Questions tagged [social-engineering]
Social engineering is the act of manipulating people into performing actions or divulging confidential information.
169
questions
-2
votes
2answers
144 views
Is it social engineering when you know you are being social engineered? [closed]
More like a philosophical question.
0
votes
0answers
360 views
Meterpreter is failing to load any extension except the core commands
[*] Starting persistent handler(s)...
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_https
PAYLOAD => windows/meterpreter/reverse_https
...
2
votes
1answer
84 views
How safe is to have a LinkedIn account where you have published all the important information about yourself?
How safe is it to make your information public? I know that there are many risks from social engineers' side, if you put everything about yourself a hacker will have most of the information about you ...
0
votes
1answer
138 views
is it possible to evil twin a WPA 2 Wifi using one of EAP methods?
the same as fluxion but without the captive portal just like this video
Stealing 802.1x Credentials with Rogue AP & RADIUS server
he was able to get the username and the password of an EAP wifi ...
0
votes
1answer
65 views
Data leakage in internet-only services
Nowadays, internet-only services became very popular, for example, direct bank and many others. The advantage of such services is you don't have to spend the time to get to the office in order to get ...
0
votes
1answer
89 views
Tech support agent asked me some questions unrelated to tech support or my problem
About 4 years ago I was having a problem with my Microsoft Windows system so I went to Google and searched "Microsoft tech support phone number" to see the results and got the number from some random ...
4
votes
1answer
495 views
Understanding a Whatsapp account hack (social engineering?)
A friend of mine (Bob) received a suspicious Whatsapp message today, seemingly from a former colleague (Alice), who claimed to have "forwarded [to Bob] an SMS with a code in it by mistake", and who ...
0
votes
0answers
38 views
What to do after a social engineering attack was used to trick utility services at my hypothetical business? How to close the security hole?
Business Attack Scenario
Standard information that was ubiquitous through my chain-businesses
was exploited by a rogue group of former employees to sabotage. They
considered manipulating all ...
0
votes
2answers
129 views
Could someone commit a social engineering “hack” on a credit card processor to get my credit card number?
Peripherally related to: Is it safe to recycle unshredded credit card receipts?.
From some basic research, it seems as though the SEQ number is internal to the company running the POS software, the ...
2
votes
1answer
108 views
Social engineering testing methodology?
Is there anything that could be used as a social engineering testing methodology from any sort of organisation (example: ISO, SANS, PCI DSS etc.)
102
votes
19answers
22k views
Defence methods against tailgating
This is a follow-up question to this one: Roles to play when tailgaiting into a residential building
How do you protect yourself or your company against tailgaters? What is the best answer when you ...
111
votes
6answers
19k views
Roles to play when tailgaiting into a residential building
Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
44
votes
2answers
13k views
Does this mean Target's twitter was successfully attacked?
I was just surprised to see this suspicious promoted tweet, asking me to send Bitcoins
I added the hand-drawn red lines so I am not responsible for propagating the apparent scam.
Clicking on the ...
7
votes
3answers
744 views
What (besides not complying, and reporting) should I do with blackmail emails? [duplicate]
I received the following email which claims, among other social engineering, to have installed a keylogger on a former system administrator's Linux box:
I know [old password deleted] one of yo...
2
votes
2answers
203 views
How do I protect myself against SIM hijacking/social engineering?
There are several posts like these:
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
2
votes
2answers
227 views
Is single-click phishing possible?
For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL?
Notice: The user only does a click on the URL, no ...
32
votes
7answers
6k views
How do hackers make the victim access an XSS attack URL?
As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers.
Say, if a page has a vulnerability of loading arbitrary script when user ...
5
votes
2answers
235 views
What is the name for building trust on a platform before pillaging?
What's the common or recognized name for a vulnerability on a platform where someone can build trust and than pillage/exploit that trust for profit or information? It's driving me crazy, and I ...
68
votes
5answers
10k views
Advised to block all traffic to/from specific IP addresses
My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the ...
0
votes
1answer
85 views
Spam identification
We have a spamfilter running that does a very good job at tackling common spammer issues.
From what it catches, I'm assuming it blocks mails based on a few things:
SPF checks
Certain attachment ...
6
votes
1answer
155 views
How can companies verify that a national security letter is real? [closed]
It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it.
There ...
1
vote
1answer
121 views
Should I reply to an email saying that I requested online access to a website?
I received an email saying I requested access to a website. The email also includes a one-time passcode. I did not do anything that would require a one-time passcode. At the bottom of the email is a ...
1
vote
2answers
151 views
How is there a preview for a fake docx file in gmail
I recently got a nasty email containing two files. I didn't open them but did check and realised they were not docx files which was the intent but on gmail in the document preview it shows what looks ...
0
votes
1answer
134 views
Server encryption to prevent access by hoster
A friend told me one of their company servers got recently hacked. The server was super secured software side.
It turned out the attacker called the hoster and used some social engineering skills to ...
7
votes
1answer
321 views
What are good methods of visual security?
What are good methods of visually securing sensitive information that might appear on your screen from the outside world?
An example to illustrate my question would be the following:
You're sat in ...
4
votes
1answer
300 views
Reality Check: Create chaos at an office
An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
3
votes
2answers
100 views
Someone is using similar domain and spamming clients
This is the problem my friend is facing in his office.
Someone is using an almost similar domain as my friend's company (via email). This person is posing as their company and asking them to send ...
4
votes
1answer
40k views
What can be done with the last 4 digits of one's SSN [closed]
If a hacker were to get the last 4 digits of your SSN (and maybe some other info like name, etc), what could they do?
To avoid the possibility that they could guess the other digits from date/...
0
votes
1answer
258 views
Fake secured WiFi network to harvest password [duplicate]
I'm not finding a lot of information on this topic although it seems so simple, so I assume it isn't possible, but I was wondering if it is possible or not to create a fake acces point that looks like ...
4
votes
2answers
129 views
Amazon 2FA: Compromising the email leads to compromising 2FA, e.g removing the other factor?
I had some interesting situation: My Amazon account has 2FA enabled where my smartphone with google authenticator is my second factor.
Due to issues with this phone my second factor basically broke (...
0
votes
2answers
546 views
Conducting Ethical Phishing Attack [closed]
For research purposes, I'm conducting an ethical phishing attack in my institution. I have permission from the institution for the same. I've created the phishing site and the email content, and I'll ...
0
votes
1answer
55 views
Seeing SSL requests in unencrypted form from a remote client [closed]
I was wondering how I could be able to see SSL requests in an unencrypted form from remote clients (specifically, my phone).
I heard that you are supposed to use CA certificates, but how would I ...
0
votes
1answer
88 views
How to get the statistics of users opening the attachment in a phishing mail during a social engineering campaign test?
I have to do a social engineering test for a friend's small company. He wants to know how many people opened the mail and then opened the attachment. How can I do that? The file can be anything- pdf,...
2
votes
1answer
145 views
What potential threats lie ahead after the hack of equifax in 2017?
Having that literally every single US resident's information is now exposed to hackers and malicious social engineers. What are some threats that we will inevitable encounter in the coming months or ...
0
votes
3answers
3k views
How to determine IP address of target device or network
I know most exploits over the internet are opportunistic, but assume an aggressor has a specific target, but no physical access to that target. How do you find the target network or device to begin an ...
0
votes
4answers
133 views
What is a good method to authenticate users and make sure they don't give their credentials to someone else?
I'm new here I hope this is the right place to ask this question, I work at a call center and I've been asked to create a TimeClock system however we have the problem that agents share their ...
2
votes
0answers
69 views
Are there any good OSINT feeds related to phone phishing? [closed]
There are lots of feeds related to fraudulent and malicious domains and IPs, but we're seeing more and more social engineering attempts coming in via phone.
When these are reported to us, I'd like to ...
1
vote
3answers
184 views
What precautions/training do companies have against social engineering strategies?
For example, if someone were to call a cell phone provider like T-Mobile, pretending to be another person to get some information, how can T-Mobile verify if it is the actual person? I'm assuming that ...
3
votes
4answers
4k views
Is it dangerous for a scammer to know just your name and birthday? [closed]
Basically, this afternoon, I got a call that I had picked up. The caller asked for (my name) stating that they were from this company associated with my healthcare. The call seemed pretty legit, and ...
1
vote
1answer
101 views
Account hacked on mobile music streaming app - what should I do next
I'm a software developer so aware of basic security issues. I use a popular music streaming service and a few months back signed up for their paid plan as I was enjoying the experience. I use the ...
24
votes
7answers
7k views
Song Lyrics as passphrases [duplicate]
I have a question slightly similar to this question. I am familiar with the
correct horse battery staple example from xkcd, yet I am leaning towards songlyrics as a passphrase, since I have a brain ...
8
votes
2answers
3k views
The audacity of accountchek.com
Maybe I'm being overly sensitive as an IT professional who has a security mindset, but I am doing a mortgage refinance right now. My lender, who is legitimate (I used them a few years ago for the ...
4
votes
2answers
730 views
How to mitigate evil twin WIFI social engineering attack?
I just come across this article: Capturing WPA Passwords by Targeting Users with a Fluxion Attack.
Although WIFI Evil Twin attack and WIFI de-authentication attacks is known for a long time, a ...
1
vote
0answers
190 views
Is someone trying to hack me through facebook?
For the past few days i have been receiving friend requests in facebook from some hot girls that have some pictures of them in sexy poses and in the timeline it says they want to meet and have sex and ...
2
votes
1answer
91 views
Responsibility of disclosing potential social engineering attack
I've just gotten a text message from a number pretending to be my bank and telling me to install a certificate from a suspicious link (link looks like this: bankname-certificate.ru/installation not ...
2
votes
3answers
262 views
How can I track whether a pdf was opened or not?
I'm working on some options for a social engineering assessment for a client. One of the things I'd like to do is email a bunch of people a pdf attachment (or put the pdf on removable media) and then ...
2
votes
0answers
213 views
Trouble finding LHOST and which IP address to use?
I'm currently using the social engineering toolkit (SET) and I'm generating a malicious PDF file. One of the first things SET asks me after choosing a File-format exploit is the IP address for the ...
3
votes
3answers
120 views
Could a phishing page generate a genuine session with the targeted service?
At the end of this tutorial the author gives a few ideas for improving a basic phishing attack.
One of them intrigued me, in particular: Is it possible to use the credentials that a victim enters in ...
1
vote
1answer
43 views
How handle Informational waste
I do big tiding of my flat and I found out, that lot of my waste consists from boxes with my addresses and receipts from online store deliveries. What is the most easiest and also most efficient way ...
2
votes
0answers
327 views
Looking for a specific story of a pen-tester who used a fake raffle to get a keylogger into a company
While reading about USB hardware keyloggers on the web a few months ago, I stumbled upon a story by a rather patient pen-tester:
He organized a raffle where the first prize was a cool gamer ...
