Questions tagged [social-engineering]

Social engineering is the act of manipulating people into performing actions or divulging confidential information.

Filter by
Sorted by
Tagged with
34 votes
10 answers
23k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
Ulkoma's user avatar
  • 8,773
4 votes
2 answers
3k views

Spear phishing data set

Are there any existing data sets of spear phishing emails available? I've found a bunch of data sets of phishing emails, but that's not what I'm looking for. I'm not looking for mass phishing ...
D.W.'s user avatar
  • 99.6k
108 votes
7 answers
6k views

Is social-engineering an actual threat

I've recently finished book The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick The book was released on 4th December 2002. Not talking only about techniques described ...
Marek Sebera's user avatar
  • 2,233
6 votes
1 answer
9k views

Databases with spam, phishing email examples [duplicate]

I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc). I order to do this I need to have a ...
sir_k's user avatar
  • 729
88 votes
9 answers
21k views

How to distinguish between a scam and a genuine call?

My bank called me the other day and the person who spoke to me failed to give me a single evidence that he is calling from my bank. The bank number is hidden just like many other companies maybe ...
Ulkoma's user avatar
  • 8,773
29 votes
7 answers
5k views

When do honest people need privacy or anonymity? (e.g. they have nothing to hide) [closed]

I'm having a discussion with someone who thinks they don't need technical measures of privacy or anonymity. Common arguments against needing to care about privacy or anonymity include: Everything ...
makerofthings7's user avatar
20 votes
6 answers
2k views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
makerofthings7's user avatar
113 votes
6 answers
20k views

Roles to play when tailgaiting into a residential building

Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
Vorac's user avatar
  • 1,907
34 votes
7 answers
4k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
Manishearth's user avatar
  • 8,317
13 votes
2 answers
7k views

Custom Metasploit payload with UAC bypass

The machine I am attacking has anti-virus installed. I have managed to use Veil Framework in order to create an initial reverse shell payload that is undetected by the AV. However, UAC is enabled on ...
SilverlightFox's user avatar
11 votes
3 answers
2k views

Why do the large majority of big organizations have "known bad" password policies?

I saw a recent password question on security.stackexchange "Is the NHS wrong about passwords?" The question is very specific about one organization but from what I've seen the same "known bad" ...
Trevor Boyd Smith's user avatar
8 votes
3 answers
884 views

What (besides not complying, and reporting) should I do with blackmail emails? [duplicate]

I received the following email which claims, among other social engineering, to have installed a keylogger on a former system administrator's Linux box: I‌ kno‌w [old password deleted] o‌n‌e o‌f yo‌...
Christos Hayward's user avatar
4 votes
2 answers
3k views

When is an intermediate page needed before directing a user off my primary website? What is the best implementation?

The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example). I've seen this used in Exchange Outlook Web Access (...
makerofthings7's user avatar
0 votes
2 answers
184 views

Is "user education" actually doable?

I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all. Are there any amazing success (or horrible ...
DanL4096's user avatar
  • 307
76 votes
13 answers
19k views

Why is a link in an email more dangerous than a link from a web search?

Everyone knows of the common cybersecurity tips to be careful when you open links in an email. But every day we look for something on the Internet, clicking links which the search engine shows us, and ...
Adam Shakhabov's user avatar
76 votes
11 answers
92k views

If someone asks to borrow your phone to make a call, what could they do?

A stranger walks up to you on the street. They say they lost their phone and need to make a phone call (has happened to me twice, and maybe to you). What's the worst a phone call could do? Let's ...
Andy Ray's user avatar
  • 1,138
66 votes
6 answers
11k views

Advised to block all traffic to/from specific IP addresses

My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the ...
upsidedowncreature's user avatar
34 votes
6 answers
5k views

After getting doxxed, how can one protect personally identifiable information?

Doxing (publicly releasing private information about an individual, to make it easier to harass them) is becoming an increasingly popular tactic not just for hackivists and Anonymous, but also for ...
J Kimball's user avatar
  • 2,137
14 votes
4 answers
3k views

Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 &...
makerofthings7's user avatar
12 votes
2 answers
29k views

Reversing an entry card - How to find out what type of RFID hardware I need to read the chip?

I have an acccess/entry card chip I want to copy for demonstrational purposes. However I am not sure how I can find out what type of RFID reader I need to get a hold of. Does anyone have a ...
Chris Dale's user avatar
  • 16.2k
5 votes
2 answers
971 views

How much can I trust domain registrars to honor Whois identity protection services?

Domain name registrars offer whois ID protection services. I do plan to use such a service. But as I'm a relative newbie to the domain name registration world, I don't know whether I can trust it. ...
user541686's user avatar
  • 2,562
5 votes
1 answer
2k views

How to detect social engineering attack?

How can I understand if I am being targeted by a grey hat social engineer? And if I fail, what approaches exist to detect social engineering attacks being in progress within an organisation?
oleksii's user avatar
  • 1,068
4 votes
2 answers
1k views

How to mitigate evil twin WIFI social engineering attack?

I just come across this article: Capturing WPA Passwords by Targeting Users with a Fluxion Attack. Although WIFI Evil Twin attack and WIFI de-authentication attacks is known for a long time, a ...
mootmoot's user avatar
  • 2,397
3 votes
2 answers
331 views

Security Training for corporate Facebook users

One of my clients is looking at allowing their employees to access Twitter and Facebook from work. I have highlighted the need for training, and I have material to present, but what do you think ...
schroeder's user avatar
  • 129k
2 votes
2 answers
375 views

Is single-click phishing possible?

For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL? Notice: The user only does a click on the URL, no ...
an0's user avatar
  • 141
2 votes
1 answer
4k views

Can Self extracting rar file (SFX) be used to automatically install malicious software?

Self extracting RAR files can be made containing dangerous files but can these SFX files be used as a tool for social engineering attacks (email attachments or on promotional CD-ROM etc.) to trick a ...
PMD's user avatar
  • 199
1 vote
3 answers
979 views

What is social engineering, how does it relate to security and how can it affect my business? [duplicate]

Possible Duplicate: Is social-engineering an actual threat What is social engineering? Can you give me some examples? Can social engineering have a big impact on business?
Lucas Kauffman's user avatar
0 votes
2 answers
328 views

Phishing emails - What do I look for?

I want to be able to spot a phishing email. What are the things to check when investigating and doing forensics on one? There are some things I know to look for already but I want to get moer ...
Warren White's user avatar
-1 votes
1 answer
782 views

Are IPv4 more intuitively hard to track than IPv6?

I understand that it is easier for a human to intuitively figure out the alleged whereabouts of a machine if that machin's IP address is IPv6, rather than if its IPv4: For example, since I configured ...
user avatar