Social engineering is the act of manipulating people into performing actions or divulging confidential information.

learn more… | top users | synonyms

5
votes
2answers
587 views

Has there been any documented cases where hackers have hijacked the phone number to a business?

Has there been any cases where hackers have taken over the phone number to a business, by creating a phone number in the same area code, setting up a virtual PBX / Asterisk system, routing all calls ...
0
votes
1answer
56 views

What could be the possible exploit for android adware vulnerability?

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. I have seen many ...
0
votes
2answers
63 views

Is there a Standard Verification process for Certificate Authorities to follow?

So the premise of the question is to quantify the risk of wild card certificates versus regular certificates. From my research the greatest fundamental danger of wild card certificates is the ...
5
votes
2answers
108 views

Could a fake tip that my server is compromised be a social engineering attack?

A little while ago I got the following email from an unknown party (using an @alum.cs.[redacted].edu email address): I'm seeing attack traffic from your Linode. Just a friendly heads up that its ...
1
vote
0answers
58 views

SET tool autopwn website type penetration [closed]

I tried to hack my second computer and phone in my local network. I am not very experienced so instead of picking the particular options and payloads i just pressed autopwn to use them all instantly. ...
13
votes
2answers
1k views

Are in-store computers a security risk?

In many "big box" stores like Walmart, Home Depot, etc. I see many store computers just sitting empty. A black hat could install a payload on one of these computers, and potentially wreak havoc on the ...
1
vote
3answers
670 views

Are Facebook, Yahoo, Google, etc. hackable?

What I would consider to be hacking one of these services is something along the lines of cracking databases (or I think what would be databases). In reality, I have no idea how sites like these store ...
4
votes
5answers
200 views

Using unique email address for online signups?

After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security. We can only do so much too protect ourselves because at the ...
10
votes
4answers
2k views

Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
1
vote
2answers
1k views

Having Trouble using SET in Kali

I'm trying to setup a website attack vector and I get in error when it tries to load up metasploit. Here's a look at my whole process: Select from the menu: 1) Spear-Phishing Attack Vectors ...
0
votes
3answers
60 views

should I give the csrf token a descriptive name?

Personally I want to call the element _DO_NOT_give_this_security_thingy_to_anybody_ever. An example scenario is some clever social engineers want the user to run a malicious "add a friend" and find ...
23
votes
9answers
5k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
80
votes
7answers
4k views

Is social-engineering an actual threat

I've recently finished book The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick The book was released on 4th December 2002. Not talking only about techniques described ...
0
votes
3answers
55 views

How can I mitigate attacks that rely on poisoned data as a developer?

A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the ...
9
votes
2answers
7k views

Reversing an entry card - How to find out what type of RFID hardware I need to read the chip?

I have an acccess/entry card chip I want to copy for demonstrational purposes. However I am not sure how I can find out what type of RFID reader I need to get a hold of. Does anyone have a ...
0
votes
2answers
68 views

Is “user education” actually doable?

I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all. Are there any amazing success (or horrible ...
7
votes
1answer
367 views

Social Engineering and Police Officers

The Story: Yesterday at 12pm a neighbor of mine was pulling into his driveway, and saw that his van's back-window was shattered. Well, this neighbor and I have had some trouble with each other in the ...
-2
votes
1answer
63 views

Voicemail PIN reset - what is a DDN? [closed]

Here is a recording of Glenn Mulcaire using social engineering to reset the PINs to voice mailboxes to which he did not have authorised access. (At least, that's my understanding.) He appears to say ...
0
votes
2answers
114 views

Malicious capabilities of Social Botnets

A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked ...
1
vote
2answers
54 views

Reverse SE: Technology or Human based?

In Reverse Social Engineering the hacker deliberately sabotages a network, causing a problem to arise. That hacker then advertises that he is the appropriate contact to fix the problem, and when he or ...
1
vote
5answers
167 views

How do big companies ensure that other people don't register a new top level domain with their name?

For example today there are ".codes", ".farm" and ".vaijes" newly available. How do big companies like google, facebook, twitter, .. keep sure that they are the first who register their name on the ...
0
votes
1answer
147 views

Is this social engineering on facebook?

Today, I received a mail from fb saying that two of my friends have mentioned me in a comment. When I opened fb to see that comment, it was filled with random names (which obviously were their ...
1
vote
1answer
78 views

What to put in outer volume of encrypted volume? [closed]

TrueCrypt offers the ability to have a hidden volume. What should go in the outer volume that would be revealed to an adversary? It's actually pretty tricky: you'd have to convince the adversary it ...
2
votes
1answer
176 views

Should police departments recommend the securit.leadsonline.com website as a secure place to store information about our valuables?

This is kind of a social engineering question -- my local law enforcement agency sent out this email today: Help us by keeping identifying information about your valuables safe and accessible – ...
2
votes
3answers
313 views

EICAR alternative for IDS/IPS

Is there a way to trigger alarms in an Intrusion Detection System with something similar to the EICAR test virus? Maybe some special packet that is harmless to the environement, but will trigger IDS? ...
0
votes
2answers
502 views

Is Google Drive security compromised?

Today when I visited drive.google.com, I was auto-directed to http://drive.googe.com/router.php After clicking on "Exit Now" on that page I was redirected to ...
1
vote
0answers
67 views

Backdoor file with custom payload

Is there a way in metasploit to add a custom exe/script as payload to a file (exe/pdf/doxc)? I'm asking this in the context of a SE media dropping scenario, where a file when executed, sends data to ...
1
vote
2answers
80 views

Detect blocked reverse shell

I am wondering if there is a way to detect if a reverse shell is blocked by egress filtering or an obligatory proxy, or the exploit just failed. I am asking this question in the context of a SE media ...
0
votes
1answer
89 views

Impersonating Law Enforcement

Obviously impersonating a law enforcement officer on an engagement is illegal but badguys don't care about the law. If a company wanted to allow impersonating LE and have it in clear writing in the ...
8
votes
5answers
3k views

How to catch a gmail hacker/money-scammer? (in conversation with one right now!)

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
4
votes
4answers
259 views

Contact person by phone, when their phone might have malware

I have a problem setting where I want to contact a user by phone, and where I need to protect the integrity of the phone call as much as possible. I'm wondering about how to design the interaction in ...
11
votes
3answers
6k views

Why would someone register a Facebook account with a stolen email address?

I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
30
votes
7answers
2k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
1
vote
2answers
72 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
2
votes
1answer
100 views

Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?

Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
1
vote
1answer
272 views

List of social engineering hacks and defenses [closed]

Sorry if this question is absolutely stupid or irrelevant, but I can't help but ask. I am just curious about different approaches hackers take in social engineering attacks, and clever examples of ...
7
votes
4answers
6k views

How do online accounts get hacked?

How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social ...
3
votes
1answer
452 views

How to detect social engineering attack?

How can I understand if I am being targeted by a grey hat social engineer? And if I fail, what approaches exist to detect social engineering attacks being in progress within an organisation?
2
votes
2answers
403 views

Ways to obfuscate web browsing habits [duplicate]

Web browsing metadata provides a lot of insight on person's habits. How can I reduce that insight? Is there something like "Detachment 2702" (http://en.wikipedia.org/wiki/Cryptonomicon) plugin for ...
4
votes
1answer
262 views

They think I am their IT Dept…What to do about it?

I have been asked to test out any security holes for a company. I created an email account that looks similar to their IT department's address and everybody is complying :) I have only asked them to ...
0
votes
2answers
94 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
9
votes
6answers
768 views

Does not having https moot this entire site?

On a bank website the other day, I noticed that they were giving out a phone number on a page that wasn't over https. This seemed really wrong to me, since it would allow somebody to change the phone ...
0
votes
3answers
185 views

What day-to-day activities can compromise a person's information security [closed]

Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
45
votes
10answers
13k views

If someone asks to borrow your phone to make a call, what could they do?

A stranger walks up to you on the street. They say they lost their phone and need to make a phone call (has happened to me twice, and maybe to you). What's the worst a phone call could do? Let's ...
2
votes
2answers
309 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
3
votes
3answers
345 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft ...
2
votes
1answer
181 views

Exposure risk of knowing only social security number?

Up until recently I was under the impression that the social security number was insufficient information to perform identity theft, and that in practice you will at least need the victim's SSN and ...
19
votes
3answers
4k views

Google hacking - why “numrange” is so dangerous?

I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this ...
2
votes
3answers
1k views

Will this work? Revealing identity (facebook) of person who clicks specially crafted link

There is a special Facebook link that will redirect anyone who clicks it to their own Facebook profile they are currently logged in on on their browser. The link goes like this: ...
5
votes
4answers
384 views

Automating Social Engineering Prevention

Being an advocate for DIO (defensive information operations), I have always been concerned about social engineering and its relation to server security. Giving administrative access to staff members ...