Social engineering is the act of manipulating people into performing actions or divulging confidential information.

learn more… | top users | synonyms

0
votes
3answers
100 views

How a professional hacker would penetrate a computer in a network?

Which kinds of vulnerabilities or security holes a hacker would use to penetrate and take over a computer in a network, like a normal PC in a default network (Wireless-LAN). I often hear that the ...
-5
votes
2answers
74 views

What is the difference between Social Engineering Attack and APT Attack?

Doesn't social engineering attack mean APT attack? They seem similar in my mind, because both of them focuses human, not technology. Shortly, what is the difference between social engineering attack ...
7
votes
2answers
59 views

List of visually similar characters, for detecting spoofing and social engineering attacks

I'm trying to detect homograph attacks and other attacks where an attacker uses a spoof domain name that looks visually similar to a trusted domain name (e.g., bankofthevvest.com instead of ...
2
votes
2answers
60 views

Suspicious SMS about activated phone service

Not long ago I had heard that someone from my family had an suspicious situation with SMS service. What happened was this person receive message like Service 'Play music on calls' have been enabled. ...
12
votes
3answers
8k views

What is reverse social engineering?

What is reverse social engineering? Is it something different from normal social engineering?
36
votes
7answers
7k views

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

Is it a bad idea to post a photo of your keyboard to social media? Can I look at a photo of a keyboard and determine the password of an account? Assuming a certain (set of) password(s) is the most ...
-4
votes
1answer
78 views

How do I stop a snooper: phone and computer [closed]

Someone is snooping on me. They can see my location, text messages, and pictures (even if I don't send them to anyone), and also my download and web browsing history. Someone is reading my old juicy ...
93
votes
7answers
5k views

Is social-engineering an actual threat

I've recently finished book The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick The book was released on 4th December 2002. Not talking only about techniques described ...
2
votes
1answer
62 views

Have I been hacked?

I noticed that my browser (Chrome) is blinking, as if someone is taking screenshots of pages I am browsing. I am using Windows 8.1 box, with Kaspersky antivirus installed. When I started Fiddler to ...
0
votes
2answers
82 views

Is it Social Engineering when a keylogger is installed from a compromised account on the domain?

So… this is a matter of definitions. Social Engineering (SE) is referred to as being related to psychological manipulation. The relation to manipulation is also prominent in the description made on ...
8
votes
1answer
99 views

Are there more hacks done by social engineering, etc, than breaking the software system?

There is a saying that, rather than finding a vulnerability in a strong security system, the hacker is more likely to hack into your system by social engineering, physically breaking into the room the ...
10
votes
2answers
13k views

Reversing an entry card - How to find out what type of RFID hardware I need to read the chip?

I have an acccess/entry card chip I want to copy for demonstrational purposes. However I am not sure how I can find out what type of RFID reader I need to get a hold of. Does anyone have a ...
1
vote
1answer
70 views

Windows command line does not check for revoked certificates: How bad is it?

I recently updated my D-link wifi dongle driver. However, I had to do this through the command line because Microsoft revoked the D-link certificates after a leak. The executable would simply not ...
3
votes
1answer
67 views

Detecting attempts to manipulate help desk support

If users forget their password, lose their one-time-password tokens, or otherwise become unable to access their accounts, they call the help desk. In certain circumstances, help desk support is ...
4
votes
1answer
129 views

Databases with spam, phishing email examples [duplicate]

I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc). I order to do this I need to have a ...
3
votes
2answers
79 views

How do I tell the difference between a fake “problem loading page” and a real one?

We know that due to numerous reasons, a browser will display a page like "Problem loading page" or "This page can’t be displayed." But there's one huge problem: browsers seem to show this error page ...
1
vote
1answer
195 views

Difficulty using SET within Kali Linux

When setting a website attack vector, I find that Kali does not give me the option to specify a port in order to receive information back to my local. Furthermore, I am unable to access the listener I ...
1
vote
2answers
6k views

Having Trouble using SET in Kali

I'm trying to setup a website attack vector and I get in error when it tries to load up metasploit. Here's a look at my whole process: Select from the menu: 1) Spear-Phishing Attack Vectors 2)...
-2
votes
1answer
36 views

Router connected to my ethernet [duplicate]

I'm guessing that someone is bringing his router to provide wifi to his coworkers, by connecting it to a certain point on one of the 8 floors of my building, how can I know where is connected?
7
votes
1answer
78 views

Rating social engineering threats in a penetration test report

Does anybody have advice on how to deal with social engineering in the context of writing up a penetration test report? How do you assign a rating to social engineering? Obviously if you can convince ...
1
vote
1answer
55 views

Social engineering attacks terminology

Let's suppose that a hacker send an email containing a Word document with a malicious macro to a sysadmin. Does this attack fall under the category of spear phishing?
4
votes
2answers
99 views

Theoretically, what are the best “reverse social engineering” methods for your password, and how good would they be?

I just saw this SMBC comic: http://www.smbc-comics.com/index.php?id=3955 I realize that this is not actually "reverse social engineering" as typical usage of the term. However, I'm wondering in ...
0
votes
0answers
33 views

Is there any benefit to re-verifying someones identity on the phone once transferred?

So this example is quite specific. You call up an organisation and they verify your identity using two pieces of information (eg; date of birth, last payment date, mothers maiden name). But then once ...
3
votes
3answers
83 views

Is there an effective social engineering employee awareness program?

Social engineering is cited as one of the primary threat vectors (see for example at: https://gallery.technet.microsoft.com/Fixing-the-1-Problem-in-2e58ac4a). Employee awareness training is also ...
33
votes
6answers
3k views

After getting doxxed, how can one protect personally identifiable information?

Doxing (publicly releasing private information about an individual, to make it easier to harass them) is becoming an increasingly popular tactic not just for hackivists and Anonymous, but also for ...
12
votes
5answers
3k views

How can I help catch an email scammer who is contacting me?

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
3
votes
1answer
85 views

How to recover/log attempted passwords from a failed login [closed]

I saw the following question before: Is it legal to log passwords from failed logins? I think it raises another question: How do I log failed attempted passwords? That seems very useful when I need ...
12
votes
5answers
9k views

How do online accounts get hacked?

How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social ...
-3
votes
2answers
191 views

Can someone put you in jail if you are only 13 and you were chatting online? [closed]

I was chatting online with a guy. First, he was being nice, but later he became mean. He said that he would put me in jail for going on a site. I did not break the law or did anything, just chat, a ...
72
votes
8answers
10k views

How to distinguish between a scam and a genuine call?

My bank called me the other day and the person who spoke to me failed to give me a single evidence that he is calling from my bank. The bank number is hidden just like many other companies maybe ...
6
votes
1answer
156 views

Incident Response - Which logs are of most interest following a social engineered remote desktop attack

Unfortunately, someone in my family fell for a phone scam after data was leaked from TalkTalk. As a result, they allowed remote access to two computers and transferred money from their bank account to ...
12
votes
1answer
242 views

New social engineering tactic that uses printer serial numbers?

We have been getting a new kind of scammer-esque call every couple weeks here at the office (I work at an enterprise web application development company). Basically, the flow of events is this: ...
0
votes
0answers
123 views

deliver a malicious payload via a cloned website

I've been tasked with conducting an internal pentest, I'm relatively new to this so please bare with me. Some time ago, I used setoolkit and I would have the option to clone a website and attach a ...
25
votes
10answers
5k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
24
votes
7answers
3k views

When do honest people need privacy or anonymity? (e.g. they have nothing to hide) [closed]

I'm having a discussion with someone who thinks they don't need technical measures of privacy or anonymity. Common arguments against needing to care about privacy or anonymity include: Everything ...
3
votes
2answers
295 views

Spear phishing data set

Are there any existing data sets of spear phishing emails available? I've found a bunch of data sets of phishing emails, but that's not what I'm looking for. I'm not looking for mass phishing ...
1
vote
0answers
218 views

SEToolkit: havester not capturing credentials

I am using the Setoolkit on Ubuntu. I am testing it by cloning Facebook and logging myself in locally to see if I capture my own credentials. However,no POSTS are written to the harvester text file ...
8
votes
1answer
149 views

Do large online software companies limit employee access to company information?

I've been wondering about how large online software companies, specifically those based around a single massive product, like Google, Facebook, Yahoo, etc. handle the risk of terminated employees. Any ...
11
votes
2answers
2k views

Custom Metasploit payload with UAC bypass

The machine I am attacking has anti-virus installed. I have managed to use Veil Framework in order to create an initial reverse shell payload that is undetected by the AV. However, UAC is enabled on ...
52
votes
11answers
31k views

If someone asks to borrow your phone to make a call, what could they do?

A stranger walks up to you on the street. They say they lost their phone and need to make a phone call (has happened to me twice, and maybe to you). What's the worst a phone call could do? Let's ...
11
votes
1answer
577 views

Social Engineering and Police Officers

The Story: Yesterday at 12pm a neighbor of mine was pulling into his driveway, and saw that his van's back-window was shattered. Well, this neighbor and I have had some trouble with each other in the ...
18
votes
3answers
5k views

Google hacking - why “numrange” is so dangerous?

I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this operator....
2
votes
1answer
83 views

What are the implications of using OAUTH? Do the positives outweigh the negatives? [closed]

OAUTH seems like a pretty good idea when it comes to helping people authenticate, cuts down on the # of passwords to remember and in general eases the friction of on-boarding. However it would mean ...
5
votes
2answers
625 views

Has there been any documented cases where hackers have hijacked the phone number to a business?

Has there been any cases where hackers have taken over the phone number to a business, by creating a phone number in the same area code, setting up a virtual PBX / Asterisk system, routing all calls ...
0
votes
1answer
120 views

What could be the possible exploit for android adware vulnerability?

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. I have seen many ...
1
vote
2answers
107 views

Is there a Standard Verification process for Certificate Authorities to follow?

So the premise of the question is to quantify the risk of wild card certificates versus regular certificates. From my research the greatest fundamental danger of wild card certificates is the ...
5
votes
2answers
217 views

Could a fake tip that my server is compromised be a social engineering attack?

A little while ago I got the following email from an unknown party (using an @alum.cs.[redacted].edu email address): I'm seeing attack traffic from your Linode. Just a friendly heads up that its ...
2
votes
0answers
174 views

SET tool autopwn website type penetration [closed]

I tried to hack my second computer and phone in my local network. I am not very experienced so instead of picking the particular options and payloads i just pressed autopwn to use them all instantly. ...
14
votes
2answers
1k views

Are in-store computers a security risk?

In many "big box" stores like Walmart, Home Depot, etc. I see many store computers just sitting empty. A black hat could install a payload on one of these computers, and potentially wreak havoc on the ...
1
vote
3answers
816 views

Are Facebook, Yahoo, Google, etc. hackable?

What I would consider to be hacking one of these services is something along the lines of cracking databases (or I think what would be databases). In reality, I have no idea how sites like these store ...