Tag Info

Hot answers tagged

134

You most definitely live in a sense of false security! Social engineering is very prevalent still today, and I doubt that is about to change in decades if ever. Here are some brief explanations on why social engineering works. It's tough to cover everything because social engineering is a really broad field. Some reasons why social engineering works (From ...


46

A few scams I've seen making the rounds: Use it to dial a premium rate number owned by the group. In the UK, 09xx numbers can cost up to £1.50 per minute, and most 09xx providers charge around 33%, so a five minute call syphons £5 into the group's hands. If you're a good social engineer, you might only have a 10 minute gap between calls as you wander ...


28

Stack Exchange has multiple layers of security preventing this. Captchas and email addresses are required. The email check is easy to beat with a script, but the captchas aren't; you'd need a Captcha breaking service to even get this off the ground. None of your bots can vote at the start, so you can't accumulate rep just by posting questions; human eyes ...


26

Yes, any system is just as weak as the weakest member, and that is the human being, and it always will be. You may be 'immune' for some of these most obvious techniques now, but does that equally apply to the stressed secretary who gets a phone call from the 'IT department' to quickly lookup some important information on her bosses computer which can not ...


18

When I've been asked to setup some presentations about security awareness, I've always used something that is familiar to the user base to demonstrate weaknesses that can be exploited. Let's take a simple organization, Acme. Acme has about 200 employees, a robust IT infrastructure, top of the line firewalls, secure applications, a smart CISO, etc. Their ...


13

The only instance where I can think of the FCC requiring that a password be clear is related to amateur radio, and even that isn't truly the case. In six years at an audit firm, and all in everything I've ever read including a lot of court briefings, I've never heard anything that hints that such madness is actually justified anywhere. It's not uncommon ...


13

@p____h already answered pretty well most of what occurs when an account is hacked, but I wanted to add my salt regarding a recently hack of a Gmail account that is very interesting to read! It's the recent Cloudflare attack. This is just AMAZING, the attacker used 4 flaw in various services, not only Cloudflare's : AT&T was tricked into ...


13

I'd say the best way to educate others about social engineering attacks is to demonstrate it to them. Explaining the concepts in theory is all well and good, but most people won't actually absorb the lesson until they actually experience the impact it could have on them. There's this funny scene in the movie Now You See Me where several magicians tricked ...


12

Social engineering is hard to mitigate problem. Why? Because it's targeting the weakest security point of all system: users. So indeed, the more complicated the system is, the more complicated for attacker it gets. But usually, they get information because someone does not respect the protocol, e.g. sending confidential data by fax, giving information to ...


12

I did little more digging by myself and I was playing with Google for a couple of hours... The numrange operator was much more problematic when it was introduced by Google than it is now. A couple of years ago you could harvest CC#s, but then Google limited the range of numbers in a query to 5 digits. If you use 6 digits in a query then you get this: ...


11

Social engineering (SE) is not only about exploiting information which attacker has, but also about exploiting patterns of (human) behaviour. To explain this, let's do a little exercise - say out loud the color, not the word. Can you see the "exploit" here? The use in real life situation of this "exploit" is very questionable, but it very clearly shows ...


11

Social engineering revolves around psychology. It tries to influence human behavior to reach a goal, and unfortunately it often works quite well. In my opinion the best way to educate people is by example. An interesting video is the Social Engineering LIVE demonstration from Defcon. Most of the time a social engineer will be required to take the ...


10

First of all, did you somehow manage to check it with your friend if his account really did get hacked into (through another email, IM, mobile, whatever)? I guess you did, but still, there is a small chance that he might indeed be in trouble. Secondly, while you're waiting trying to figure out a way to catch this guy, some other friends of your friend might ...


10

Numrange has been criticized for potentially aiding harvesters -- bots that collect large numbers of CC#s, SSNs, emails, etc. Someone who wants to harvest CC#s might only have to write a crawler for google search results instead of crawling a large chunk of the web themselves. Obviously, unless Google takes countermeasures, crawling one website (or using ...


10

Strong: yes; easy to use: no. A cryptographic algorithm provides a precise functionality, and for most functionalities we do know algorithms which, when implemented properly, are strong enough (which means: nobody has a clue about how to break them with non-sci-fi hardware). However: It turns out to be quite hard to implement any given cryptographic ...


10

If attackers are doing a MitM to inject good answers in the stream, I certainly won't mind... More seriously, StackExchange counts on most people being basically honest, and most attackers being basically people, i.e. lazy. It takes quite some effort and resources to maintain a working wide-scale Man-in-the-Middle attack so we can just assume that the ...


9

My metaphor for social engineering is that it's like water - it will find the point of least resistance and work it's way in. When user's have two factor authentication, then you're right that you may seal up one point in the leaky dam of access to the system - I would hope that most users won't blindly hand over their token, and with the security ...


9

It is one of the most used forms of targeted attack when the goal is internal information - in working with social engineering attack teams for many years we have had access to server rooms and secure areas, received confidential paperwork, been given accounts on sensitive systems etc. People, as a generality, are helpful and ignorant. This sounds harsh, ...


9

Two possible scenarios that pop into my mind: Since we can assume the attacker probably had access to his email, he probably had access to his address-book as well and he could have requested friendship (search for friends by email address) from all the people that had a facebook account registered to one of the email addresses from that address-book (some ...


9

There are a lot of ways which could be used to hack into your account. Firstly, a lot of people use the same password to register everywhere. If you create account on the vulnerable website, then someone could hack into that website and get your credentials (stored at database). Then attacker has your e-mail, your password and if that password is the same ...


9

First off what you're doing sounds like a pen. test/security test. It's very important when doing this kind of testing to ensure you have a signed off scope document from someone in authority at the company you're testing, as without that you could do something that the company wouldn't be happy with. Also without authorization from the company some ...


8

I think you have hit the nail on the head when you say, "...not interfacing with our users very often" You absolutely must work with the end users to understand their view - most end users have no interest in understanding what 0-day even means, let alone why they should care. A lot of what I do is that interface between technical security teams and ...


8

Reverse social engineering (RSE) can mean two things - attack where attacker is trustworthy entity (case 1) or attack where attacker becomes victim (case 2). When we talk about case 1 there are usually three stages of attack. Stage one is called sabotage where initial damage is made. Stage two or advertise is where attacker gains trust of victim and pursue ...


8

Many phones allow you charge with only power and ground connected. Some phones (looking at you, Apple) use the data lines to determine whether or not the charger is "permitted" to charge your phone. Other phones still (some Android phones in particular) explicitly ask you to decide what to do with the USB connection -- e.g. charge only, or mount as usb ...


7

Who's your daddy CUPP Description and download link is in the linked page(s). Downside is (as far as I know) they can be only used under Linux.


7

Modern ciphers and hashing algorithms are practically impossible to crack in a reasonable amount of time. There are other attack vectors though, like integration of the cipher in a practical system, block modes, random number generator, key management. Then there are non-cryptographically related attack vectors, which are the most commonly used vectors to ...


7

Modern ciphers, like AES are practically impossible to decipher without the key. I don't have the exact numbers, but trying to crack the key will take too long with the current hardware available. This does not mean that the same cipher would be secure in the future. Moore's Law comes into play. Hardware will get better, which will reduce the time needed to ...


7

Really, you can't. There is no authentication on the information. That said, the chances of a meaningful attack in that vector are probably fairly minimal in general, so the bank probably decided that it wasn't worth the cost of having SSL on the page (it does take more server resources to do HTTPS). The balancing point of what is a good trade off and ...


7

My 2 cents, not really from an IT security standpoint: Ideally you would be correlating and checking up on information found on this site. Generally, answers fall into two categories: Summarizing or explaining relevant information. Providing original thoughts or analysis. The first one ultimately comes down to someone re-writing existing human ...



Only top voted, non community-wiki answers of a minimum length are eligible