Tag Info

Hot answers tagged

138

You most definitely live in a sense of false security! Social engineering is very prevalent still today, and I doubt that is about to change in decades if ever. Here are some brief explanations on why social engineering works. It's tough to cover everything because social engineering is a really broad field. Some reasons why social engineering works (From ...


52

A few scams I've seen making the rounds: Use it to dial a premium rate number owned by the group. In the UK, 09xx numbers can cost up to £1.50 per minute, and most 09xx providers charge around 33%, so a five minute call syphons £5 into the group's hands. If you're a good social engineer, you might only have a 10 minute gap between calls as you wander ...


41

Not at all a guarantee. HTTPS means that the web page has SSL, which simply means that your connection to the page is encrypted. The content on the page could be anything that could be posted on any web site whether encrypted by SSL or not.


33

No, HTTPS does not necessarily mean that a site is not malicious. HTTPS means very little as to the security of a site. It's specifically geared to keep your communication with the site secure from eavesdroppers and tampering, but offers nothing as to the security of the site itself. Yes, a site serving content over HTTPS has a certificate. That means ...


28

Stack Exchange has multiple layers of security preventing this. Captchas and email addresses are required. The email check is easy to beat with a script, but the captchas aren't; you'd need a Captcha breaking service to even get this off the ground. None of your bots can vote at the start, so you can't accumulate rep just by posting questions; human eyes ...


27

Yes, any system is just as weak as the weakest member, and that is the human being, and it always will be. You may be 'immune' for some of these most obvious techniques now, but does that equally apply to the stressed secretary who gets a phone call from the 'IT department' to quickly lookup some important information on her bosses computer which can not ...


19

When I've been asked to setup some presentations about security awareness, I've always used something that is familiar to the user base to demonstrate weaknesses that can be exploited. Let's take a simple organization, Acme. Acme has about 200 employees, a robust IT infrastructure, top of the line firewalls, secure applications, a smart CISO, etc. Their ...


18

They could use it to send the detonation signal to that nuclear weapon they've secreted in a warehouse in Manhattan. That's pretty much the worst-case scenario.


17

Forget about it, just report to police (local and in Spain) and let them deal with it.


16

They could dial their own number to get yours (assuming your number isn't private.) I think I just invented a new, somewhat forceful and creepy, pick-up move.


14

You mistyped the URL: http://drive.googe.com http://drive.google.com ^ There I confirmed that the redirect to router.php happens when you mistype the URL, and does not happen when you type it correctly. Note that typosquatting (which is what this is called) is a serious security problem as you no doubt can see. Had the ...


13

@p____h already answered pretty well most of what occurs when an account is hacked, but I wanted to add my salt regarding a recently hack of a Gmail account that is very interesting to read! It's the recent Cloudflare attack. This is just AMAZING, the attacker used 4 flaw in various services, not only Cloudflare's : AT&T was tricked into ...


13

Social engineering is hard to mitigate problem. Why? Because it's targeting the weakest security point of all system: users. So indeed, the more complicated the system is, the more complicated for attacker it gets. But usually, they get information because someone does not respect the protocol, e.g. sending confidential data by fax, giving information to ...


13

The only instance where I can think of the FCC requiring that a password be clear is related to amateur radio, and even that isn't truly the case. In six years at an audit firm, and all in everything I've ever read including a lot of court briefings, I've never heard anything that hints that such madness is actually justified anywhere. It's not uncommon ...


13

I'd say the best way to educate others about social engineering attacks is to demonstrate it to them. Explaining the concepts in theory is all well and good, but most people won't actually absorb the lesson until they actually experience the impact it could have on them. There's this funny scene in the movie Now You See Me where several magicians tricked ...


12

I did little more digging by myself and I was playing with Google for a couple of hours... The numrange operator was much more problematic when it was introduced by Google than it is now. A couple of years ago you could harvest CC#s, but then Google limited the range of numbers in a query to 5 digits. If you use 6 digits in a query then you get this: ...


12

Social engineering revolves around psychology. It tries to influence human behavior to reach a goal, and unfortunately it often works quite well. In my opinion the best way to educate people is by example. An interesting video is the Social Engineering LIVE demonstration from Defcon. Most of the time a social engineer will be required to take the ...


11

Social engineering (SE) is not only about exploiting information which attacker has, but also about exploiting patterns of (human) behavior. To explain this, let's do a little exercise - say out loud the color, not the word. Can you see the "exploit" here? The use in real life situation of this "exploit" is very questionable, but it very clearly shows us ...


10

Strong: yes; easy to use: no. A cryptographic algorithm provides a precise functionality, and for most functionalities we do know algorithms which, when implemented properly, are strong enough (which means: nobody has a clue about how to break them with non-sci-fi hardware). However: It turns out to be quite hard to implement any given cryptographic ...


10

It is one of the most used forms of targeted attack when the goal is internal information - in working with social engineering attack teams for many years we have had access to server rooms and secure areas, received confidential paperwork, been given accounts on sensitive systems etc. People, as a generality, are helpful and ignorant. This sounds harsh, ...


10

Numrange has been criticized for potentially aiding harvesters -- bots that collect large numbers of CC#s, SSNs, emails, etc. Someone who wants to harvest CC#s might only have to write a crawler for google search results instead of crawling a large chunk of the web themselves. Obviously, unless Google takes countermeasures, crawling one website (or using ...


10

First of all, did you somehow manage to check it with your friend if his account really did get hacked into (through another email, IM, mobile, whatever)? I guess you did, but still, there is a small chance that he might indeed be in trouble. Secondly, while you're waiting trying to figure out a way to catch this guy, some other friends of your friend might ...


10

If attackers are doing a MitM to inject good answers in the stream, I certainly won't mind... More seriously, StackExchange counts on most people being basically honest, and most attackers being basically people, i.e. lazy. It takes quite some effort and resources to maintain a working wide-scale Man-in-the-Middle attack so we can just assume that the ...


9

My metaphor for social engineering is that it's like water - it will find the point of least resistance and work it's way in. When user's have two factor authentication, then you're right that you may seal up one point in the leaky dam of access to the system - I would hope that most users won't blindly hand over their token, and with the security ...


9

There are a lot of ways which could be used to hack into your account. Firstly, a lot of people use the same password to register everywhere. If you create account on the vulnerable website, then someone could hack into that website and get your credentials (stored at database). Then attacker has your e-mail, your password and if that password is the same ...


9

Two possible scenarios that pop into my mind: Since we can assume the attacker probably had access to his email, he probably had access to his address-book as well and he could have requested friendship (search for friends by email address) from all the people that had a facebook account registered to one of the email addresses from that address-book (some ...


9

First off what you're doing sounds like a pen. test/security test. It's very important when doing this kind of testing to ensure you have a signed off scope document from someone in authority at the company you're testing, as without that you could do something that the company wouldn't be happy with. Also without authorization from the company some ...


8

I think you have hit the nail on the head when you say, "...not interfacing with our users very often" You absolutely must work with the end users to understand their view - most end users have no interest in understanding what 0-day even means, let alone why they should care. A lot of what I do is that interface between technical security teams and ...


8

Reverse social engineering (RSE) can mean two things - attack where attacker is trustworthy entity (case 1) or attack where attacker becomes victim (case 2). When we talk about case 1 there are usually three stages of attack. Stage one is called sabotage where initial damage is made. Stage two or advertise is where attacker gains trust of victim and pursue ...



Only top voted, non community-wiki answers of a minimum length are eligible