Questions tagged [social-engineering]
Social engineering is the act of manipulating people into performing actions or divulging confidential information.
199
questions
1
vote
0
answers
45
views
Should I publish a blog post about scam ideas? [closed]
I have written and was planning on publishing a blog post about scams. The blog post talks about methods used by hackers in their Reconnaissance phase (specifically, researching individual people) and ...
- 111
0
votes
1
answer
111
views
Doesn't 2FA increase the vulnerability of an account?
You create an account on an online service X with login=your email + password. Compare these 2 situations:
No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
- 3
1
vote
0
answers
59
views
Is there a standard for fencing email domains to specific use cases?
To my knowledge, there's no common standard for sysadmins to publish trusted domains for specific use cases.
If it exists, I would presume that this might limit phishing attacks. Think of my question ...
- 195
1
vote
1
answer
127
views
Suspicious hyperlinks (all hex URLs) in e-mail
I'm communicating with a job headhunter over LinkedIn and he sent me an e-mail containing information about a position. However, I noticed that all of the hyperlinks in the e-mail (even the one on ...
- 115
2
votes
1
answer
71
views
Would there be any security downside to text-message "verification codes" saying what they're for?
When I log into some web services, I need to send back a verification code contained in a text message that starts out with something to the effect of "You or someone claiming to be you is trying ...
- 2,029
4
votes
0
answers
185
views
Disturbing/suspicious Google notifications about account recovery and password change
This is similar to Is this Google mail from gaia.bounces.google.com legit?, except a) I have nothing in my life related to the language used (Indonesian), b) these are different notifications (and ...
- 141
1
vote
1
answer
103
views
Can you impersonate someone on a cell phone network if you can get them to enter a magic code?
I just got weird warning on a social network about a scam that is supposedly making the rounds. However the claims were quite outlandish and I'm skeptical if it's even technically possible.
If the ...
- 996
1
vote
4
answers
281
views
Why don't bigger companies buy similar domains to their main domain to prevent typosquatting?
One big threat out there is typosquat domains. For example instead of:
steamcommunity.com some malicious actor will register the domain stearncornmunity.com and set up his fake steam login.
Why do ...
- 31
0
votes
0
answers
62
views
Sending emails as other persons from internal network in Outlook Online
So today in work I tried making an SMTP email to our local mailserver. Using colleagues email name I sent an email to another colleague. The email didn't fall in spam and it actually showed the ...
0
votes
1
answer
107
views
Purpose of fraudulent AWS SL/TLS certificate request for my domain
I just received an email from AWS re Certificate request for [my personal domain].
This email asked me to approve this request with a link or forward to a AWS email for validation.
Needless to say ...
- 101
0
votes
0
answers
147
views
How can I protect myself from this simple, yet lethal (SE) WhatsApp hack?
I've been using WhatsApp as well as my current phone number for at least eight years now. As of now, everything went pretty smooth. That's why the message four days ago, 13rd of August 2021, struck me:...
- 101
2
votes
1
answer
166
views
Multiple login attempts made using mobile OTP in multiple customer sites at the same time
We have multiple customer sites which provides login via mobile number OTP option (new & registered users). Recently, we come across an incident where a user received 100+ OTPs with in few minutes ...
0
votes
1
answer
120
views
Realistic for organizations to avoid links in emails pointing to less known sites?
Over the years, I found myself constantly pointing out to organizations that emails containing links with 3rd party domain names that are relatively unknown are problematic. That's how social ...
- 105
0
votes
1
answer
238
views
How was the hacker able to get my Instagram tag through Facebook when they weren’t linked?
All of this happened on 18th November 2020
A person I know sent me a phishing link of Facebook then Google, I entered my credentials however as soon as I found out that its a phishing link, I turned ...
- 1
2
votes
1
answer
200
views
New trend? Recognizable and specific subject in Spam / malware mails
It seems that a new trend has emerged in the past few weeks. While users are (meanwhile) aware that an unexpected mail with subject "Your invoice" or "Your delivery" is suspicious, ...
- 1,098
77
votes
13
answers
17k
views
Why is a link in an email more dangerous than a link from a web search?
Everyone knows of the common cybersecurity tips to be careful when you open links in an email. But every day we look for something on the Internet, clicking links which the search engine shows us, and ...
- 843
1
vote
0
answers
80
views
Can OTP (One-Time password) be used to protect data after intrusion has been detected? [closed]
I am working on Social Engineering attacks happening via SMSs. Let's assume a person receives an SMS asking him to click on a malicious link. If a virus is installed on the person's device, how can ...
- 11
37
votes
4
answers
8k
views
Why is social engineering often excluded from bug bounties?
I noticed a lot of companies do not have social engineering as in-scope of bug bounties/responsible disclosure guidelines, even though it is often used in real-world attacks. I understand that for ...
- 473
-1
votes
1
answer
97
views
Social Engineering or Broken Authentication
If I go to a cybercafe and use one of the shared computers, and use a social media application, which deletes session IDs when the browser is closed.
A clever person comes, who knows about the ...
- 133
2
votes
2
answers
3k
views
How do I know/find out about Minecraft Server Vulnerabilities?
I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
- 51
7
votes
3
answers
290
views
I have lost control of my online identity due to mistakes made decades ago. What can I do?
About 2 decades ago (late 90s/early 00s), when I was still in high school, I opened up social media accounts online. Over the course of a few years and using these social media platforms, I posted ...
- 71
26
votes
6
answers
6k
views
Is it a good idea to use non-ASCII names in the U.S.? [closed]
Grimes and Elon Musk named their baby: X Æ A-12.
What are the risks of non-ASCII names?
For example, does the COBOL unemployment platform support non-ASCII names? Would it be possible to get a ...
- 1,402
2
votes
1
answer
137
views
How misappropriation-resistant are common deployed signature formats?
Given an RSA signature as produced by
openssl dgst -sha256 -sign rsapriv.pem -out afile.sig afile
and without access to the private key used for that, one can¹ come up with a fully functional RSA ...
- 1,020
0
votes
2
answers
187
views
Phishing emails - What do I look for?
I want to be able to spot a phishing email. What are the things to check when investigating and doing forensics on one?
There are some things I know to look for already but I want to get moer ...
-1
votes
1
answer
286
views
Are IPv4 more intuitively hard to track than IPv6?
I understand that it is easier for a human to intuitively figure out the alleged whereabouts of a machine if that machin's IP address is IPv6, rather than if its IPv4:
For example, since I configured ...
user123574
1
vote
0
answers
133
views
Is Social Engineering out of scope unless explicitly requested? [closed]
I've seen some sample "What would you like to be pentested?" page (I can't find or remember the exact source) where Cyber, Physical and Social were asked separately (among other areas like Wifi, ...
- 3,502
12
votes
1
answer
673
views
Canadian police mentioned a new line-trapping technique, but what is that?
The police in Canada are saying that there is a new technique ("line-trapping") where the scammers told a lady to call the police to confirm some fraudulent details, but when she hung up and called ...
- 1,182
1
vote
1
answer
233
views
What is it called when someone glides through a building's external door behind you? [duplicate]
One form of social engineering is the practice of running up to a building's external door just as an employee is entering. The employee often holds the door open for the intruder, bypassing security ...
- 113
0
votes
1
answer
459
views
"Harmless" script which downloads malicious script
What if I code a program without malicious code which would pass in every antivirus scan and after the virus scan and user giving special rights to it, it downloads and executes the real virus? Since ...
- 141
19
votes
1
answer
3k
views
How to protect yourself against OSINT?
I recently watched a video about OSINT and learnt it can be quite a powerful agent. I've been on the internet for years, and at this point I'm not sure what I've posted and where.
Given this is now ...
- 193
2
votes
1
answer
168
views
How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?
How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
- 432
-2
votes
2
answers
206
views
Is it social engineering when you know you are being social engineered? [closed]
More like a philosophical question.
- 17
0
votes
0
answers
4k
views
Meterpreter is failing to load any extension except the core commands
[*] Starting persistent handler(s)...
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_https
PAYLOAD => windows/meterpreter/reverse_https
...
2
votes
1
answer
202
views
How safe is to have a LinkedIn account where you have published all the important information about yourself?
How safe is it to make your information public? I know that there are many risks from social engineers' side, if you put everything about yourself a hacker will have most of the information about you ...
- 117
0
votes
1
answer
510
views
is it possible to evil twin a WPA 2 Wifi using one of EAP methods?
the same as fluxion but without the captive portal just like this video
Stealing 802.1x Credentials with Rogue AP & RADIUS server
he was able to get the username and the password of an EAP wifi ...
- 117
0
votes
1
answer
130
views
Data leakage in internet-only services
Nowadays, internet-only services became very popular, for example, direct bank and many others. The advantage of such services is you don't have to spend the time to get to the office in order to get ...
- 3
0
votes
1
answer
167
views
Tech support agent asked me some questions unrelated to tech support or my problem
About 4 years ago I was having a problem with my Microsoft Windows system so I went to Google and searched "Microsoft tech support phone number" to see the results and got the number from some random ...
- 2,099
6
votes
1
answer
1k
views
Understanding a Whatsapp account hack (social engineering?)
A friend of mine (Bob) received a suspicious Whatsapp message today, seemingly from a former colleague (Alice), who claimed to have "forwarded [to Bob] an SMS with a code in it by mistake", and who ...
- 163
0
votes
0
answers
83
views
What to do after a social engineering attack was used to trick utility services at my hypothetical business? How to close the security hole?
Business Attack Scenario
Standard information that was ubiquitous through my chain-businesses
was exploited by a rogue group of former employees to sabotage. They
considered manipulating all ...
- 149
0
votes
2
answers
254
views
Could someone commit a social engineering "hack" on a credit card processor to get my credit card number?
Peripherally related to: Is it safe to recycle unshredded credit card receipts?.
From some basic research, it seems as though the SEQ number is internal to the company running the POS software, the ...
- 343
2
votes
1
answer
186
views
Social engineering testing methodology?
Is there anything that could be used as a social engineering testing methodology from any sort of organisation (example: ISO, SANS, PCI DSS etc.)
- 1,812
107
votes
19
answers
23k
views
Defence methods against tailgating
This is a follow-up question to this one: Roles to play when tailgaiting into a residential building
How do you protect yourself or your company against tailgaters? What is the best answer when you ...
- 1,669
114
votes
6
answers
20k
views
Roles to play when tailgaiting into a residential building
Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
- 1,817
45
votes
2
answers
13k
views
Does this mean Target's twitter was successfully attacked?
I was just surprised to see this suspicious promoted tweet, asking me to send Bitcoins
I added the hand-drawn red lines so I am not responsible for propagating the apparent scam.
Clicking on the ...
- 1,767
8
votes
3
answers
856
views
What (besides not complying, and reporting) should I do with blackmail emails? [duplicate]
I received the following email which claims, among other social engineering, to have installed a keylogger on a former system administrator's Linux box:
I know [old password deleted] one of yo...
- 1,210
2
votes
2
answers
327
views
How do I protect myself against SIM hijacking/social engineering?
There are several posts like these:
https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd
https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
- 23
2
votes
2
answers
289
views
Is single-click phishing possible?
For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL?
Notice: The user only does a click on the URL, no ...
- 141
32
votes
7
answers
7k
views
How do hackers make the victim access an XSS attack URL?
As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers.
Say, if a page has a vulnerability of loading arbitrary script when user ...
- 421
5
votes
2
answers
280
views
What is the name for building trust on a platform before pillaging?
What's the common or recognized name for a vulnerability on a platform where someone can build trust and than pillage/exploit that trust for profit or information? It's driving me crazy, and I ...
- 101
67
votes
5
answers
11k
views
Advised to block all traffic to/from specific IP addresses
My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the ...
