Questions tagged [social-engineering]
Social engineering is the act of manipulating people into performing actions or divulging confidential information.
181
questions
-1
votes
1answer
52 views
Social Engineering or Broken Authentication
If I go to a cybercafe and use one of the shared computers, and use a social media application, which deletes session IDs when the browser is closed.
A clever person comes, who knows about the ...
1
vote
2answers
239 views
How do I know/find out about Minecraft Server Vulnerabilities?
I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
7
votes
3answers
221 views
I have lost control of my online identity due to mistakes made decades ago. What can I do?
About 2 decades ago (late 90s/early 00s), when I was still in high school, I opened up social media accounts online. Over the course of a few years and using these social media platforms, I posted ...
25
votes
6answers
6k views
Is it a good idea to use non-ASCII names in the U.S.? [closed]
Grimes and Elon Musk named their baby: X Æ A-12.
What are the risks of non-ASCII names?
For example, does the COBOL unemployment platform support non-ASCII names? Would it be possible to get a ...
2
votes
1answer
87 views
How misappropriation-resistant are common deployed signature formats?
Given an RSA signature as produced by
openssl dgst -sha256 -sign rsapriv.pem -out afile.sig afile
and without access to the private key used for that, one can¹ come up with a fully functional RSA ...
0
votes
2answers
123 views
Phishing emails - What do I look for?
I want to be able to spot a phishing email. What are the things to check when investigating and doing forensics on one?
There are some things I know to look for already but I want to get moer ...
-1
votes
1answer
85 views
Are IPv4 more intuitively hard to track than IPv6?
I understand that it is easier for a human to intuitively figure out the alleged whereabouts of a machine if that machin's IP address is IPv6, rather than if its IPv4:
For example, since I configured ...
1
vote
0answers
91 views
Is Social Engineering out of scope unless explicitly requested? [closed]
I've seen some sample "What would you like to be pentested?" page (I can't find or remember the exact source) where Cyber, Physical and Social were asked separately (among other areas like Wifi, ...
12
votes
1answer
483 views
Canadian police mentioned a new line-trapping technique, but what is that?
The police in Canada are saying that there is a new technique ("line-trapping") where the scammers told a lady to call the police to confirm some fraudulent details, but when she hung up and called ...
1
vote
1answer
96 views
What is it called when someone glides through a building's external door behind you? [duplicate]
One form of social engineering is the practice of running up to a building's external door just as an employee is entering. The employee often holds the door open for the intruder, bypassing security ...
0
votes
1answer
218 views
“Harmless” script which downloads malicious script
What if I code a program without malicious code which would pass in every antivirus scan and after the virus scan and user giving special rights to it, it downloads and executes the real virus? Since ...
18
votes
1answer
2k views
How to protect yourself against OSINT?
I recently watched a video about OSINT and learnt it can be quite a powerful agent. I've been on the internet for years, and at this point I'm not sure what I've posted and where.
Given this is now ...
2
votes
1answer
111 views
How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?
How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
-2
votes
2answers
155 views
Is it social engineering when you know you are being social engineered? [closed]
More like a philosophical question.
0
votes
0answers
2k views
Meterpreter is failing to load any extension except the core commands
[*] Starting persistent handler(s)...
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_https
PAYLOAD => windows/meterpreter/reverse_https
...
2
votes
1answer
138 views
How safe is to have a LinkedIn account where you have published all the important information about yourself?
How safe is it to make your information public? I know that there are many risks from social engineers' side, if you put everything about yourself a hacker will have most of the information about you ...
0
votes
1answer
303 views
is it possible to evil twin a WPA 2 Wifi using one of EAP methods?
the same as fluxion but without the captive portal just like this video
Stealing 802.1x Credentials with Rogue AP & RADIUS server
he was able to get the username and the password of an EAP wifi ...
0
votes
1answer
89 views
Data leakage in internet-only services
Nowadays, internet-only services became very popular, for example, direct bank and many others. The advantage of such services is you don't have to spend the time to get to the office in order to get ...
0
votes
1answer
117 views
Tech support agent asked me some questions unrelated to tech support or my problem
About 4 years ago I was having a problem with my Microsoft Windows system so I went to Google and searched "Microsoft tech support phone number" to see the results and got the number from some random ...
6
votes
1answer
971 views
Understanding a Whatsapp account hack (social engineering?)
A friend of mine (Bob) received a suspicious Whatsapp message today, seemingly from a former colleague (Alice), who claimed to have "forwarded [to Bob] an SMS with a code in it by mistake", and who ...
0
votes
0answers
46 views
What to do after a social engineering attack was used to trick utility services at my hypothetical business? How to close the security hole?
Business Attack Scenario
Standard information that was ubiquitous through my chain-businesses
was exploited by a rogue group of former employees to sabotage. They
considered manipulating all ...
0
votes
2answers
181 views
Could someone commit a social engineering “hack” on a credit card processor to get my credit card number?
Peripherally related to: Is it safe to recycle unshredded credit card receipts?.
From some basic research, it seems as though the SEQ number is internal to the company running the POS software, the ...
2
votes
1answer
139 views
Social engineering testing methodology?
Is there anything that could be used as a social engineering testing methodology from any sort of organisation (example: ISO, SANS, PCI DSS etc.)
106
votes
19answers
23k views
Defence methods against tailgating
This is a follow-up question to this one: Roles to play when tailgaiting into a residential building
How do you protect yourself or your company against tailgaters? What is the best answer when you ...
110
votes
6answers
20k views
Roles to play when tailgaiting into a residential building
Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
45
votes
2answers
13k views
Does this mean Target's twitter was successfully attacked?
I was just surprised to see this suspicious promoted tweet, asking me to send Bitcoins
I added the hand-drawn red lines so I am not responsible for propagating the apparent scam.
Clicking on the ...
8
votes
3answers
804 views
What (besides not complying, and reporting) should I do with blackmail emails? [duplicate]
I received the following email which claims, among other social engineering, to have installed a keylogger on a former system administrator's Linux box:
I know [old password deleted] one of yo...
2
votes
2answers
255 views
How do I protect myself against SIM hijacking/social engineering?
There are several posts like these:
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
2
votes
2answers
239 views
Is single-click phishing possible?
For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL?
Notice: The user only does a click on the URL, no ...
32
votes
7answers
7k views
How do hackers make the victim access an XSS attack URL?
As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers.
Say, if a page has a vulnerability of loading arbitrary script when user ...
5
votes
2answers
244 views
What is the name for building trust on a platform before pillaging?
What's the common or recognized name for a vulnerability on a platform where someone can build trust and than pillage/exploit that trust for profit or information? It's driving me crazy, and I ...
67
votes
5answers
11k views
Advised to block all traffic to/from specific IP addresses
My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the ...
0
votes
1answer
89 views
Spam identification
We have a spamfilter running that does a very good job at tackling common spammer issues.
From what it catches, I'm assuming it blocks mails based on a few things:
SPF checks
Certain attachment ...
6
votes
1answer
165 views
How can companies verify that a national security letter is real? [closed]
It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it.
There ...
1
vote
1answer
128 views
Should I reply to an email saying that I requested online access to a website?
I received an email saying I requested access to a website. The email also includes a one-time passcode. I did not do anything that would require a one-time passcode. At the bottom of the email is a ...
1
vote
2answers
204 views
How is there a preview for a fake docx file in gmail
I recently got a nasty email containing two files. I didn't open them but did check and realised they were not docx files which was the intent but on gmail in the document preview it shows what looks ...
0
votes
1answer
141 views
Server encryption to prevent access by hoster
A friend told me one of their company servers got recently hacked. The server was super secured software side.
It turned out the attacker called the hoster and used some social engineering skills to ...
7
votes
1answer
346 views
What are good methods of visual security?
What are good methods of visually securing sensitive information that might appear on your screen from the outside world?
An example to illustrate my question would be the following:
You're sat in ...
4
votes
1answer
337 views
Reality Check: Create chaos at an office
An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
3
votes
2answers
105 views
Someone is using similar domain and spamming clients
This is the problem my friend is facing in his office.
Someone is using an almost similar domain as my friend's company (via email). This person is posing as their company and asking them to send ...
4
votes
1answer
49k views
What can be done with the last 4 digits of one's SSN [closed]
If a hacker were to get the last 4 digits of your SSN (and maybe some other info like name, etc), what could they do?
To avoid the possibility that they could guess the other digits from date/...
0
votes
1answer
317 views
Fake secured WiFi network to harvest password [duplicate]
I'm not finding a lot of information on this topic although it seems so simple, so I assume it isn't possible, but I was wondering if it is possible or not to create a fake acces point that looks like ...
4
votes
2answers
150 views
Amazon 2FA: Compromising the email leads to compromising 2FA, e.g removing the other factor?
I had some interesting situation: My Amazon account has 2FA enabled where my smartphone with google authenticator is my second factor.
Due to issues with this phone my second factor basically broke (...
0
votes
2answers
758 views
Conducting Ethical Phishing Attack [closed]
For research purposes, I'm conducting an ethical phishing attack in my institution. I have permission from the institution for the same. I've created the phishing site and the email content, and I'll ...
0
votes
1answer
58 views
Seeing SSL requests in unencrypted form from a remote client [closed]
I was wondering how I could be able to see SSL requests in an unencrypted form from remote clients (specifically, my phone).
I heard that you are supposed to use CA certificates, but how would I ...
0
votes
1answer
101 views
How to get the statistics of users opening the attachment in a phishing mail during a social engineering campaign test?
I have to do a social engineering test for a friend's small company. He wants to know how many people opened the mail and then opened the attachment. How can I do that? The file can be anything- pdf,...
2
votes
1answer
148 views
What potential threats lie ahead after the hack of equifax in 2017?
Having that literally every single US resident's information is now exposed to hackers and malicious social engineers. What are some threats that we will inevitable encounter in the coming months or ...
0
votes
3answers
5k views
How to determine IP address of target device or network
I know most exploits over the internet are opportunistic, but assume an aggressor has a specific target, but no physical access to that target. How do you find the target network or device to begin an ...
0
votes
4answers
137 views
What is a good method to authenticate users and make sure they don't give their credentials to someone else?
I'm new here I hope this is the right place to ask this question, I work at a call center and I've been asked to create a TimeClock system however we have the problem that agents share their ...
2
votes
0answers
71 views
Are there any good OSINT feeds related to phone phishing? [closed]
There are lots of feeds related to fraudulent and malicious domains and IPs, but we're seeing more and more social engineering attempts coming in via phone.
When these are reported to us, I'd like to ...
