New answers tagged

0

As GdD said, it's CallerID spoofing with the hope of tricking you into answering a 'local' call. I've had this happen where they used my own number as the Caller ID number! I answered because I thought there might have been a glitch in the matrix and that it was a legitimate caller, but no, it was spam (and yes, I should have known better.) Their real ...


2

The telephone system has been designed so that a caller can replace their phone number with a fake, and some unscrupulous companies use this to change their number to appear to be local to the person they are calling. They aren't using specific numbers of people you know, just something picked at random. The thinking is that a person is more likely to pick ...


1

AdHominem is right; using email verification prevents this attack vector. It's a usability challenge, though. I think that for many sites the right (but cumbersome) way to do it is as follows: Allow the user to complete the entire signup process and start using the site with a low-privilege, temporary account. You should probably prevent them from taking ...


7

The email harvesting scenario you describe is really slow and not likely to happen, at least as a way to gather lots of email addresses. The attacker would need to brute force really long strings against your form. As already stated by symcbean, emails are already very cheap if you buy them and it's pretty easy to block such attempts if someone tries to use ...


0

instead we could just use in the login form a username without leaking the registered email, and sending an alert to the users in case there is a failed login attempt to their account to warm them that there is someone who wants to connect... Giving such information/clous will just make brute force easiest for an attacker, for example if i give to a website ...


3

There is no weakness in the SMTP protocol itself, but there is a problem of trust. You can send a letter by snail mail and simply write a different sender on the letter. The letter will still be delivered to the recipient even if the sender is spoofed. And exactly the same can be done with SMTP, which is just the electronic way of delivering letters. The ...


0

I'm surprised nobody mentioned bitcoin. While hashcash may have been impractical for email systems, it has proved useful in cryptocurrencies algorithms for proof of work of miners. "Hashcash is a proof-of-work system used to limit email spam and denial-of-service attacks, and more recently has become known for its use in bitcoin (and other ...


1

All they have to do is view the page. Specifically, it is ran through iframe cross-scripting or Adobe Flash (< v15). There are also more obscure ASP .NET and PHP viruses that utilize drive-by-download tactics. These are less common, but it was how many banks were hacked in 2010. There have been historically viruses embedded within files. A programmer ...


1

From Comodo.com's newsletter: A 'drive-by-download' attack is a malware delivery technique that is triggered simply because the user visited a website. Traditionally, malware was only 'activated' as a result of the user proactively opening an infected file (for example, opening an email attachment or double clicking on an executable that had been ...


2

Yes, using any browser exploit. https://en.wikipedia.org/wiki/Browser_exploit http://krebsonsecurity.com/2010/01/a-peek-inside-the-eleonore-browser-exploit-kit/ What current browser exploits exist is anybodies guess however. No spam filter will be able to filter out all malicious URLs though. You will need to educate your users.


2

Anything what the browser can do without human intervention can be automated. This might be done from outside by looking at the code or one might simply control the normal browser with Selenium or similar tools. Since you will pay users for visiting the page the chances are high that somebody likes to earn easy money and will automate the visits.


0

They might be trying to increase the search ranking of a site or something else - as far as I understand search engine rankings, the more places that link to something, the higher it's ranked. The higher a dodgy site is ranked, the more likely potential victims are to click on it when searching.



Top 50 recent answers are included