Questions tagged [social-engineering]

Social engineering is the act of manipulating people into performing actions or divulging confidential information.

Filter by
Sorted by
Tagged with
113 votes
6 answers
20k views

Roles to play when tailgaiting into a residential building

Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have ...
Vorac's user avatar
  • 1,907
108 votes
7 answers
6k views

Is social-engineering an actual threat

I've recently finished book The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick The book was released on 4th December 2002. Not talking only about techniques described ...
Marek Sebera's user avatar
  • 2,233
107 votes
19 answers
24k views

Defence methods against tailgating

This is a follow-up question to this one: Roles to play when tailgaiting into a residential building How do you protect yourself or your company against tailgaters? What is the best answer when you ...
Lithilion's user avatar
  • 1,669
88 votes
9 answers
21k views

How to distinguish between a scam and a genuine call?

My bank called me the other day and the person who spoke to me failed to give me a single evidence that he is calling from my bank. The bank number is hidden just like many other companies maybe ...
Ulkoma's user avatar
  • 8,773
76 votes
13 answers
19k views

Why is a link in an email more dangerous than a link from a web search?

Everyone knows of the common cybersecurity tips to be careful when you open links in an email. But every day we look for something on the Internet, clicking links which the search engine shows us, and ...
Adam Shakhabov's user avatar
76 votes
11 answers
92k views

If someone asks to borrow your phone to make a call, what could they do?

A stranger walks up to you on the street. They say they lost their phone and need to make a phone call (has happened to me twice, and maybe to you). What's the worst a phone call could do? Let's ...
Andy Ray's user avatar
  • 1,138
66 votes
6 answers
11k views

Advised to block all traffic to/from specific IP addresses

My CFO received an email from a director at a financial institution advising that all traffic (inbound and outbound) from certain IP addresses should be blocked at the firewall. The director at the ...
upsidedowncreature's user avatar
44 votes
2 answers
13k views

Does this mean Target's twitter was successfully attacked?

I was just surprised to see this suspicious promoted tweet, asking me to send Bitcoins I added the hand-drawn red lines so I am not responsible for propagating the apparent scam. Clicking on the ...
Oddthinking's user avatar
  • 1,859
36 votes
4 answers
8k views

Why is social engineering often excluded from bug bounties?

I noticed a lot of companies do not have social engineering as in-scope of bug bounties/responsible disclosure guidelines, even though it is often used in real-world attacks. I understand that for ...
Z3r0byte's user avatar
  • 463
36 votes
7 answers
9k views

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

Is it a bad idea to post a photo of your keyboard to social media? Can I look at a photo of a keyboard and determine the password of an account? Assuming a certain (set of) password(s) is the most ...
formicophobia's user avatar
34 votes
10 answers
23k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
Ulkoma's user avatar
  • 8,773
34 votes
7 answers
4k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
Manishearth's user avatar
  • 8,317
34 votes
6 answers
5k views

After getting doxxed, how can one protect personally identifiable information?

Doxing (publicly releasing private information about an individual, to make it easier to harass them) is becoming an increasingly popular tactic not just for hackivists and Anonymous, but also for ...
J Kimball's user avatar
  • 2,137
31 votes
7 answers
8k views

How do hackers make the victim access an XSS attack URL?

As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers. Say, if a page has a vulnerability of loading arbitrary script when user ...
Hetfield Joe's user avatar
29 votes
7 answers
5k views

When do honest people need privacy or anonymity? (e.g. they have nothing to hide) [closed]

I'm having a discussion with someone who thinks they don't need technical measures of privacy or anonymity. Common arguments against needing to care about privacy or anonymity include: Everything ...
makerofthings7's user avatar
28 votes
2 answers
47k views

List of visually similar characters, for detecting spoofing and social engineering attacks

I'm trying to detect homograph attacks and other attacks where an attacker uses a spoof domain name that looks visually similar to a trusted domain name (e.g., bankofthevvest.com instead of ...
D.W.'s user avatar
  • 99.6k
26 votes
6 answers
7k views

Is it a good idea to use non-ASCII names in the U.S.? [closed]

Grimes and Elon Musk named their baby: X Æ A-12. What are the risks of non-ASCII names? For example, does the COBOL unemployment platform support non-ASCII names? Would it be possible to get a ...
0x90's user avatar
  • 1,422
23 votes
7 answers
11k views

Song Lyrics as passphrases [duplicate]

I have a question slightly similar to this question. I am familiar with the correct horse battery staple example from xkcd, yet I am leaning towards songlyrics as a passphrase, since I have a brain ...
Baron Furzgesicht's user avatar
20 votes
10 answers
2k views

How to persuade average people that security matters?

If people could be fooled in life so easily ( http://www.bbc.co.uk/realhustle/ ) then in computing.... What are the best tips to persuade a regular user to pay a little more attention to security: e....
LanceBaynes's user avatar
  • 6,279
20 votes
6 answers
2k views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
makerofthings7's user avatar
19 votes
2 answers
842 views

How secure is Stack Exchange's reputation?

I recently read an article about researchers being able to penetrate the Facebook network and making lots of friends with about 100 "Social" bots. What would prevent somebody to do the same on Stack ...
user1202136's user avatar
19 votes
3 answers
9k views

Google hacking - why "numrange" is so dangerous?

I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this operator....
StupidOne's user avatar
  • 2,812
19 votes
1 answer
4k views

How to protect yourself against OSINT?

I recently watched a video about OSINT and learnt it can be quite a powerful agent. I've been on the internet for years, and at this point I'm not sure what I've posted and where. Given this is now ...
iiSupaCannon's user avatar
19 votes
3 answers
18k views

The audacity of accountchek.com

Maybe I'm being overly sensitive as an IT professional who has a security mindset, but I am doing a mortgage refinance right now. My lender, who is legitimate (I used them a few years ago for the ...
theglossy1's user avatar
17 votes
3 answers
16k views

What is reverse social engineering?

What is reverse social engineering? Is it something different from normal social engineering?
Lucas Kauffman's user avatar
16 votes
5 answers
2k views

Does two factor authentication prevent social engineering attacks

After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password. Considering three different additional ...
Peter Smit's user avatar
  • 2,759
16 votes
7 answers
2k views

Has cryptography reached the development level where social engineering is the only reliable method of attack?

Note that for the purpose of this question, "social engineering" means extracting information from humans, be your methods compliant with Geneva Conventions or not. Simply put: Do cryptographic ...
Drew's user avatar
  • 401
15 votes
5 answers
10k views

How do online accounts get hacked?

How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social ...
Doug T.'s user avatar
  • 291
15 votes
1 answer
1k views

New social engineering tactic that uses printer serial numbers?

We have been getting a new kind of scammer-esque call every couple weeks here at the office (I work at an enterprise web application development company). Basically, the flow of events is this: ...
Omar Himada's user avatar
14 votes
4 answers
3k views

Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 &...
makerofthings7's user avatar
14 votes
2 answers
1k views

Are in-store computers a security risk?

In many "big box" stores like Walmart, Home Depot, etc. I see many store computers just sitting empty. A black hat could install a payload on one of these computers, and potentially wreak havoc on the ...
user avatar
14 votes
3 answers
18k views

Why would someone register a Facebook account with a stolen email address?

I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
Demento's user avatar
  • 7,455
13 votes
5 answers
4k views

How can I help catch an email scammer who is contacting me?

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
SeanKilleen's user avatar
13 votes
2 answers
7k views

Custom Metasploit payload with UAC bypass

The machine I am attacking has anti-virus installed. I have managed to use Veil Framework in order to create an initial reverse shell payload that is undetected by the AV. However, UAC is enabled on ...
SilverlightFox's user avatar
13 votes
2 answers
643 views

How do you address a social engineering and or software weakness/concern in a company or organisation?

Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change ...
KilledKenny's user avatar
  • 1,672
12 votes
1 answer
1k views

Social Engineering and Police Officers

The Story: Yesterday at 12pm a neighbor of mine was pulling into his driveway, and saw that his van's back-window was shattered. Well, this neighbor and I have had some trouble with each other in the ...
Jake's user avatar
  • 123
12 votes
2 answers
29k views

Reversing an entry card - How to find out what type of RFID hardware I need to read the chip?

I have an acccess/entry card chip I want to copy for demonstrational purposes. However I am not sure how I can find out what type of RFID reader I need to get a hold of. Does anyone have a ...
Chris Dale's user avatar
  • 16.2k
12 votes
1 answer
782 views

Canadian police mentioned a new line-trapping technique, but what is that?

The police in Canada are saying that there is a new technique ("line-trapping") where the scammers told a lady to call the police to confirm some fraudulent details, but when she hung up and called ...
Filipon's user avatar
  • 1,264
11 votes
3 answers
2k views

Why do the large majority of big organizations have "known bad" password policies?

I saw a recent password question on security.stackexchange "Is the NHS wrong about passwords?" The question is very specific about one organization but from what I've seen the same "known bad" ...
Trevor Boyd Smith's user avatar
10 votes
6 answers
1k views

Does not having https moot this entire site?

On a bank website the other day, I noticed that they were giving out a phone number on a page that wasn't over https. This seemed really wrong to me, since it would allow somebody to change the phone ...
mlissner's user avatar
  • 332
9 votes
4 answers
576 views

Automating Social Engineering Prevention

Being an advocate for DIO (defensive information operations), I have always been concerned about social engineering and its relation to server security. Giving administrative access to staff members ...
Daniel Li's user avatar
  • 451
9 votes
1 answer
357 views

Do large online software companies limit employee access to company information?

I've been wondering about how large online software companies, specifically those based around a single massive product, like Google, Facebook, Yahoo, etc. handle the risk of terminated employees. Any ...
TheEnvironmentalist's user avatar
8 votes
5 answers
905 views

How can we get into the user's mindset?

As security folk, we tend to over- or under-estimate the capabilities and educatedness of our users, especially in terms of resistance to social engineering attacks. Stereotypically, this is due to ...
Polynomial's user avatar
  • 135k
8 votes
3 answers
884 views

What (besides not complying, and reporting) should I do with blackmail emails? [duplicate]

I received the following email which claims, among other social engineering, to have installed a keylogger on a former system administrator's Linux box: I‌ kno‌w [old password deleted] o‌n‌e o‌f yo‌...
Christos Hayward's user avatar
8 votes
1 answer
217 views

Rating social engineering threats in a penetration test report

Does anybody have advice on how to deal with social engineering in the context of writing up a penetration test report? How do you assign a rating to social engineering? Obviously if you can convince ...
just some user's user avatar
8 votes
1 answer
326 views

Are there more hacks done by social engineering, etc, than breaking the software system?

There is a saying that, rather than finding a vulnerability in a strong security system, the hacker is more likely to hack into your system by social engineering, physically breaking into the room the ...
user23013's user avatar
  • 740
7 votes
1 answer
444 views

What are good methods of visual security?

What are good methods of visually securing sensitive information that might appear on your screen from the outside world? An example to illustrate my question would be the following: You're sat in ...
li x's user avatar
  • 462
7 votes
3 answers
2k views

Theory X vs Theory Y in social engineering

Theory X and Theory Y are two models of human motivation, often used when discussing people-management in business. In short, Theory X postulates people are lazy, will avoid work, and require ...
Polynomial's user avatar
  • 135k
7 votes
1 answer
170 views

Mitigating risk from electronic payments

When attempting to sell a product online (for instance, on craigslist) there is a very good chance you will be the target of a social engineer; this is especially true when you are selling high-value ...
Moses's user avatar
  • 2,157
7 votes
3 answers
322 views

I have lost control of my online identity due to mistakes made decades ago. What can I do?

About 2 decades ago (late 90s/early 00s), when I was still in high school, I opened up social media accounts online. Over the course of a few years and using these social media platforms, I posted ...
user235075's user avatar

1
2 3 4 5