

A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked ...
1
vote
2answers
73 views

Reverse SE: Technology or Human based?

In Reverse Social Engineering the hacker deliberately sabotages a network, causing a problem to arise. That hacker then advertises that he is the appropriate contact to fix the problem, and when he or ...
2
votes
5answers
291 views

How do big companies ensure that other people don't register a new top level domain with their name?

For example today there are ".codes", ".farm" and ".vaijes" newly available. How do big companies like google, facebook, twitter, .. keep sure that they are the first who register their name on the ...
0
votes
1answer
237 views

Is this social engineering on facebook?

Today, I received a mail from fb saying that two of my friends have mentioned me in a comment. When I opened fb to see that comment, it was filled with random names (which obviously were their friends/...
1
vote
1answer
105 views

What to put in outer volume of encrypted volume? [closed]

TrueCrypt offers the ability to have a hidden volume. What should go in the outer volume that would be revealed to an adversary? It's actually pretty tricky: you'd have to convince the adversary it ...
2
votes
1answer
227 views

Should police departments recommend the securit.leadsonline.com website as a secure place to store information about our valuables?

This is kind of a social engineering question -- my local law enforcement agency sent out this email today: Help us by keeping identifying information about your valuables safe and accessible – ...
2
votes
3answers
885 views

EICAR alternative for IDS/IPS

Is there a way to trigger alarms in an Intrusion Detection System with something similar to the EICAR test virus? Maybe some special packet that is harmless to the environement, but will trigger IDS? ...
0
votes
2answers
803 views

Is Google Drive security compromised?

Today when I visited drive.google.com, I was auto-directed to http://drive.googe.com/router.php After clicking on "Exit Now" on that page I was redirected to http://globalreward-zone.sweepclam.eu/...
1
vote
0answers
82 views

Backdoor file with custom payload

Is there a way in metasploit to add a custom exe/script as payload to a file (exe/pdf/doxc)? I'm asking this in the context of a SE media dropping scenario, where a file when executed, sends data to ...
1
vote
2answers
172 views

Detect blocked reverse shell

I am wondering if there is a way to detect if a reverse shell is blocked by egress filtering or an obligatory proxy, or the exploit just failed. I am asking this question in the context of a SE media ...
0
votes
1answer
100 views

Impersonating Law Enforcement

Obviously impersonating a law enforcement officer on an engagement is illegal but badguys don't care about the law. If a company wanted to allow impersonating LE and have it in clear writing in the ...
5
votes
4answers
510 views

Contact person by phone, when their phone might have malware

I have a problem setting where I want to contact a user by phone, and where I need to protect the integrity of the phone call as much as possible. I'm wondering about how to design the interaction in ...
11
votes
3answers
9k views

Why would someone register a Facebook account with a stolen email address?

I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
33
votes
7answers
2k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
1
vote
2answers
94 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
2
votes
1answer
110 views

Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?

Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
1
vote
1answer
347 views

List of social engineering hacks and defenses [closed]

Sorry if this question is absolutely stupid or irrelevant, but I can't help but ask. I am just curious about different approaches hackers take in social engineering attacks, and clever examples of ...
3
votes
1answer
1k views

How to detect social engineering attack?

How can I understand if I am being targeted by a grey hat social engineer? And if I fail, what approaches exist to detect social engineering attacks being in progress within an organisation?
2
votes
2answers
754 views

Ways to obfuscate web browsing habits [duplicate]

Web browsing metadata provides a lot of insight on person's habits. How can I reduce that insight? Is there something like "Detachment 2702" (http://en.wikipedia.org/wiki/Cryptonomicon) plugin for ...
4
votes
1answer
293 views

They think I am their IT Dept…What to do about it?

I have been asked to test out any security holes for a company. I created an email account that looks similar to their IT department's address and everybody is complying :) I have only asked them to ...
0
votes
2answers
106 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
10
votes
6answers
822 views

Does not having https moot this entire site?

On a bank website the other day, I noticed that they were giving out a phone number on a page that wasn't over https. This seemed really wrong to me, since it would allow somebody to change the phone ...
1
vote
3answers
232 views

What day-to-day activities can compromise a person's information security [closed]

Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
2
votes
2answers
356 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: https://www.site.com/opis.swf?...
3
votes
3answers
381 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft Security,...
2
votes
1answer
217 views

Exposure risk of knowing only social security number?

Up until recently I was under the impression that the social security number was insufficient information to perform identity theft, and that in practice you will at least need the victim's SSN and ...
2
votes
3answers
4k views

Will this work? Revealing identity (facebook) of person who clicks specially crafted link

There is a special Facebook link that will redirect anyone who clicks it to their own Facebook profile they are currently logged in on on their browser. The link goes like this: http://www.facebook....
6
votes
4answers
424 views

Automating Social Engineering Prevention

Being an advocate for DIO (defensive information operations), I have always been concerned about social engineering and its relation to server security. Giving administrative access to staff members ...
7
votes
5answers
581 views

How can we get into the user's mindset?

As security folk, we tend to over- or under-estimate the capabilities and educatedness of our users, especially in terms of resistance to social engineering attacks. Stereotypically, this is due to ...
5
votes
3answers
234 views

Best way to handle identity theft incident?

A user's email is hacked, contacts copied, and similar emails (look alike emails with minor spelling differences) are created by the attacker with the same name and avatar, sending relatively well ...
3
votes
2answers
506 views

How to mimic an emotion?

Microexpression is a brief facial expression according to emotions experienced. It is also one of the most powerful SE (social engineering) weapons. However, they are very hard to master. Are they ...
2
votes
2answers
201 views

E-mail Server Security

In recent news, Bitcoinica was compromised by an e-mail server infiltration. The hacker then applied social engineering, using one of the administrative e-mail accounts to reset the root credentials ...
3
votes
1answer
892 views

When a company asks to test physical security, what are some techniques one could use to gain entry?

When a company asks to test physical/infrastructure security, what are some techniques one could use to test employees? This could include good excuses to gain access to some hardware/software.
1
vote
2answers
197 views

How to educate users about the dangers of social engineering?

What would be the best way to teach and test employees on the topic of social engineering? What topics would you include?
7
votes
3answers
1k views

Theory X vs Theory Y in social engineering

Theory X and Theory Y are two models of human motivation, often used when discussing people-management in business. In short, Theory X postulates people are lazy, will avoid work, and require ...
1
vote
3answers
682 views

What is social engineering, how does it relate to security and how can it affect my business? [duplicate]

Possible Duplicate: Is social-engineering an actual threat What is social engineering? Can you give me some examples? Can social engineering have a big impact on business?
3
votes
3answers
365 views

“Doxing” users on Social Media

I hope this question falls within the scope of the faq...I'm curious to see what kind of answers I get. Suppose the following A user is posting libel and slander on social media (lets say Twitter ...
2
votes
3answers
187 views

How can I help an online identity theft potential victim?

I just learned that my dad fell for a online green card lottery scam. It happened over 3 years ago, the attacker took 60$ and disappeared. I am not even considering getting this money back. On the ...
14
votes
7answers
1k views

Has cryptography reached the development level where social engineering is the only reliable method of attack?

Note that for the purpose of this question, "social engineering" means extracting information from humans, be your methods compliant with Geneva Conventions or not. Simply put: Do cryptographic ...
19
votes
2answers
620 views

How secure is Stack Exchange's reputation?

I recently read an article about researchers being able to penetrate the Facebook network and making lots of friends with about 100 "Social" bots. What would prevent somebody to do the same on Stack ...
6
votes
2answers
324 views

What is the Ethics and Legality of Grabbing Data from Social Networks to aid a Pentest?

What is the ethics and legality of developing and using a tool to grab data on employees in the client's company in social networks such as facebook, twitter and linkedin. The data should then be used ...
2
votes
1answer
163 views

Industrial security — resources for ISO27k compliance, social-engineering trend reports

I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
3
votes
2answers
234 views

Security Training for corporate Facebook users

One of my clients is looking at allowing their employees to access Twitter and Facebook from work. I have highlighted the need for training, and I have material to present, but what do you think ...
7
votes
1answer
112 views

Mitigating risk from electronic payments

When attempting to sell a product online (for instance, on craigslist) there is a very good chance you will be the target of a social engineer; this is especially true when you are selling high-value ...