Social engineering is the act of manipulating people into performing actions or divulging confidential information.

learn more… | top users | synonyms

2
votes
3answers
136 views

How can I help an online identity theft potential victim?

I just learned that my dad fell for a online green card lottery scam. It happened over 3 years ago, the attacker took 60$ and disappeared. I am not even considering getting this money back. On the ...
3
votes
3answers
305 views

“Doxing” users on Social Media

I hope this question falls within the scope of the faq...I'm curious to see what kind of answers I get. Suppose the following A user is posting libel and slander on social media (lets say Twitter ...
18
votes
2answers
574 views

How secure is Stack Exchange's reputation?

I recently read an article about researchers being able to penetrate the Facebook network and making lots of friends with about 100 "Social" bots. What would prevent somebody to do the same on Stack ...
0
votes
3answers
620 views

Are Facebook, Yahoo, Google, etc. hackable?

Just to be clear, I am not asking how to hack in these services, I am just curious. Let me try to explain. Since I know a little bit about computers, people automatically assume I know how to have, ...
2
votes
1answer
144 views

Industrial security — resources for ISO27k compliance, social-engineering trend reports

I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
3
votes
2answers
167 views

Security Training for corporate Facebook users

One of my clients is looking at allowing their employees to access Twitter and Facebook from work. I have highlighted the need for training, and I have material to present, but what do you think ...
6
votes
1answer
103 views

Mitigating risk from electronic payments

When attempting to sell a product online (for instance, on craigslist) there is a very good chance you will be the target of a social engineer; this is especially true when you are selling high-value ...
11
votes
3answers
5k views

Why would someone register a Facebook account with a stolen email address?

I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
79
votes
7answers
4k views

Is social-engineering an actual threat

I've recently finished book The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick The book was released on 4th December 2002. Not talking only about techniques described ...
1
vote
1answer
102 views

Detecting and Responding to Email Account Compromise (regarding FINRA 12-05, ISAC/IC3 alerts)

FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information. They then use social engineering / persuasion to complete the attack. What ...
1
vote
2answers
828 views

How to react on a message about a pending account ban on Facebook? [closed]

Are you getting this message on chat? LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable ...
8
votes
5answers
3k views

How to catch a gmail hacker/money-scammer? (in conversation with one right now!)

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
2
votes
1answer
839 views

Social Engineer Toolkit (Cloning Sites)

Is it legal or illegal to use the cloning site option within the social engineer toolkit (SET) or any other tool that clones websites? I was under the impression that if performing a social engineer ...
3
votes
2answers
545 views

When is an intermediate page needed before directing a user off my primary website? What is the best implementation?

The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example). I've seen this used in Exchange Outlook Web Access ...
19
votes
3answers
4k views

Google hacking - why “numrange” is so dangerous?

I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this ...
6
votes
3answers
303 views

Are there password/passphrase guessers/crackers which can utilize facts supplied about the target?

I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't. ...
18
votes
5answers
872 views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
15
votes
5answers
902 views

Does two factor authentication prevent social engineering attacks

After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password. Considering three different additional ...
8
votes
2answers
6k views

Reversing an entry card - How to find out what type of RFID hardware I need to read the chip?

I have an acccess/entry card chip I want to copy for demonstrational purposes. However I am not sure how I can find out what type of RFID reader I need to get a hold of. Does anyone have a ...
17
votes
11answers
872 views

How to persuade average people that security matters?

If people could be fooled in life so easily ( http://www.bbc.co.uk/realhustle/ ) then in computing.... So what are the best tips, to persuade a regular user to pay a little more attention to ...
8
votes
2answers
240 views

How do you address a social engineering and or software weakness/concern in a company or organisation?

Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change ...