Tag Info

Hot answers tagged

242

IMPORTANT: this is based on data I got from your link, but the server might implement some protection. For example, once it has sent its "silver bullet" against a victim, it might answer with a faked "silver bullet" to the same request, so that anyone investigating is led astray. I have tried sending a fake parameter of cHVwcGFtZWxv to see whether it ...


189

It is not. This is a FUD (fear, uncertainty, and doubt) campaign by GMX because they want to display their ads. There is absolutely no security risk from the mentioned ad blockers. They added some crapware to the list to make it look more legitimate. Of course such campaigns are very unusual, especially from such a big and well known company like GMX. ...


101

This may well be for the same reason as many scammers rely on the tired old 'Nigerian Prince' strategy: by self-selecting for gullible targets, they can be more efficient. In phishing, as in scams, sending the initial batch of emails is the easy part. The hard part is coaxing information out of the target (which can require a concerted exchange of emails). ...


100

If you're worried about the authenticity of a cold-call, don't try over-the-phone authentication in either direction. Simply ask for some basic information you can use to refer to the issue in follow-up: Name of the company/service the account is for. What is the nature of the problem? Is there a reference ID (e.g.: ticket #) for the issue? Name and/or ...


90

Update After thinking it over, I have to agree with the other answers in that, despite the fact that it CAN access your data, Adblock is more likely to protect your privacy than invade it. The real risk are malicious ads that prompt you to install software on your computer. Adblock prevents these. Below is the original, cautionary answer: Yes, it totally ...


61

Okay, personal anecdote time. I'm a sysadmin in real life, working for an ISP that primarily caters to small to medium businesses. One of our larger customers operates, among other things, an exceptionally cheap and completely automated shared webhosting service. You sign up, pay a couple of bucks via credit card, and plonk your site down. No human ...


53

It seems like the spammer got your personal information including your password through a security breach somewhere. Why did they use your password instead of your name? I would say it was an honest mistake on their side. They just mixed up the fields when designing the spam mail. When you are still using the password somewhere, you should change it ASAP. ...


51

If the server is configured correctly, you cannot download a PHP file. It will be executed when called via the webserver. The only way to see what it does is to gain access to the server via SSH or FTP or some other method. This is because PHP is a serverside language, all the actions are performed on the server, then the result is sent to your browser ...


50

At every place I have worked (as a contract developer) developers are given local admin rights on their desktops. The reasons are: 1) Developers toolsets are often updated very regularly. Graphics libraries, code helpers, visual studio updates; they end up having updates coming out almost weekly that need to be installed. Desktop support usually gets ...


45

This really comes down to an issue of trust. It is true that today, the AdBlock extension is safe. We know that it will not steal your data, even though—as the other answers point out—it has the technical ability to do so. However, Chrome extensions are silently and automatically updated. Do you trust that the developer of the AdBlock ...


41

Emails with mistakes are probably from people who doesn't know English well enough to write correctly. Many phishing emails do not have mistakes, and may be copied directly from emails sent by the company it claims to represent. See this for more details: "Phishing" red flags and countermeasures


38

All software is a security risk, but in this case their claim is misleading. Just like all advice is potentially bad and and all transactions are potentially fraudulent. "Risk" just means your security isn't guarenteed, with is true in 100% of cases. But in the case of AdBlock Plus, the software is well-understood and developed by a team that has a track ...


30

As Polynomial mentioned, this is part of ICANN-mandated WHOIS verification. The reason it goes to domainadmin.com is that ICANN doesn't actually run the verification -- rather, like just about all ICANN things, they set policies that are then implemented by others (remember, your .com domain is in a registry operated by Verisign, and was registered by a ...


29

There are several ways to achieve this: Malware working as a proxy or directly hooked into the browser (like with browser extensions) can change the content of the site itself, that is one will still visit the original site but the content will be changed in transit or gets changed inside the browser with script injection or similar. This kind of malware ...


25

As the answer by phillipp stated, there is a good chance they got your password from some form of security breach. I doubt that they would have obtained that through Paypal's system. It could have happened in one of the following ways, to name a few (with tips on how to protect yourself from each one). At some point you could have accessed a fake PayPal ...


24

Ask for their extension, then call the bank back with a number you trust. Most office phone systems allow you to get directly to any employee if you know that employee's extension, so hanging up and calling the bank back will not take more than a few seconds. If you have been called on an old style landline you should phone back on a different phone line or ...


23

It's called knowledge-based authentication, and it's used to authenticate the remote server. Common authentication tokens are words and pictures. One point I would make is that it's a bad idea to give out the authentication token only after being given a non-secret piece of information such as a username. An attacker could target a single user by simply ...


23

As Rook pointed out, security theatre is a big part of how consumer perception is exploited to ensure that customers believe that something is safe, without the vendor having to go through all that complicated hassle with actual security. The TSA is a great example, but there are many others: Extended Verification on SSL certificates are largely theatre, ...


22

SiteKey is the feature name that many banks call it and should be able to be searched for under that name. It adds minimal if any security. Anything that your server can present to the user, a man in the middle can act as if they were the client and get the same information. SiteKey (which is likely what your bank calls it) is not secure and doesn't add ...


22

The answer depends upon what kind of browser you are using, so I'll break it down. Mobile browsers. You can't trust anything you see. Sorry. Life on a small screen sucks. That's just the way it is. (Did you want an explanation why? Any web page can go full-screen, using mobile-specific tricks like scrolling the page down so that the address bar is not ...


21

This partly depends on the kind of software the dev team is expected to develop. Some types of software are easier to develop without administrative rights than others. For example, you can do a fair amount of web-based Java development using the likes of Eclipse with Maven artifacts, all installed locally (and typically tested on port 8080), without ...


21

Since you didn't enter your second factor code from your phone, and since you didn't say that you received a text requesting the second factor, you should be safe. However, if you want to be sure that all bases are covered (or if you hadn't enabled 2 factor authentication), there are a few things to check to be sure that you haven't been compromised and ...


19

This type of attack is called "Vishing". I don't think it's very common, but it's not unheard of. However, mostly its automated responses on bogus numbers, manual vishing I have to think is even less common. It sounds like the attacker was either hoping to get lucky, or it was a targeted attack - not really enough information here to tell. It could be ...


19

Phishing "red flags": Any un-solicited communication regarding any account you have. Certainly, this criteria is the easiest one to have a false-positive hit on, and probably shouldn't be the only clue you act on, but it's also your first clue. Any un-solicited communication regarding any account you don't have. There's definitely something wrong, if ...


19

Just an observation - I tend to promote ad blockers especially for my less savvy friends and associates - precisely because it reduces security threats. How? Because much of the most malicious content on the web comes in the form of a misleading advertisement like "click here to make your pc faster"... These largely disappear with an ad blocker.


18

Great question! As it happens, I can present experimental data on this question -- and the data is fascinating. (I noticed that some of the answers contain speculation from first principles about how much security these security images offer. However, the data turns out to have some surprises for all of us!) Experimental methodology. "Security images" ...


18

Microsoft recently got the ability to penalise a dynamic domain host that was seen to be hosting sites that deliver malware. They pursued legal action, and did gain possession of all of Vitalwerks domains. Within two days, Microsoft quickly realised how impossible the task of keeping nefarious uses off the service was and about faced and gave the domains ...


15

To answer your specific question, .local has already been reserved by ICANN as an internal gTLD. Please see section 2.2.1.2.1 "Reserved Names" in the ICANN Applicant Guidebook. The full list of reserved gTLDs are: AFRINIC IANA-SERVERS NRO ALAC ICANN RFC-EDITOR APNIC IESG RIPE ARIN IETF ROOT-SERVERS ASO INTERNIC RSSAC CCNSO INVALID ...


14

I am assuming that the bank wants to protect its customers from phishing. (Not its employees; that's a different problem, and if you want to know about that, you should ask that one separately in a different question.) The bank should take several steps: Avoid emailing out links to the site. Go clobber the marketing team and get them to quit doing that. ...


13

Security seals are used on phishing sites, and our tax dollars fund the TSA. Whether we like it or not, "Security Theater" rules us all.



Only top voted, non community-wiki answers of a minimum length are eligible