Questions tagged [social-engineering]
Social engineering is the act of manipulating people into performing actions or divulging confidential information.
101
votes
19answers
21k views
Defence methods against tailgating
This is a follow-up question to this one: Roles to play when tailgaiting into a residential building
How do you protect yourself or your company against tailgaters? What is the best answer when you ...
108
votes
6answers
19k views
Roles to play when tailgaiting into a residential building
Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
44
votes
2answers
12k views
Does this mean Target's twitter was successfully attacked?
I was just surprised to see this suspicious promoted tweet, asking me to send Bitcoins
I added the hand-drawn red lines so I am not responsible for propagating the apparent scam.
Clicking on the ...
7
votes
3answers
492 views
What (besides not complying, and reporting) should I do with blackmail emails? [duplicate]
I received the following email which claims, among other social engineering, to have installed a keylogger on a former system administrator's Linux box:
I know [old password deleted] one of yo...
2
votes
2answers
160 views
How do I protect myself against SIM hijacking/social engineering?
There are several posts like these:
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
2
votes
2answers
210 views
Is single-click phishing possible?
For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL?
Notice: The user only does a click on the URL, no ...
32
votes
7answers
6k views
How do hackers make the victim access an XSS attack URL?
As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers.
Say, if a page has a vulnerability of loading arbitrary script when user ...
5
votes
2answers
231 views
What is the name for building trust on a platform before pillaging?
What's the common or recognized name for a vulnerability on a platform where someone can build trust and than pillage/exploit that trust for profit or information? It's driving me crazy, and I ...
68
votes
5answers
10k views
Advised to block all traffic to/from specific IP addresses
My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the ...
0
votes
1answer
71 views
Spam identification
We have a spamfilter running that does a very good job at tackling common spammer issues.
From what it catches, I'm assuming it blocks mails based on a few things:
SPF checks
Certain attachment ...
6
votes
1answer
139 views
How can companies verify that a national security letter is real? [closed]
It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it.
There ...
1
vote
1answer
112 views
Should I reply to an email saying that I requested online access to a website?
I received an email saying I requested access to a website. The email also includes a one-time passcode. I did not do anything that would require a one-time passcode. At the bottom of the email is a ...
1
vote
2answers
120 views
How is there a preview for a fake docx file in gmail
I recently got a nasty email containing two files. I didn't open them but did check and realised they were not docx files which was the intent but on gmail in the document preview it shows what looks ...
0
votes
0answers
68 views
What can be compromised if someone knows this information about me?
If someone has my DOB, last four of my SSN, my name, and my address, what kinds of things could they do that would potentially ruin my life? What are ways they could "hack" institutions and take all ...
0
votes
1answer
133 views
Server encryption to prevent access by hoster
A friend told me one of their company servers got recently hacked. The server was super secured software side.
It turned out the attacker called the hoster and used some social engineering skills to ...
7
votes
1answer
309 views
What are good methods of visual security?
What are good methods of visually securing sensitive information that might appear on your screen from the outside world?
An example to illustrate my question would be the following:
You're sat in ...
4
votes
1answer
280 views
Reality Check: Create chaos at an office
An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
0
votes
0answers
60 views
I randomly have 11 subscriptions to newsletters on gmail. Should I be worried?
Just signed up for StackExchange today... That's the only thing I can think of.
Do any of you think I could possibly be the victim of some kind of email exploit? I marked all of them as spam and ...
3
votes
2answers
96 views
Someone is using similar domain and spamming clients
This is the problem my friend is facing in his office.
Someone is using an almost similar domain as my friend's company (via email). This person is posing as their company and asking them to send ...
3
votes
1answer
23k views
What can be done with the last 4 digits of one's SSN [closed]
If a hacker were to get the last 4 digits of your SSN (and maybe some other info like name, etc), what could they do?
To avoid the possibility that they could guess the other digits from date/...
0
votes
0answers
310 views
SEToolkit Credential Harvester not returning credentials
When I use credential Harvester > Site Cloner in my LAN environment it works fine. That means it returns:
1) POSSIBLE USERNAME FIELD FOUND
2) POSSIBLE PASSWORD FIELD FOUND
3) Redirects to actual ...
0
votes
1answer
210 views
Fake secured WiFi network to harvest password [duplicate]
I'm not finding a lot of information on this topic although it seems so simple, so I assume it isn't possible, but I was wondering if it is possible or not to create a fake acces point that looks like ...
4
votes
2answers
117 views
Amazon 2FA: Compromising the email leads to compromising 2FA, e.g removing the other factor?
I had some interesting situation: My Amazon account has 2FA enabled where my smartphone with google authenticator is my second factor.
Due to issues with this phone my second factor basically broke (...
0
votes
2answers
386 views
Conducting Ethical Phishing Attack [closed]
For research purposes, I'm conducting an ethical phishing attack in my institution. I have permission from the institution for the same. I've created the phishing site and the email content, and I'll ...
0
votes
1answer
53 views
Seeing SSL requests in unencrypted form from a remote client [closed]
I was wondering how I could be able to see SSL requests in an unencrypted form from remote clients (specifically, my phone).
I heard that you are supposed to use CA certificates, but how would I ...
0
votes
1answer
86 views
How to get the statistics of users opening the attachment in a phishing mail during a social engineering campaign test?
I have to do a social engineering test for a friend's small company. He wants to know how many people opened the mail and then opened the attachment. How can I do that? The file can be anything- pdf,...
2
votes
1answer
141 views
What potential threats lie ahead after the hack of equifax in 2017?
Having that literally every single US resident's information is now exposed to hackers and malicious social engineers. What are some threats that we will inevitable encounter in the coming months or ...
0
votes
3answers
2k views
How to determine IP address of target device or network
I know most exploits over the internet are opportunistic, but assume an aggressor has a specific target, but no physical access to that target. How do you find the target network or device to begin an ...
0
votes
4answers
130 views
What is a good method to authenticate users and make sure they don't give their credentials to someone else?
I'm new here I hope this is the right place to ask this question, I work at a call center and I've been asked to create a TimeClock system however we have the problem that agents share their ...
2
votes
0answers
67 views
Are there any good OSINT feeds related to phone phishing? [closed]
There are lots of feeds related to fraudulent and malicious domains and IPs, but we're seeing more and more social engineering attempts coming in via phone.
When these are reported to us, I'd like to ...
1
vote
3answers
173 views
What precautions/training do companies have against social engineering strategies?
For example, if someone were to call a cell phone provider like T-Mobile, pretending to be another person to get some information, how can T-Mobile verify if it is the actual person? I'm assuming that ...
3
votes
4answers
2k views
Is it dangerous for a scammer to know just your name and birthday? [closed]
Basically, this afternoon, I got a call that I had picked up. The caller asked for (my name) stating that they were from this company associated with my healthcare. The call seemed pretty legit, and ...
1
vote
1answer
98 views
Account hacked on mobile music streaming app - what should I do next
I'm a software developer so aware of basic security issues. I use a popular music streaming service and a few months back signed up for their paid plan as I was enjoying the experience. I use the ...
24
votes
7answers
6k views
Song Lyrics as passphrases [duplicate]
I have a question slightly similar to this question. I am familiar with the
correct horse battery staple example from xkcd, yet I am leaning towards songlyrics as a passphrase, since I have a brain ...
6
votes
2answers
1k views
The audacity of accountchek.com
Maybe I'm being overly sensitive as an IT professional who has a security mindset, but I am doing a mortgage refinance right now. My lender, who is legitimate (I used them a few years ago for the ...
4
votes
2answers
557 views
How to mitigate evil twin WIFI social engineering attack?
I just come across this article: Capturing WPA Passwords by Targeting Users with a Fluxion Attack.
Although WIFI Evil Twin attack and WIFI de-authentication attacks is known for a long time, a ...
1
vote
0answers
189 views
Is someone trying to hack me through facebook?
For the past few days i have been receiving friend requests in facebook from some hot girls that have some pictures of them in sexy poses and in the timeline it says they want to meet and have sex and ...
2
votes
1answer
87 views
Responsibility of disclosing potential social engineering attack
I've just gotten a text message from a number pretending to be my bank and telling me to install a certificate from a suspicious link (link looks like this: bankname-certificate.ru/installation not ...
3
votes
3answers
240 views
How can I track whether a pdf was opened or not?
I'm working on some options for a social engineering assessment for a client. One of the things I'd like to do is email a bunch of people a pdf attachment (or put the pdf on removable media) and then ...
2
votes
0answers
165 views
Trouble finding LHOST and which IP address to use?
I'm currently using the social engineering toolkit (SET) and I'm generating a malicious PDF file. One of the first things SET asks me after choosing a File-format exploit is the IP address for the ...
3
votes
3answers
118 views
Could a phishing page generate a genuine session with the targeted service?
At the end of this tutorial the author gives a few ideas for improving a basic phishing attack.
One of them intrigued me, in particular: Is it possible to use the credentials that a victim enters in ...
1
vote
1answer
41 views
How handle Informational waste
I do big tiding of my flat and I found out, that lot of my waste consists from boxes with my addresses and receipts from online store deliveries. What is the most easiest and also most efficient way ...
2
votes
0answers
311 views
Looking for a specific story of a pen-tester who used a fake raffle to get a keylogger into a company
While reading about USB hardware keyloggers on the web a few months ago, I stumbled upon a story by a rather patient pen-tester:
He organized a raffle where the first prize was a cool gamer ...
-3
votes
1answer
59 views
What is the term to describe “Transitivity” in network security?
If A's security is breached, while A and B are in the same network,
then B's security is breached.
I can imagine this could happen to computer networks, but also to social networks; for example if ...
1
vote
3answers
280 views
Is there any way to detect Phishing and Deceptive page ( social engineering )
I'm programmer and I have a website that allows users to upload their HTML websites to it.
The user will zip up a folder and then will upload it to my website where it will show up as sub-domain.
I ...
3
votes
4answers
281 views
Preventing phishing / spear phishing of employees
We get a lot of targeted phishing emails to our employees, semi-sophisticated ones where they speak about a project or give an outline brief. We then get back to them and they send us an 'attached PDF'...
2
votes
2answers
143 views
How to convince employees not to click spam links in their email accounts?
In my company spam emails are becoming a real headache. Since the number of employees is growing rapidly, the email accounts are to. We have managed to take security measures in a technical point of ...
3
votes
1answer
1k views
Can Self extracting rar file (SFX) be used to automatically install malicious software?
Self extracting RAR files can be made containing dangerous files but can these SFX files be used as a tool for social engineering attacks (email attachments or on promotional CD-ROM etc.) to trick a ...
1
vote
2answers
111 views
Get info of computer (logged in username) secretly using USB drive
I have a scenario in which I have to do a social engineering exercise for a client. The exercise is the simple old free USB trick, but the catch here is that I have to only get only the (non damaging) ...
9
votes
2answers
1k views
Why do the large majority of big organizations have “known bad” password policies?
I saw a recent password question on security.stackexchange "Is the NHS wrong about passwords?" The question is very specific about one organization but from what I've seen the same "known bad" ...
