Social engineering is the act of manipulating people into performing actions or divulging confidential information.

learn more… | top users | synonyms

2
votes
0answers
87 views

SET tool autopwn website type penetration [closed]

I tried to hack my second computer and phone in my local network. I am not very experienced so instead of picking the particular options and payloads i just pressed autopwn to use them all instantly. ...
1
vote
3answers
691 views

Are Facebook, Yahoo, Google, etc. hackable?

What I would consider to be hacking one of these services is something along the lines of cracking databases (or I think what would be databases). In reality, I have no idea how sites like these store ...
1
vote
2answers
88 views

Detect blocked reverse shell

I am wondering if there is a way to detect if a reverse shell is blocked by egress filtering or an obligatory proxy, or the exploit just failed. I am asking this question in the context of a SE media ...
1
vote
2answers
841 views

How to react on a message about a pending account ban on Facebook? [closed]

Are you getting this message on chat? LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable ...
1
vote
2answers
1k views

Having Trouble using SET in Kali

I'm trying to setup a website attack vector and I get in error when it tries to load up metasploit. Here's a look at my whole process: Select from the menu: 1) Spear-Phishing Attack Vectors ...
1
vote
5answers
175 views

How do big companies ensure that other people don't register a new top level domain with their name?

For example today there are ".codes", ".farm" and ".vaijes" newly available. How do big companies like google, facebook, twitter, .. keep sure that they are the first who register their name on the ...
1
vote
2answers
75 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
1
vote
2answers
178 views

How to educate users about the dangers of social engineering?

What would be the best way to teach and test employees on the topic of social engineering? What topics would you include?
1
vote
1answer
54 views

What are the implications of using OAUTH? Do the positives outweigh the negatives? [closed]

OAUTH seems like a pretty good idea when it comes to helping people authenticate, cuts down on the # of passwords to remember and in general eases the friction of on-boarding. However it would mean ...
1
vote
2answers
56 views

Reverse SE: Technology or Human based?

In Reverse Social Engineering the hacker deliberately sabotages a network, causing a problem to arise. That hacker then advertises that he is the appropriate contact to fix the problem, and when he or ...
1
vote
1answer
82 views

What to put in outer volume of encrypted volume? [closed]

TrueCrypt offers the ability to have a hidden volume. What should go in the outer volume that would be revealed to an adversary? It's actually pretty tricky: you'd have to convince the adversary it ...
1
vote
1answer
281 views

List of social engineering hacks and defenses [closed]

Sorry if this question is absolutely stupid or irrelevant, but I can't help but ask. I am just curious about different approaches hackers take in social engineering attacks, and clever examples of ...
1
vote
1answer
104 views

Detecting and Responding to Email Account Compromise (regarding FINRA 12-05, ISAC/IC3 alerts)

FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information. They then use social engineering / persuasion to complete the attack. What ...
1
vote
0answers
71 views

Backdoor file with custom payload

Is there a way in metasploit to add a custom exe/script as payload to a file (exe/pdf/doxc)? I'm asking this in the context of a SE media dropping scenario, where a file when executed, sends data to ...
0
votes
2answers
607 views

Is Google Drive security compromised?

Today when I visited drive.google.com, I was auto-directed to http://drive.googe.com/router.php After clicking on "Exit Now" on that page I was redirected to ...
0
votes
3answers
525 views

What is social engineering, how does it relate to security and how can it affect my business? [duplicate]

Possible Duplicate: Is social-engineering an actual threat What is social engineering? Can you give me some examples? Can social engineering have a big impact on business?
0
votes
1answer
92 views

Impersonating Law Enforcement

Obviously impersonating a law enforcement officer on an engagement is illegal but badguys don't care about the law. If a company wanted to allow impersonating LE and have it in clear writing in the ...
0
votes
2answers
70 views

Is there a Standard Verification process for Certificate Authorities to follow?

So the premise of the question is to quantify the risk of wild card certificates versus regular certificates. From my research the greatest fundamental danger of wild card certificates is the ...
0
votes
3answers
187 views

What day-to-day activities can compromise a person's information security [closed]

Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
0
votes
2answers
73 views

Is “user education” actually doable?

I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all. Are there any amazing success (or horrible ...
0
votes
2answers
125 views

Malicious capabilities of Social Botnets

A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked ...
0
votes
2answers
94 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
0
votes
1answer
69 views

What could be the possible exploit for android adware vulnerability?

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. I have seen many ...
0
votes
3answers
56 views

How can I mitigate attacks that rely on poisoned data as a developer?

A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the ...
0
votes
1answer
153 views

Is this social engineering on facebook?

Today, I received a mail from fb saying that two of my friends have mentioned me in a comment. When I opened fb to see that comment, it was filled with random names (which obviously were their ...
0
votes
3answers
65 views

should I give the csrf token a descriptive name?

Personally I want to call the element _DO_NOT_give_this_security_thingy_to_anybody_ever. An example scenario is some clever social engineers want the user to run a malicious "add a friend" and find ...
-2
votes
1answer
68 views

Voicemail PIN reset - what is a DDN? [closed]

Here is a recording of Glenn Mulcaire using social engineering to reset the PINs to voice mailboxes to which he did not have authorised access. (At least, that's my understanding.) He appears to say ...