Social engineering is the act of manipulating people into performing actions or divulging confidential information.

learn more… | top users | synonyms

0
votes
2answers
101 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
10
votes
6answers
795 views

Does not having https moot this entire site?

On a bank website the other day, I noticed that they were giving out a phone number on a page that wasn't over https. This seemed really wrong to me, since it would allow somebody to change the phone ...
0
votes
3answers
191 views

What day-to-day activities can compromise a person's information security [closed]

Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
2
votes
2answers
322 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
3
votes
3answers
355 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft ...
2
votes
1answer
195 views

Exposure risk of knowing only social security number?

Up until recently I was under the impression that the social security number was insufficient information to perform identity theft, and that in practice you will at least need the victim's SSN and ...
2
votes
3answers
1k views

Will this work? Revealing identity (facebook) of person who clicks specially crafted link

There is a special Facebook link that will redirect anyone who clicks it to their own Facebook profile they are currently logged in on on their browser. The link goes like this: ...
5
votes
4answers
399 views

Automating Social Engineering Prevention

Being an advocate for DIO (defensive information operations), I have always been concerned about social engineering and its relation to server security. Giving administrative access to staff members ...
7
votes
5answers
524 views

How can we get into the user's mindset?

As security folk, we tend to over- or under-estimate the capabilities and educatedness of our users, especially in terms of resistance to social engineering attacks. Stereotypically, this is due to ...
4
votes
3answers
211 views

Best way to handle identity theft incident?

A user's email is hacked, contacts copied, and similar emails (look alike emails with minor spelling differences) are created by the attacker with the same name and avatar, sending relatively well ...
3
votes
2answers
432 views

How to mimic an emotion?

Microexpression is a brief facial expression according to emotions experienced. It is also one of the most powerful SE (social engineering) weapons. However, they are very hard to master. Are they ...
2
votes
2answers
184 views

E-mail Server Security

In recent news, Bitcoinica was compromised by an e-mail server infiltration. The hacker then applied social engineering, using one of the administrative e-mail accounts to reset the root credentials ...
3
votes
1answer
616 views

When a company asks to test physical security, what are some techniques one could use to gain entry?

When a company asks to test physical/infrastructure security, what are some techniques one could use to test employees? This could include good excuses to gain access to some hardware/software.
1
vote
2answers
182 views

How to educate users about the dangers of social engineering?

What would be the best way to teach and test employees on the topic of social engineering? What topics would you include?
6
votes
3answers
988 views

Theory X vs Theory Y in social engineering

Theory X and Theory Y are two models of human motivation, often used when discussing people-management in business. In short, Theory X postulates people are lazy, will avoid work, and require ...
0
votes
3answers
551 views

What is social engineering, how does it relate to security and how can it affect my business? [duplicate]

Possible Duplicate: Is social-engineering an actual threat What is social engineering? Can you give me some examples? Can social engineering have a big impact on business?
3
votes
3answers
338 views

“Doxing” users on Social Media

I hope this question falls within the scope of the faq...I'm curious to see what kind of answers I get. Suppose the following A user is posting libel and slander on social media (lets say Twitter ...
2
votes
3answers
170 views

How can I help an online identity theft potential victim?

I just learned that my dad fell for a online green card lottery scam. It happened over 3 years ago, the attacker took 60$ and disappeared. I am not even considering getting this money back. On the ...
13
votes
7answers
1k views

Has cryptography reached the development level where social engineering is the only reliable method of attack?

Note that for the purpose of this question, "social engineering" means extracting information from humans, be your methods compliant with Geneva Conventions or not. Simply put: Do cryptographic ...
18
votes
2answers
601 views

How secure is Stack Exchange's reputation?

I recently read an article about researchers being able to penetrate the Facebook network and making lots of friends with about 100 "Social" bots. What would prevent somebody to do the same on Stack ...
6
votes
2answers
306 views

What is the Ethics and Legality of Grabbing Data from Social Networks to aid a Pentest?

What is the ethics and legality of developing and using a tool to grab data on employees in the client's company in social networks such as facebook, twitter and linkedin. The data should then be used ...
2
votes
1answer
153 views

Industrial security — resources for ISO27k compliance, social-engineering trend reports

I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
3
votes
2answers
173 views

Security Training for corporate Facebook users

One of my clients is looking at allowing their employees to access Twitter and Facebook from work. I have highlighted the need for training, and I have material to present, but what do you think ...
7
votes
1answer
109 views

Mitigating risk from electronic payments

When attempting to sell a product online (for instance, on craigslist) there is a very good chance you will be the target of a social engineer; this is especially true when you are selling high-value ...
1
vote
2answers
890 views

How to react on a message about a pending account ban on Facebook? [closed]

Are you getting this message on chat? LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable ...
1
vote
1answer
107 views

Detecting and Responding to Email Account Compromise (regarding FINRA 12-05, ISAC/IC3 alerts)

FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information. They then use social engineering / persuasion to complete the attack. What ...
2
votes
1answer
983 views

Social Engineer Toolkit (Cloning Sites)

Is it legal or illegal to use the cloning site option within the social engineer toolkit (SET) or any other tool that clones websites? I was under the impression that if performing a social engineer ...
4
votes
2answers
694 views

When is an intermediate page needed before directing a user off my primary website? What is the best implementation?

The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example). I've seen this used in Exchange Outlook Web Access ...
18
votes
5answers
931 views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
18
votes
11answers
985 views

How to persuade average people that security matters?

If people could be fooled in life so easily ( http://www.bbc.co.uk/realhustle/ ) then in computing.... So what are the best tips, to persuade a regular user to pay a little more attention to ...
6
votes
3answers
318 views

Are there password/passphrase guessers/crackers which can utilize facts supplied about the target?

I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't. ...
15
votes
5answers
979 views

Does two factor authentication prevent social engineering attacks

After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password. Considering three different additional ...
8
votes
2answers
261 views

How do you address a social engineering and or software weakness/concern in a company or organisation?

Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change ...