Hot answers tagged phishing
45
At every place I have worked (as a contract developer) developers are given local admin rights on their desktops.
The reasons are:
1) Developers toolsets are often updated very regularly. Graphics libraries, code helpers, visual studio updates; they end up having updates coming out almost weekly that need to be installed. Desktop support usually gets ...
22
It's called knowledge-based authentication, and it's used to authenticate the remote server. Common authentication tokens are words and pictures.
One point I would make is that it's a bad idea to give out the authentication token only after being given a non-secret piece of information such as a username. An attacker could target a single user by simply ...
22
As Rook pointed out, security theatre is a big part of how consumer perception is exploited to ensure that customers believe that something is safe, without the vendor having to go through all that complicated hassle with actual security.
The TSA is a great example, but there are many others:
Extended Verification on SSL certificates are largely theatre, ...
19
SiteKey is the feature name that many banks call it and should be able to be searched for under that name. It adds minimal if any security. Anything that your server can present to the user, a man in the middle can act as if they were the client and get the same information. SiteKey (which is likely what your bank calls it) is not secure and doesn't add ...
18
This partly depends on the kind of software the dev team is expected to develop. Some types of software are easier to develop without administrative rights than others.
For example, you can do a fair amount of web-based Java development using the likes of Eclipse with Maven artifacts, all installed locally (and typically tested on port 8080), without ...
16
This type of attack is called "Vishing".
I don't think it's very common, but it's not unheard of. However, mostly its automated responses on bogus numbers, manual vishing I have to think is even less common.
It sounds like the attacker was either hoping to get lucky, or it was a targeted attack - not really enough information here to tell. It could be ...
13
I am assuming that the bank wants to protect its customers from phishing. (Not its employees; that's a different problem, and if you want to know about that, you should ask that one separately in a different question.)
The bank should take several steps:
Avoid emailing out links to the site. Go clobber the marketing team and get them to quit doing that.
...
13
To answer your specific question, .local has already been reserved by ICANN as an internal gTLD. Please see section 2.2.1.2.1 "Reserved Names" in the ICANN Applicant Guidebook.
The full list of reserved gTLDs are:
AFRINIC IANA-SERVERS NRO ALAC ICANN RFC-EDITOR APNIC IESG RIPE ARIN
IETF ROOT-SERVERS ASO INTERNIC RSSAC CCNSO INVALID ...
12
Answer:
Yeah. It's possible. Re-install OSX and then change all her passwords. She got phished.
IT Services is correct here.
Prevention:
To prevent this from happening in the future make sure she understands the importance of updates, and how to spot and avoid phishing scams.
How it Happened:
A lot of attackers will use shortened URLs or legitimate ...
11
The answer depends upon what kind of browser you are using, so I'll break it down.
Mobile browsers. You can't trust anything you see. Sorry. Life on a small screen sucks. That's just the way it is.
(Did you want an explanation why? Any web page can go full-screen, using mobile-specific tricks like scrolling the page down so that the address bar is not ...
11
Theoretically speaking: maybe, at the moment you just have a possibility and no actual proof. (Just IP addresses aren't enough they are circumstantial, the police will need to at least find proof on his computer (which in most cases is also, at most, considered circumstantial))
Realistically: Not a chance. It's Ghana, the chance you will get anything done ...
10
I don't rate their security particularly high; but they are more than just security theater. They potentially can make the job of the attacker more difficult and the job of a security forensic experts tracking down anomolies easier.
Let's say there is no security image/phrase or equivalent. Then an man-in-the-middle attacker can construct a fake version ...
8
I believe it is legitimate. If you visit paypal.com, switch to the "Germany - Deutsch" site and check out the links on the resulting site, you can see that, for example, the "Sicherheit" (Google translate as "Security") link points to https://www.paypal-deutschland.de/sicherheit/.
Of course, one could argue that this means very little.
If in doubt, ...
7
First things first: you must (I insist, must) wipe out your hard disk and reinstall from scratch. Any half-witted attacker or mere virus which could gain root access on a system will certainly not stop after adding a folder. It is highly probable that one or several backdoors have been installed, in various system utilities and/or the kernel itself, in ways ...
7
Great question! As it happens, I can present experimental data on this question -- and the data is fascinating. (I noticed that some of the answers contain speculation from first principles about how much security these security images offer. However, the data turns out to have some surprises for all of us!)
Experimental methodology.
"Security images" ...
6
That depends on the DNS configuration for the local networks. I would assume most companies have their own DNS servers which, aside from knowing where to ask for DNS records for other domains, also declare themselves as authorative for the .local TLD. Assuming all clients are pointing at these DNS servers, owning the .local TLD wouldn't help an attacker one ...
6
There is an Epidemic of this attack in NZ at the moment.
We have been called about 5 times over the last 6 months.
The attacker wants to get you to open up your computer to remote access and then who-knows-what.
They use a Contact Centre (probably in India) with a script that goes something like this:
Hi, I am from Windows.
We have found a virus ...
6
Safe Browsing API
Google offers Safe Browsing, which uses URL lists as well as heuristics:
Safe Browsing works in two ways to help protect you against phishing and malware. First, Google downloads a list of information to your browser about sites that may contain malicious software or engage in phishing. If the URL of the site you're on matches ...
5
As for email-based phishing:
The number one red flag is anything or anybody asking for the user password. There is never any valid reason for a valid maintenance message to ask for the user password: those who may need the password already have it, by construction.
The second flag is URL which points to the bad site name or is obfuscated in some way. In ...
5
You can have a look at that article from Murdoch and Anderson, on the topic of the "Verified by VISA" and "MasterCard SecureCode" online authentication systems. The article points out several problems in that system, among which the use of iframes which train users into entering personal details on Web pages, the provenance of which they cannot verify.
5
Banks have been urging the use of debit cards for years, but the policies around reimbursement after a fraudulent transaction are widely variable. It's one thing to have a fraudulent transaction sitting on a credit card statement, but it's quite another to have actual cash missing from your checking account and not be able to pay your rent. I always ...
5
In general, you should contact the Facebook support or abuse team about messages like this. If the warning is real, they will be happy to confirm it. If it is not real, it is itself an abusive action and Facebook will be happy to learn about it.
In your case, the mentioned URL does not point to facebook.com but a domain that is not owned by Facebook. ...
5
I'm going to go ahead and say the unexpected - it looks legitimate to me actually.
A quick whois on the domain shows that the same DNS servers serve paypal-deutschland.de as paypal.com (as well as the registration information being almost identical in every other way) - this, in addition to an SSL Cert from VeriSign would be quite difficult to fake. The ...
4
Advice which is just, quite simply, incorrect
Westpac still clings to their claim that a Java or Javascript point-at-the-screen-and-click picture of a keyboard for entering your (monocase alphanumeric, exactly 6 character) password is more secure than allowing use of the real keyboard. Shoulder surfing is something that only happens to the customers of ...
4
Learning and experimentation is good, everyone started somewhere. There is a lot of information out there. If you are interested in the functionality of BackTrack then I would suggest hanging out in their community forums. They have a lot of tips and tricks. Just like with a carpenter, they have to know their tools and material. Be as it may - a hammer ...
4
Phishing is a way to collect your private information, usually site username/password, but also sometimes your CC info.
Did you type any of this on the page that you were send to from Facebook?
If not - it's not phishing.
It can be "click jacking"
or, most likely, they tried to install something on your computer.
From their site an attacker can't access ...
4
A few things that have not been mentioned in previous answers and comments that would be an argument for developers working under least privilege:
Depending on the industry in which you are working, there may be legal or regulatory reasons that restrict employees from having elevated privileges on their workstations. Allowing administrative access to ...
4
Risk is an increasing function of access
There is a simple rule of risk computation which explains the fear of your colleagues of the IT team. The more access you have on any operating system
the higher are the impacts of any error or attack.
For example, if one of your colleague, lets say Bob, is attacked through a standard phishing attack,
then Bob ...
4
You give them Local admin rights to their workstation and anything else they want. The development environment is always isolated from the main network. It is IT's job to make sure you provide them with what ever setup they need while making sure nothing in the dev environment can harm the main network. Plan ahead and work with management to buy the ...
4
A simple way to check is just to get them to send another password reset and see what the links used for password recovery are, it would also be useful if you checked your emails and see if you did request one a few days ago, or check the trash folder if you deleted it. Here's the reset email they sent me:
> Hi ****,
>
> You recently asked to ...
Only top voted, non community-wiki answers of a minimum length are eligible
