258

Yes encrypt, it is easy. Plus according to a 2014 Software Engineering Institute study 1 in 4 hacks was from someone inside the company with an average damage 50% higher than an external threat actor. Link to source: https://insights.sei.cmu.edu/insider-threat/2017/01/2016-us-state-of-cybercrime-highlights.html Although this is the 2017 version.


166

I interpret your question as: What's the motivation for someone to use an alien Facebook account to play poker and stock it with chips? It's not that strange if you think about it this way: As poker is a game where knowledge about the dealt cards gives you a significant edge in the game, you'd like to use sock puppets at a table to know more about the ...


110

What are the real world chances that someone would steal his identity? Running a MITM attack on an HTTP connection when on the same LAN is basically trivial. ARP is not designed to be secure. Some high end switches provide reasonable mitigation, but it is mostly pretty weak on anything that is not fabulously expensive. There is an employee complaining ...


81

I feel that ignoring would be the wrong thing to do, but I'm not sure what to do. If you feel that ignoring this is wrong, look up the bank's phone number from a reputable source, e.g. yellow pages or the banks actual website. Call them, and ask. Or submit a contact form on their website, or similar - in short, contact them through a channel not related to ...


75

The issue is not the birthday itself, the issue is a that unfortunately a lot of companies and websites are still using it for verification purposes. This is certainly bad practice and lots of companies are changing their policies just for that reason. Banks sometimes used it for retrieving a password, but in recent years they too have changed their ...


65

I react exactly the same as you- I first ask them to authenticate themselves to me, after all, they called me. If they can't or won't I tell them that I will call my bank manager/utility rep/whatever and that if this is an official message I should be able to receive it after authenticating the usual way. Don't give in to them- they need motivation to ...


64

To me it seems as if someone is doing fraud from your account. They load your FB with money (from a stolen credit card). Lose at poker so the money goes to another FB account. Withdraw that with an anonymous prepaid credit card. There are lots of different ways of doing carding (fraud). I'd contact FB and maybe the police as you might get a loud knock on ...


58

Our web application is being mimicked by another domain ... The domain in question is configured to resolve to the same IP address as yours. That's why it looks like they mimic you when in fact it is simply the same physical server, only accessed by another name. But when using the URL from your question one gets a security warning in the browser: the ...


48

Offensive defense is the type of attack you are looking to perform. You have been the victim of a technological crime, you are the target of a phishing campaign, and you want to get even. This is a very normal response and I can tell you that many organizations, governments, and individuals attempt this on their own daily. There is a major issue with any ...


40

Yes, you have to encrypt your connections. Let's take a scenario where you believe your network is physically secured (with required physical security and other required security measure) and no internet access (since you have indicated you only allow VPN access to trusted sources), but let's assume your employees take their laptop home and connecting to ...


37

A few thoughts about that: Biometric data is easy to access and should not be used as a password, only as additional authentication. As Freedom explained quite well your government already tracks you. Biometric data like fingerprints are mostly not stored as raw images but in form of hashes. An algorithm extracts certain characteristics. You cannot restore ...


33

OP has clarified that this is Zynga Poker, in which no real money changes hands. That being the case, the most likely reasons for a fraudster to put money into your mother's account is that this scamp has acquired/purchased a block of PayPal account details and is systematically testing them to see if they work by hacking into Facebook accounts and using ...


29

Risk of Repudiation In addition to all the fine answers about employees as a threat and visitors as a threat, I think you have to consider that the mere fact that the traffic is unencrypted is of itself a vulnerability even in the total absence of hackers. You are setting yourself up for a situation where any employee who does something they are not ...


28

I generally ask that they give me a call back number so that I can validate their identity. If they give you the number, tell them you will call them back momentarily at that number and validate that it is a number for the company they claim to be. If they get irate, ask to speak to a supervisor, if they still won't play ball, hang up on them and call the ...


28

I've just checked on Whois.us. Both domains are registered to the same person, with a stated address in London. Try talking to the internet fraud team from your local police. Chances are they're overworked, but if they've got some free time then they may be able to go to TLDsolutions.com and trace the payments. For most countries this would be a dead loss, ...


27

Is your site nrnsewa.com? If so, you aren't being mimicked, they just entered the IP address of your server in the DNS entry for their domain name. As a result, https://www.djjpl.com.sg is hitting your web server. Since it's your server, it responds with your content (or web app, or whatever). But since it's your server, you can also control how it responds....


24

This kind of thing happens all too often, and there isn't much you can do about it. You aren't going to get ahold of the person's IP address, or be able to find out anything beyond what is on the public snapchat account profile. Snapchat could determine a lot more, for instance IP address and the email address used when creating the account. They are not ...


23

First of all go to the police. Tell them your story, tell them you sent them a copy of your passport. Alert your bank and credit card suppliers as well. The biggest problem with sending a copy of your passport is that they can easily do identity theft. I wouldn't use an AV for your computer, I would just re-install your computer from scratch. As we ...


23

The problem with revealing your birthday isn't the birthday itself, it is that you are giving people one more data point. Reveal your birthday on site A, your relatives on site B (which gives for example mother's maiden name), your address on site C...before you know it people are able to pull together a huge amount of compiled information. That ...


19

PII by definition is any information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. And to answer your question, image of signature is a sensitive PII as it can be used to identify a person. As base64 encoding only obfuscate the data, that also shall be ...


18

The number of security measures in place and the capabilities to discover breaches will vary widely from company to company and depends on the type of data that is stolen. There are several ways a company will learn of a breach: security sofware catches unusal behaviour and marks it for later review (or stops it on the fly after part of the data ...


17

Based on the linked article, the biometrics to be used in this proposal are similar to what was used in the recent past on Georgia (US) drivers' licenses: a photo and fingerprint data. So this move would not be entirely without precedent. The linked article is a little short on details, so it is hard to assess what the risks to the individual might be ...


15

Call the police and sue them in court! That will show them you can be mean. Moreover, it will be legal and you will stay out of trouble.


15

I have a very generic e-mail address on which I receive similar e-mails from a Finnish and a French bank (I am not Finnish nor French and don't have any bank contacts in either country). However, I have found on Facebook two people with this rather unusual name in Finland and France respectively and both seem to fit the information I can distil from the ...


14

Some companies, especially larger ones that have been around long enough to develop bad habits, have roughly the following fallacious security model: The network is safe as long as nobody else plugs into it and nobody inside is technologically skilled enough to abuse it. Is this possible to protect in all cases? No, but proper physical/building access ...


14

In 2018, the answer depends on your threat and risk analysis results. Which, of course, you have performed, identified the likely scenarios, rated them and made a business decision based on the impact and frequency, according to a proper statistical or quantitative method. Your individual employee, however, has made his own personal risk analysis and ...


14

The attackers are skilled enough to not enable the phone and to set up a fake Find My iPhone site. This clearly shows they understand fairly well how the iPhones security features work and are trying to trick you into revealing the credentials that will let them get around those. Unless you are highly skilled yourself, they probably have the upper hand in ...


Only top voted, non community-wiki answers of a minimum length are eligible