Tag Info

New answers tagged

1

A big part of how people respond to these tests has to do with why they think the test is being given. People seem OK with running tests to measure the effectiveness of corporate training programs but less happy if they feel that they are being individually tested. Make it clear that there is no reward or punishment for their performance on the test. ...


4

I run a service that tests people and organizations in their ability to spot and properly respond to phishing attempts. You must let all users know that a test will be performed, even the CEO. This does not mean that you inform them then try to phish them right away. With a few days delay, people will stop being on guard against a test. How this is done, ...


1

There is no such thing as bulletproof security. What could be done is to use a text based mail client such as mutt. This way, you'll see the link instead of being able to click on it. Also you can try a good spamfilter and setting it tight. There are multiple phishing training frameworks. For example the Simple Phising Toolkit, which you can use to educate ...


0

There is no one answer to this, a number of things can help, spam filters will help, but A.They won't catch everything and B. They might filter legit email (especially if you have it set to be very aggressive.) It is really a trade off. When explaining to users the best thing is general user education. Explain the risks, explain what to look out for and ...


1

The problem you are trying to solve is that the client needs to be identified by the server (to know which user this is) but the server needs also be reliably identified by the client to detect phishing. I agree that simply using HTTPS for identification of the server is not enough, since an attacker might simply own a similar looking domain (e.g. paipal.com ...


1

Security measures strengthen in inverse proportion to convenience... so I probably wouldn't do this... and I don't know a single site that does this... but... you did ask. How about a workflow like this: User accesses web site and enters user name Site looks up user's phone number and sends one time code or a random word as SMS. Site displays one time ...


1

I know of one that let's users upload a picture of their own choosing when the account is set up. (They can change it later.) The picture is shown on the password screen, after the user ID is entered. Wrong or no picture == fake web site. You would want to use a back-end program to make the pics a standard size and to strip out meta data before storing ...


0

There are some good points in the answers, but I think we need to clarify a few definitions. There is a difference between spam, sometimes referred to as unsolicited commercial email and phishing, attempts to get the user to respond to a link, open an attachment or perform some other action which either assists in the installation of malware or fools the ...


0

Only enter your credentials for the service when the domain matches the one you expect e.g. facebook.com for Facebook, Google.com for Google, etc. Also check that the protocol is https in the address bar, and that there's a padlock symbol displayed. It's all about the address bar. Simples.


2

I protect myself from look-alike phishing sites by using the Lastpass browser extension to store my passwords. Lastpass will by default only enter credentials on the correct domain, and it is much simpler for a computer to parse the domain than a human. If you are about to enter credentials into the incorrect domain, Lastpass provides a warning: Lastpass ...


0

Unfortunately, there are little safeguards except from keeping attention: Check, that the the link to the login goes to the site it claims that it comes from (i.e., verify, that the login forms go to google.com, facebook.com etc.) Check that the link uses the https protocol Only use your Google/Facebook/Whatever account on site you trust And check that you ...


1

A user can detect he is probably on a phishing web server by reading the first part of the URL after the protocol header: http:// https:// For example to connect on this web server the URL is something like: http://security.stackexchange.com/login... and the field to check is: security.stackexchange.com If in place of this web server name, which I ...


-1

There is no way to stop others from copying front-end files, so it's pretty much impossible to stop phishing. HTML, CSS, and Javascript documents in addition to other files such as images will always be available to the public. The phisher(s) will just steal whatever documents they need to re-create the front-end of the targeted website then create their ...


0

Disable third party payment by contacting your operator. You wont be able to pay by phone service - but who needs this? Otherwise if needed, use Adblock.


0

Verizon and Sprint recently got in trouble for allowing unauthorized third-party charges. As a result of this, Sprint and Verizon agreed to provide a free service that blocks third party charges. I'd suggest calling up your carrier, and threatening to report them to the FCC if they prove to be unhelpful. You might also be able to receive compensation.


-1

Machine learning algorythms are sensitive to certain words / patterns. Those spelling mistakes are often an attempt to fool the algorithm into 'thinking' that it deals with a new words. When the algorithm gets a feedback from users marking those messages as spam, it adds those misspelled words or word patterns to its anti-spam filters.


8

Is it possible that by appearing to be less intelligent they seem (perhaps even subconsciously) to be less of a threat? I mean, there's no way somebody who confuses you're and your could fool someone as smart as me!


9

Spam filters work by looking for certain words. (among many other test) If these words are misspelled, the filter won't recognize them.


101

This may well be for the same reason as many scammers rely on the tired old 'Nigerian Prince' strategy: by self-selecting for gullible targets, they can be more efficient. In phishing, as in scams, sending the initial batch of emails is the easy part. The hard part is coaxing information out of the target (which can require a concerted exchange of emails). ...


41

Emails with mistakes are probably from people who doesn't know English well enough to write correctly. Many phishing emails do not have mistakes, and may be copied directly from emails sent by the company it claims to represent. See this for more details: "Phishing" red flags and countermeasures


1

These scammers often scare people by disguising harmless elements (such as event log entries, firewall rules, etc) into evidence of compromise and malware. For example they could tell you to execute some commands or find in advanced system properties what looks like a random number but is actually an reference to some system component common on all systems, ...


0

The iPhone in its unjailbroken state is a highly secure platform, arguably one of the most secure. For the most part, you can’t get a drive-by download on iOS as easily as on a desktop due to the extremely good sand boxing it utilizes. Ironically, this strong sandbox model is what makes apps sharing data with each other (a perk Android users have enjoyed for ...



Top 50 recent answers are included