Tag Info

New answers tagged

2

I wouldn't put it past Facebook to "mess up". From the headers, it appears that Google's servers saw the request as coming from IP address 66.220.144.148, which is indeed part of the facebookmail.com domain. The Google server verified the DKIM signature on the email, relatively to the public key found in the DNS as a TXT record for ...


0

Full disclosure: I'm the owner of SelfPhish.com When I was looking for examples of online sources, I found material was either skewed too much to the simplistic, or too much to the technical. When it comes to phishing education, what you are looking to do is not simply to educate, but to change behaviors. More specifically, how to respond to 'triggers'. ...


0

Google is your friend. http://www.webroot.com/us/en/home/resources/articles/pc-security/computer-security-threats-phishing Phishing attacks can be very convincing because sometimes the attacker can spoof the "from" address making the email seem like it is from a trusted colleague. The email may contain convincing information, gleaned through social ...


0

Phishing is usually carried out by spoofing. You get a link asking you to login with the credentials to some site whose appearance is identical to some trusted sites you know. Your parents probably clicked on the link, and logged in too with gmail credentials. This way the attacker obtained the login credentials. However, I believe that the security of the ...


1

If you want to be as sure as you can be, reinstalling the operation system from read only media is a good idea.


0

What I believe is you need to do as long term plans Implement proper incident response mechanism Give information security awareness sessions for employees. (E.g. IT Security Day) Keep contingency plans for such events.


1

Change the users email password, (Also suggest if this password has been used elsewhere (either in your company or outside on other websites) by collegue to change it their aswell to a new unique password) Check for any login attempts from unknown locations If such logins emails exist check logs for emails sent also check whats in the mailbox and assess ...


1

There is no universal standard about what "being logged in" actually means, so there is no universally applicable solution. Depending on the website, the attacker could use a javascript which attempts to load an image or other media file from the external website which can only be requested by a user which is logged in. When the user is logged in, the load ...


1

For future occurrences (and you can be sure there will be more - the question is whether your employees will fall for that or not) you can consider purchasing some defense mechanism that will prevent the leakage of the credentials in the first place. For example Trusteer's Apex or ProofPoint


3

If you have backups of your site, I would remove all of your files and start again from a known good backup. I would imagine there is a tiny bit of code somewhere redirecting to this bad page, probably buried in a comment or obfuscated to look harmless. Change the passwords to all of your admin areas, webmail consoles, SSH, ftp access etc. It might also ...


3

Block the phishing link in the company firewall. If the co-workers only read their mails in the office, this would suffice. But this seems highly unlikely. Further steps if the co-workers use company laptops, block the link on the laptop firewall too. Lastly, if they access it from any other personal device, make sure they know a phishing mail is going ...


4

Everything is fine now no. some 3rd party had write-access to your server and you dont know what mailicous stuff is left behind. Can anyone help? yes, get a professional to help you, this is serious since you are putting your users at risk.


0

The flip side is that an XSS in a site gives you access to everything on the same origin. So, if an attacker finds an XSS anywhere in example.com, they can use it to steal login credentials from example.com/login. With a separate login domain and HttpOnly cookies, this is significantly mitigated. (Of course, you need some way to pass credentials from the ...



Top 50 recent answers are included