Social engineering is the act of manipulating people into performing actions or divulging confidential information.

learn more… | top users | synonyms

3
votes
2answers
232 views

Security Training for corporate Facebook users

One of my clients is looking at allowing their employees to access Twitter and Facebook from work. I have highlighted the need for training, and I have material to present, but what do you think ...
3
votes
2answers
219 views

Spear phishing data set

Are there any existing data sets of spear phishing emails available? I've found a bunch of data sets of phishing emails, but that's not what I'm looking for. I'm not looking for mass phishing ...
3
votes
1answer
1k views

How to detect social engineering attack?

How can I understand if I am being targeted by a grey hat social engineer? And if I fail, what approaches exist to detect social engineering attacks being in progress within an organisation?
3
votes
2answers
73 views

How do I tell the difference between a fake “problem loading page” and a real one?

We know that due to numerous reasons, a browser will display a page like "Problem loading page" or "This page can’t be displayed." But there's one huge problem: browsers seem to show this error page ...
3
votes
1answer
73 views

How to recover/log attempted passwords from a failed login [closed]

I saw the following question before: Is it legal to log passwords from failed logins? I think it raises another question: How do I log failed attempted passwords? That seems very useful when I need ...
2
votes
3answers
782 views

EICAR alternative for IDS/IPS

Is there a way to trigger alarms in an Intrusion Detection System with something similar to the EICAR test virus? Maybe some special packet that is harmless to the environement, but will trigger IDS? ...
2
votes
3answers
3k views

Will this work? Revealing identity (facebook) of person who clicks specially crafted link

There is a special Facebook link that will redirect anyone who clicks it to their own Facebook profile they are currently logged in on on their browser. The link goes like this: ...
2
votes
2answers
351 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
2
votes
5answers
273 views

How do big companies ensure that other people don't register a new top level domain with their name?

For example today there are ".codes", ".farm" and ".vaijes" newly available. How do big companies like google, facebook, twitter, .. keep sure that they are the first who register their name on the ...
2
votes
3answers
184 views

How can I help an online identity theft potential victim?

I just learned that my dad fell for a online green card lottery scam. It happened over 3 years ago, the attacker took 60$ and disappeared. I am not even considering getting this money back. On the ...
2
votes
2answers
196 views

E-mail Server Security

In recent news, Bitcoinica was compromised by an e-mail server infiltration. The hacker then applied social engineering, using one of the administrative e-mail accounts to reset the root credentials ...
2
votes
1answer
108 views

Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?

Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
2
votes
1answer
1k views

Social Engineer Toolkit (Cloning Sites)

Is it legal or illegal to use the cloning site option within the social engineer toolkit (SET) or any other tool that clones websites? I was under the impression that if performing a social engineer ...
2
votes
2answers
706 views

Ways to obfuscate web browsing habits [duplicate]

Web browsing metadata provides a lot of insight on person's habits. How can I reduce that insight? Is there something like "Detachment 2702" (http://en.wikipedia.org/wiki/Cryptonomicon) plugin for ...
2
votes
1answer
213 views

Exposure risk of knowing only social security number?

Up until recently I was under the impression that the social security number was insufficient information to perform identity theft, and that in practice you will at least need the victim's SSN and ...
2
votes
1answer
160 views

Industrial security — resources for ISO27k compliance, social-engineering trend reports

I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
2
votes
1answer
80 views

What are the implications of using OAUTH? Do the positives outweigh the negatives? [closed]

OAUTH seems like a pretty good idea when it comes to helping people authenticate, cuts down on the # of passwords to remember and in general eases the friction of on-boarding. However it would mean ...
2
votes
1answer
219 views

Should police departments recommend the securit.leadsonline.com website as a secure place to store information about our valuables?

This is kind of a social engineering question -- my local law enforcement agency sent out this email today: Help us by keeping identifying information about your valuables safe and accessible – ...
2
votes
0answers
160 views

SET tool autopwn website type penetration [closed]

I tried to hack my second computer and phone in my local network. I am not very experienced so instead of picking the particular options and payloads i just pressed autopwn to use them all instantly. ...
1
vote
3answers
671 views

What is social engineering, how does it relate to security and how can it affect my business? [duplicate]

Possible Duplicate: Is social-engineering an actual threat What is social engineering? Can you give me some examples? Can social engineering have a big impact on business?
1
vote
3answers
781 views

Are Facebook, Yahoo, Google, etc. hackable?

What I would consider to be hacking one of these services is something along the lines of cracking databases (or I think what would be databases). In reality, I have no idea how sites like these store ...
1
vote
2answers
154 views

Detect blocked reverse shell

I am wondering if there is a way to detect if a reverse shell is blocked by egress filtering or an obligatory proxy, or the exploit just failed. I am asking this question in the context of a SE media ...
1
vote
2answers
925 views

How to react on a message about a pending account ban on Facebook? [closed]

Are you getting this message on chat? LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable ...
1
vote
2answers
101 views

Is there a Standard Verification process for Certificate Authorities to follow?

So the premise of the question is to quantify the risk of wild card certificates versus regular certificates. From my research the greatest fundamental danger of wild card certificates is the ...
1
vote
2answers
5k views

Having Trouble using SET in Kali

I'm trying to setup a website attack vector and I get in error when it tries to load up metasploit. Here's a look at my whole process: Select from the menu: 1) Spear-Phishing Attack Vectors ...
1
vote
3answers
226 views

What day-to-day activities can compromise a person's information security [closed]

Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
1
vote
1answer
104 views

Difficulty using SET within Kali Linux

When setting a website attack vector, I find that Kali does not give me the option to specify a port in order to receive information back to my local. Furthermore, I am unable to access the listener I ...
1
vote
3answers
76 views

How can I mitigate attacks that rely on poisoned data as a developer?

A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the ...
1
vote
1answer
36 views

Windows command line does not check for revoked certificates: How bad is it?

I recently updated my D-link wifi dongle driver. However, I had to do this through the command line because Microsoft revoked the D-link certificates after a leak. The executable would simply not ...
1
vote
2answers
94 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
1
vote
2answers
194 views

How to educate users about the dangers of social engineering?

What would be the best way to teach and test employees on the topic of social engineering? What topics would you include?
1
vote
2answers
72 views

Reverse SE: Technology or Human based?

In Reverse Social Engineering the hacker deliberately sabotages a network, causing a problem to arise. That hacker then advertises that he is the appropriate contact to fix the problem, and when he or ...
1
vote
1answer
102 views

What to put in outer volume of encrypted volume? [closed]

TrueCrypt offers the ability to have a hidden volume. What should go in the outer volume that would be revealed to an adversary? It's actually pretty tricky: you'd have to convince the adversary it ...
1
vote
1answer
340 views

List of social engineering hacks and defenses [closed]

Sorry if this question is absolutely stupid or irrelevant, but I can't help but ask. I am just curious about different approaches hackers take in social engineering attacks, and clever examples of ...
1
vote
1answer
115 views

Detecting and Responding to Email Account Compromise (regarding FINRA 12-05, ISAC/IC3 alerts)

FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information. They then use social engineering / persuasion to complete the attack. What ...
1
vote
1answer
52 views

Social engineering attacks terminology

Let's suppose that a hacker send an email containing a Word document with a malicious macro to a sysadmin. Does this attack fall under the category of spear phishing?
1
vote
0answers
183 views

SEToolkit: havester not capturing credentials

I am using the Setoolkit on Ubuntu. I am testing it by cloning Facebook and logging myself in locally to see if I capture my own credentials. However,no POSTS are written to the harvester text file ...
1
vote
0answers
81 views

Backdoor file with custom payload

Is there a way in metasploit to add a custom exe/script as payload to a file (exe/pdf/doxc)? I'm asking this in the context of a SE media dropping scenario, where a file when executed, sends data to ...
1
vote
1answer
53 views

Have I been hacked?

I noticed that my browser (Chrome) is blinking, as if someone is taking screenshots of pages I am browsing. I am using Windows 8.1 box, with Kaspersky antivirus installed. When I started Fiddler to ...
0
votes
2answers
778 views

Is Google Drive security compromised?

Today when I visited drive.google.com, I was auto-directed to http://drive.googe.com/router.php After clicking on "Exit Now" on that page I was redirected to ...
0
votes
1answer
100 views

Impersonating Law Enforcement

Obviously impersonating a law enforcement officer on an engagement is illegal but badguys don't care about the law. If a company wanted to allow impersonating LE and have it in clear writing in the ...
0
votes
2answers
64 views

Is it Social Engineering when a keylogger is installed from a compromised account on the domain?

So… this is a matter of definitions. Social Engineering (SE) is referred to as being related to psychological manipulation. The relation to manipulation is also prominent in the description made on ...
0
votes
2answers
89 views

Is “user education” actually doable?

I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all. Are there any amazing success (or horrible ...
0
votes
2answers
176 views

Malicious capabilities of Social Botnets

A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked ...
0
votes
2answers
106 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
0
votes
1answer
111 views

What could be the possible exploit for android adware vulnerability?

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. I have seen many ...
0
votes
1answer
227 views

Is this social engineering on facebook?

Today, I received a mail from fb saying that two of my friends have mentioned me in a comment. When I opened fb to see that comment, it was filled with random names (which obviously were their ...
0
votes
0answers
31 views

Is there any benefit to re-verifying someones identity on the phone once transferred?

So this example is quite specific. You call up an organisation and they verify your identity using two pieces of information (eg; date of birth, last payment date, mothers maiden name). But then once ...
0
votes
0answers
104 views

deliver a malicious payload via a cloned website

I've been tasked with conducting an internal pentest, I'm relatively new to this so please bare with me. Some time ago, I used setoolkit and I would have the option to clone a website and attach a ...
0
votes
3answers
82 views

should I give the csrf token a descriptive name?

Personally I want to call the element _DO_NOT_give_this_security_thingy_to_anybody_ever. An example scenario is some clever social engineers want the user to run a malicious "add a friend" and find ...