Questions tagged [social-engineering]

Social engineering is the act of manipulating people into performing actions or divulging confidential information.

Filter by
Sorted by
Tagged with
3 votes
1 answer
156 views

Would there be any security downside to text-message "verification codes" saying what they're for?

When I log into some web services, I need to send back a verification code contained in a text message that starts out with something to the effect of "You or someone claiming to be you is trying ...
66 votes
6 answers
11k views

Advised to block all traffic to/from specific IP addresses

My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the ...
0 votes
2 answers
179 views

What's the risk of interacting with a social engineer?

I received a WhatsApp message. I never registed with any recruitment job portal, or even speak Arabic at all What are the dangers in myself trying to find out what happened (did they send the same ...
0 votes
2 answers
422 views

How was the hacker able to get my Instagram tag through Facebook when they weren’t linked?

All of this happened on 18th November 2020 A person I know sent me a phishing link of Facebook then Google, I entered my credentials however as soon as I found out that its a phishing link, I turned ...
0 votes
2 answers
1k views

Conducting Ethical Phishing Attack [closed]

For research purposes, I'm conducting an ethical phishing attack in my institution. I have permission from the institution for the same. I've created the phishing site and the email content, and I'll ...
4 votes
1 answer
194 views

Is there any benefit to normalize unicode/utf-8 names that I am overlooking?

Reading how Spotify was normalizing unicode inconsistently, and now I'm questioning if I am overlooking any issue on accepting non-normalized usernames. From what I can tell, lowercase was first used ...
3 votes
0 answers
162 views

A paper about putting formally proven secure "fake" vulnerabilities into your software to waste malicious actors' time

I remember seeing a tweet about an infosec research paper a while ago on how one can put a lot of "fake vulnerabilities", which resemble real vulnerabilities but are actually formally proven ...
5 votes
6 answers
8k views

Using unique email address for online signups?

After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security. We can only do so much too protect ourselves because at the ...
4 votes
2 answers
3k views

Spear phishing data set

Are there any existing data sets of spear phishing emails available? I've found a bunch of data sets of phishing emails, but that's not what I'm looking for. I'm not looking for mass phishing ...
6 votes
1 answer
9k views

Databases with spam, phishing email examples [duplicate]

I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc). I order to do this I need to have a ...
2 votes
1 answer
511 views

Multiple login attempts made using mobile OTP in multiple customer sites at the same time

We have multiple customer sites which provides login via mobile number OTP option (new & registered users). Recently, we come across an incident where a user received 100+ OTPs with in few minutes ...
3 votes
1 answer
743 views

Is FIDO2 authentication vulnerable to a social engineering replay attack?

I'm starting to learn about the FIDO2 standard, and I'm wondering if this scenario is possible... Victim visits a credential harvesting page and enters their credentials Credential harvesting backend ...
1 vote
0 answers
94 views

Should I publish a blog post about scam ideas? [closed]

I have written and was planning on publishing a blog post about scams. The blog post talks about methods used by hackers in their Reconnaissance phase (specifically, researching individual people) and ...
0 votes
1 answer
302 views

Doesn't 2FA increase the vulnerability of an account?

You create an account on an online service X with login=your email + password. Compare these 2 situations: No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
1 vote
0 answers
96 views

Is there a standard for fencing email domains to specific use cases?

To my knowledge, there's no common standard for sysadmins to publish trusted domains for specific use cases. If it exists, I would presume that this might limit phishing attacks. Think of my question ...
2 votes
1 answer
224 views

New trend? Recognizable and specific subject in Spam / malware mails

It seems that a new trend has emerged in the past few weeks. While users are (meanwhile) aware that an unexpected mail with subject "Your invoice" or "Your delivery" is suspicious, ...
1 vote
1 answer
177 views

Suspicious hyperlinks (all hex URLs) in e-mail

I'm communicating with a job headhunter over LinkedIn and he sent me an e-mail containing information about a position. However, I noticed that all of the hyperlinks in the e-mail (even the one on ...
5 votes
0 answers
1k views

Disturbing/suspicious Google notifications about account recovery and password change

This is similar to Is this Google mail from gaia.bounces.google.com legit?, except a) I have nothing in my life related to the language used (Indonesian), b) these are different notifications (and ...
1 vote
1 answer
210 views

Can you impersonate someone on a cell phone network if you can get them to enter a magic code?

I just got weird warning on a social network about a scam that is supposedly making the rounds. However the claims were quite outlandish and I'm skeptical if it's even technically possible. If the ...
2 votes
4 answers
558 views

Why don't bigger companies buy similar domains to their main domain to prevent typosquatting?

One big threat out there is typosquat domains. For example instead of: steamcommunity.com some malicious actor will register the domain stearncornmunity.com and set up his fake steam login. Why do ...
0 votes
1 answer
277 views

Purpose of fraudulent AWS SL/TLS certificate request for my domain

I just received an email from AWS re Certificate request for [my personal domain]. This email asked me to approve this request with a link or forward to a AWS email for validation. Needless to say ...
0 votes
0 answers
189 views

How can I protect myself from this simple, yet lethal (SE) WhatsApp hack?

I've been using WhatsApp as well as my current phone number for at least eight years now. As of now, everything went pretty smooth. That's why the message four days ago, 13rd of August 2021, struck me:...
4 votes
4 answers
10k views

Will this work? Revealing identity (facebook) of person who clicks specially crafted link

There is a special Facebook link that will redirect anyone who clicks it to their own Facebook profile they are currently logged in on on their browser. The link goes like this: http://www.facebook....
0 votes
1 answer
149 views

Realistic for organizations to avoid links in emails pointing to less known sites?

Over the years, I found myself constantly pointing out to organizations that emails containing links with 3rd party domain names that are relatively unknown are problematic. That's how social ...
20 votes
10 answers
2k views

How to persuade average people that security matters?

If people could be fooled in life so easily ( http://www.bbc.co.uk/realhustle/ ) then in computing.... What are the best tips to persuade a regular user to pay a little more attention to security: e....
1 vote
0 answers
292 views

Is someone trying to hack me through facebook?

For the past few days i have been receiving friend requests in facebook from some hot girls that have some pictures of them in sexy poses and in the timeline it says they want to meet and have sex and ...
76 votes
13 answers
19k views

Why is a link in an email more dangerous than a link from a web search?

Everyone knows of the common cybersecurity tips to be careful when you open links in an email. But every day we look for something on the Internet, clicking links which the search engine shows us, and ...
1 vote
0 answers
102 views

Can OTP (One-Time password) be used to protect data after intrusion has been detected? [closed]

I am working on Social Engineering attacks happening via SMSs. Let's assume a person receives an SMS asking him to click on a malicious link. If a virus is installed on the person's device, how can ...
36 votes
4 answers
8k views

Why is social engineering often excluded from bug bounties?

I noticed a lot of companies do not have social engineering as in-scope of bug bounties/responsible disclosure guidelines, even though it is often used in real-world attacks. I understand that for ...
15 votes
1 answer
1k views

New social engineering tactic that uses printer serial numbers?

We have been getting a new kind of scammer-esque call every couple weeks here at the office (I work at an enterprise web application development company). Basically, the flow of events is this: ...
-1 votes
1 answer
123 views

Social Engineering or Broken Authentication

If I go to a cybercafe and use one of the shared computers, and use a social media application, which deletes session IDs when the browser is closed. A clever person comes, who knows about the ...
2 votes
2 answers
4k views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
7 votes
3 answers
322 views

I have lost control of my online identity due to mistakes made decades ago. What can I do?

About 2 decades ago (late 90s/early 00s), when I was still in high school, I opened up social media accounts online. Over the course of a few years and using these social media platforms, I posted ...
26 votes
6 answers
7k views

Is it a good idea to use non-ASCII names in the U.S.? [closed]

Grimes and Elon Musk named their baby: X Æ A-12. What are the risks of non-ASCII names? For example, does the COBOL unemployment platform support non-ASCII names? Would it be possible to get a ...
2 votes
1 answer
169 views

How misappropriation-resistant are common deployed signature formats?

Given an RSA signature as produced by openssl dgst -sha256 -sign rsapriv.pem -out afile.sig afile and without access to the private key used for that, one can¹ come up with a fully functional RSA ...
19 votes
3 answers
18k views

The audacity of accountchek.com

Maybe I'm being overly sensitive as an IT professional who has a security mindset, but I am doing a mortgage refinance right now. My lender, who is legitimate (I used them a few years ago for the ...
34 votes
7 answers
4k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
0 votes
2 answers
328 views

Phishing emails - What do I look for?

I want to be able to spot a phishing email. What are the things to check when investigating and doing forensics on one? There are some things I know to look for already but I want to get moer ...
-1 votes
1 answer
783 views

Are IPv4 more intuitively hard to track than IPv6?

I understand that it is easier for a human to intuitively figure out the alleged whereabouts of a machine if that machin's IP address is IPv6, rather than if its IPv4: For example, since I configured ...
12 votes
1 answer
782 views

Canadian police mentioned a new line-trapping technique, but what is that?

The police in Canada are saying that there is a new technique ("line-trapping") where the scammers told a lady to call the police to confirm some fraudulent details, but when she hung up and called ...
1 vote
0 answers
157 views

Is Social Engineering out of scope unless explicitly requested? [closed]

I've seen some sample "What would you like to be pentested?" page (I can't find or remember the exact source) where Cyber, Physical and Social were asked separately (among other areas like Wifi, ...
6 votes
1 answer
2k views

Understanding a Whatsapp account hack (social engineering?)

A friend of mine (Bob) received a suspicious Whatsapp message today, seemingly from a former colleague (Alice), who claimed to have "forwarded [to Bob] an SMS with a code in it by mistake", and who ...
1 vote
1 answer
992 views

What is it called when someone glides through a building's external door behind you? [duplicate]

One form of social engineering is the practice of running up to a building's external door just as an employee is entering. The employee often holds the door open for the intruder, bypassing security ...
0 votes
1 answer
615 views

"Harmless" script which downloads malicious script

What if I code a program without malicious code which would pass in every antivirus scan and after the virus scan and user giving special rights to it, it downloads and executes the real virus? Since ...
19 votes
1 answer
4k views

How to protect yourself against OSINT?

I recently watched a video about OSINT and learnt it can be quite a powerful agent. I've been on the internet for years, and at this point I'm not sure what I've posted and where. Given this is now ...
2 votes
1 answer
201 views

How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?

How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
34 votes
10 answers
23k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
8 votes
3 answers
884 views

What (besides not complying, and reporting) should I do with blackmail emails? [duplicate]

I received the following email which claims, among other social engineering, to have installed a keylogger on a former system administrator's Linux box: I‌ kno‌w [old password deleted] o‌n‌e o‌f yo‌...
28 votes
2 answers
47k views

List of visually similar characters, for detecting spoofing and social engineering attacks

I'm trying to detect homograph attacks and other attacks where an attacker uses a spoof domain name that looks visually similar to a trusted domain name (e.g., bankofthevvest.com instead of ...
-2 votes
2 answers
232 views

Is it social engineering when you know you are being social engineered? [closed]

More like a philosophical question.

1
2 3 4 5