Social engineering is the act of manipulating people into performing actions or divulging confidential information.
68
votes
7answers
3k views
Is social-engineering an actual threat
I've recently finished book The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick
The book was released on 4th December 2002. Not talking only about techniques described ...
34
votes
10answers
2k views
If someone asks to borrow your phone to make a call, what could they do?
A stranger walks up to you on the street. They say they lost their phone and need to make a phone call (has happened to me twice, and maybe to you). What's the worst a phone call could do?
Let's ...
18
votes
2answers
497 views
How secure is Stack Exchange's reputation?
I recently read an article about researchers being able to penetrate the Facebook network and making lots of friends with about 100 "Social" bots. What would prevent somebody to do the same on Stack ...
17
votes
5answers
681 views
Is there any legal reason to save a cleartext password?
I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen.
I asked her about this and she defended the ...
17
votes
3answers
2k views
Google hacking - why “numrange” is so dangerous?
I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this ...
15
votes
11answers
740 views
How to persuade average people that security matters?
If people could be fooled in life so easily ( http://www.bbc.co.uk/realhustle/ ) then in computing....
So what are the best tips, to persuade a regular user to pay a little more attention to ...
12
votes
7answers
898 views
Has cryptography reached the development level where social engineering is the only reliable method of attack?
Note that for the purpose of this question, "social engineering" means extracting information from humans, be your methods compliant with Geneva Conventions or not.
Simply put: Do cryptographic ...
11
votes
5answers
591 views
Does two factor authentication prevent social engineering attacks
After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password.
Considering three different additional ...
8
votes
2answers
187 views
How do you address a social engineering and or software weakness/concern in a company or organisation?
Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change ...
7
votes
4answers
2k views
How do online accounts get hacked?
How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social ...
7
votes
5answers
423 views
How can we get into the user's mindset?
As security folk, we tend to over- or under-estimate the capabilities and educatedness of our users, especially in terms of resistance to social engineering attacks.
Stereotypically, this is due to ...
6
votes
2answers
1k views
What is reverse social engineering?
What is reverse social engineering? Is it something different from normal social engineering?
6
votes
3answers
199 views
Are there password/passphrase guessers/crackers which can utilize facts supplied about the target?
I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't.
...
6
votes
3answers
277 views
Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?
According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
6
votes
2answers
2k views
Reversing an entry card - How to find out what type of RFID hardware I need to read the chip?
I have an acccess/entry card chip I want to copy for demonstrational purposes. However I am not sure how I can find out what type of RFID reader I need to get a hold of.
Does anyone have a ...
6
votes
2answers
1k views
Why would someone register a Facebook account with a stolen email address?
I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
6
votes
1answer
89 views
Mitigating risk from electronic payments
When attempting to sell a product online (for instance, on craigslist) there is a very good chance you will be the target of a social engineer; this is especially true when you are selling high-value ...
5
votes
6answers
580 views
Does not having https moot this entire site?
On a bank website the other day, I noticed that they were giving out a phone number on a page that wasn't over https. This seemed really wrong to me, since it would allow somebody to change the phone ...
5
votes
4answers
298 views
Automating Social Engineering Prevention
Being an advocate for DIO (defensive information operations), I have always been concerned about social engineering and its relation to server security. Giving administrative access to staff members ...
5
votes
3answers
535 views
Theory X vs Theory Y in social engineering
Theory X and Theory Y are two models of human motivation, often used when discussing people-management in business. In short, Theory X postulates people are lazy, will avoid work, and require ...
4
votes
4answers
2k views
How to catch a gmail hacker/money-scammer? (in conversation with one right now!)
My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
4
votes
2answers
196 views
What is the Ethics and Legality of Grabbing Data from Social Networks to aid a Pentest?
What is the ethics and legality of developing and using a tool to grab data on employees in the client's company in social networks such as facebook, twitter and linkedin. The data should then be used ...
4
votes
3answers
126 views
Best way to handle identity theft incident?
A user's email is hacked, contacts copied, and similar emails (look alike emails with minor spelling differences) are created by the attacker with the same name and avatar, sending relatively well ...
3
votes
1answer
167 views
When a company asks to test physical security, what are some techniques one could use to gain entry?
When a company asks to test physical/infrastructure security, what are some techniques one could use to test employees?
This could include good excuses to gain access to some hardware/software.
3
votes
2answers
211 views
How to mimic an emotion?
Microexpression is a brief facial expression according to emotions experienced. It is also one of the most powerful SE (social engineering) weapons. However, they are very hard to master.
Are they ...
3
votes
3answers
223 views
“Doxing” users on Social Media
I hope this question falls within the scope of the faq...I'm curious to see what kind of answers I get.
Suppose the following
A user is posting libel and slander on social media (lets say Twitter ...
3
votes
2answers
129 views
Security Training for corporate Facebook users
One of my clients is looking at allowing their employees to access Twitter and Facebook from work. I have highlighted the need for training, and I have material to present, but what do you think ...
3
votes
1answer
68 views
Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?
Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
2
votes
3answers
268 views
I found a malicious website embedded in Malware spam. What should I do?
An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code.
Who should I report these malicious URLs to? (Microsoft ...
2
votes
3answers
234 views
Will this work? Revealing identity (facebook) of person who clicks specially crafted link
There is a special Facebook link that will redirect anyone who clicks it to their own Facebook profile they are currently logged in on on their browser. The link goes like this: ...
2
votes
3answers
116 views
How can I help an online identity theft potential victim?
I just learned that my dad fell for a online green card lottery scam. It happened over 3 years ago, the attacker took 60$ and disappeared. I am not even considering getting this money back.
On the ...
2
votes
2answers
136 views
E-mail Server Security
In recent news, Bitcoinica was compromised by an e-mail server infiltration. The hacker then applied social engineering, using one of the administrative e-mail accounts to reset the root credentials ...
2
votes
2answers
304 views
When is an intermediate page needed before directing a user off my primary website? What is the best implementation?
The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example).
I've seen this used in Exchange Outlook Web Access ...
2
votes
1answer
479 views
Social Engineer Toolkit (Cloning Sites)
Is it legal or illegal to use the cloning site option within the social engineer toolkit (SET) or any other tool that clones websites? I was under the impression that if performing a social engineer ...
2
votes
1answer
122 views
Industrial security — resources for ISO27k compliance, social-engineering trend reports
I'm attempting to compile resources on industrial IT security from a non-technical standpoint as it pertains to the U.S petrochemical industry. This is for my final research paper as an undergraduate ...
1
vote
2answers
191 views
I need explanation on how serious these vulnerabilities are?
I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities :
RFI inside SWF file.
Example: ...
1
vote
2answers
592 views
How to react on a message about a pending account ban on Facebook? [closed]
Are you getting this message on chat?
LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable ...
1
vote
2answers
116 views
How to educate users about the dangers of social engineering?
What would be the best way to teach and test employees on the topic of social engineering?
What topics would you include?
1
vote
1answer
92 views
Exposure risk of knowing only social security number?
Up until recently I was under the impression that the social security number was insufficient information to perform identity theft, and that in practice you will at least need the victim's SSN and ...
1
vote
1answer
74 views
Detecting and Responding to Email Account Compromise (regarding FINRA 12-05, ISAC/IC3 alerts)
FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information. They then use social engineering / persuasion to complete the attack.
What ...
1
vote
0answers
292 views
what the differences between cyber security, information security, computer forensics, digital forensics [closed]
what is the purpose or difference between of master cyber security, information security, computer forensics, digital forensics .i will to be computer investigator who is the best. Thanks
0
votes
3answers
232 views
What is social engineering, how does it relate to security and how can it affect my business? [duplicate]
Possible Duplicate:
Is social-engineering an actual threat
What is social engineering? Can you give me some examples?
Can social engineering have a big impact on business?
0
votes
3answers
354 views
Are Facebook, Yahoo, Google, etc. hackable?
Just to be clear, I am not asking how to hack in these services, I am just curious. Let me try to explain.
Since I know a little bit about computers, people automatically assume I know how to have, ...
0
votes
3answers
113 views
What day-to-day activities can compromise a person's information security [closed]
Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
-2
votes
1answer
72 views
Is SE a bigger threat than breaking-and-entering or other threats? [closed]
Thinking about this week's topic I thought of something I would love to hear more about:
What is so special about Social Engineering? Is SE a bigger threat than breaking-and-entering?
This is not ...
