The Stack Overflow podcast is back! Listen to an interview with our new CEO.
264

IMPORTANT: this is based on data I got from your link, but the server might implement some protection. For example, once it has sent its "silver bullet" against a victim, it might answer with a faked "silver bullet" to the same request, so that anyone investigating is led astray. I have tried sending a fake parameter of cHVwcGFtZWxv to see whether it ...


221

It is not. This is a FUD (fear, uncertainty, and doubt) campaign by GMX because they want to display their ads. There is absolutely no security risk from the mentioned ad blockers. They added some crapware to the list to make it look more legitimate. Of course such campaigns are very unusual, especially from such a big and well known company like GMX. ...


179

While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC). This means that a spoofed mail would be ...


173

This may well be for the same reason as many scammers rely on the tired old 'Nigerian Prince' strategy: by self-selecting for gullible targets, they can be more efficient. In phishing, as in scams, sending the initial batch of emails is the easy part. The hard part is coaxing information out of the target (which can require a concerted exchange of emails). ...


153

This initial campaign established a baseline first. So, yes, it's normal. "How do we as a company stand? To what level do we need to train? Do we have, as a whole, secure users or do we have, as a whole, unsecure users?" This report establishes this and the extent to which management needs to engage in phishing training. Were only 5% of users to fall ...


129

No, because by giving names you are assigning blame, security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web site: you shouldn't blame the developer but should instead look to improve the entire process. We run phishing campaigns and do not identify users. What we use it ...


118

If you're worried about the authenticity of a cold-call, don't try over-the-phone authentication in either direction. Simply ask for some basic information you can use to refer to the issue in follow-up: Name of the company/service the account is for. What is the nature of the issue/offer the caller wants to discuss? Is there a reference ID (e.g.: ticket #) ...


107

Update After thinking it over, I have to agree with the other answers in that, despite the fact that it CAN access your data, Adblock is more likely to protect your privacy than invade it. The real risk are malicious ads that prompt you to install software on your computer. Adblock prevents these. Below is the original, cautionary answer: Yes, it totally ...


101

I think there is an underlying problem that you will need to address. Why do the users care that they are failing? Phishing simulations should, first and foremost, be an education tool not a testing tool. If there are negative consequences to failing, then yes, your users are going to complain if the tests are more difficult than you have prepared them ...


95

There are a number of both technical and non-technical ways that someone can identify a phishing attempt. Communicate out of Band. The easiest reliable way is to communicate with the proposed sender out-of-band. Call them, send them a what's app if applicable, signal, whatever. If an organization or an individual didn't send you an email they can tell you ...


90

Very dangerous things could happen here, indeed. It would be laughably easy for a scammer to phish users. A migration is an excuse many phishers already use: There was xyz problem in our user database [...] just "log in" or you won't be able to use our service. So the legitimate reason we upgraded our ‘BBC iD’ sign-in system to ‘BBC Account’ ...


87

This is just regular malware spam. The evil part of this message is likely the attached PDF it mentions. It likely contains an exploit which targets a vulnerability in one or more PDF readers and does something bad if opened with a vulnerable program. So do not open the attachment. The reason for the gibberish text in the email's sourcecode is likely to ...


78

It's a game of probability and chances are high that you might have one of the most popular apps in history installed on your device. My guess is that the scammer does not know anything about you. The app in question is widely popular and one of the most successful apps on both iOS and Android. An attacker may just send out large amounts of mails containing ...


76

Some telephone or SMS numbers allow for an additional charge that is automatically recovered by your phone provider and reversed to the owner of the number. This is mainly used (legally) for some TV games where each participant pays a little money when calling a special number or sending a SMS. At the end, either one of the players earns something, or the ...


74

There is a really, really good paper on this here. Tl;dr: 95% of spam is in English In f.ex. Germany only 17% of the spam is in German In Scandinavia it's less than 1% in the local language Conclusion I: Yes, generic phishing is mostly directed to English speaking people. I can only confirm that many German people will not even consider opening a mail ...


64

If the server is configured correctly, you cannot download a PHP file. It will be executed when called via the webserver. The only way to see what it does is to gain access to the server via SSH or FTP or some other method. This is because PHP is a serverside language, all the actions are performed on the server, then the result is sent to your browser (...


63

At every place I have worked (as a contract developer) developers are given local admin rights on their desktops. The reasons are: 1) Developers toolsets are often updated very regularly. Graphics libraries, code helpers, visual studio updates; they end up having updates coming out almost weekly that need to be installed. Desktop support usually gets ...


62

Okay, personal anecdote time. I'm a sysadmin in real life, working for an ISP that primarily caters to small to medium businesses. One of our larger customers operates, among other things, an exceptionally cheap and completely automated shared webhosting service. You sign up, pay a couple of bucks via credit card, and plonk your site down. No human ...


61

Great question! As it happens, I can present experimental data on this question -- and the data is fascinating. (I noticed that some of the answers contain speculation from first principles about how much security these security images offer. However, the data turns out to have some surprises for all of us!) Experimental methodology. "Security images" ...


59

We have been getting push back from end users that they have no way of distinguishing a legitimate email that they would receive day to day from truly malicious phishing emails. This is an indication that tests that could be rooted out as fakes by trained security professionals are being used to evaluate people who aren't. You may have the skills to pick ...


59

First of all, it would be a usability nightmare. Second, it wouldn't even fix the problem it purports to. While it could be effective to phishing mails designed for 'normal' clients, attacks designed to suir such systems would probably be even more effective. The users of such networks would be used to using all kind of alternative ways to refer to urls. ...


58

Our web application is being mimicked by another domain ... The domain in question is configured to resolve to the same IP address as yours. That's why it looks like they mimic you when in fact it is simply the same physical server, only accessed by another name. But when using the URL from your question one gets a security warning in the browser: the ...


57

It seems like the spammer got your personal information including your password through a security breach somewhere. Why did they use your password instead of your name? I would say it was an honest mistake on their side. They just mixed up the fields when designing the spam mail. When you are still using the password somewhere, you should change it ASAP. ...


54

This really comes down to an issue of trust. It is true that today, the AdBlock extension is safe. We know that it will not steal your data, even though—as the other answers point out—it has the technical ability to do so. However, Chrome extensions are silently and automatically updated. Do you trust that the developer of the AdBlock ...


50

Emails with mistakes are probably from people who doesn't know English well enough to write correctly. Many phishing emails do not have mistakes, and may be copied directly from emails sent by the company it claims to represent. See this for more details: "Phishing" red flags and countermeasures


49

I think the correct angle to look at this, is to ask the following question: With the amount of people that failed the test, what (security) goals would be accomplished if the company had these names? I would say: none. What is the security goal of a company-wide phishing test anyway? Typically in every company that relies on IT and has a certain amount ...


48

It is likely that the from header has been forged. I get emails from fake .govs quite often, mostly they end up in my spam filter. The hyperlink within is either unique, allowing tracking, or just delivers malware. Most of the time I just ignore these. If you believe that the header is not forged then you can typically contact the agency by Googling their ...


48

Call the credit card company! They have procedures for this including blocking your credit card and replacing it. You might even be able to get the 40€ back. There is a lot of articles about this online. If you knowingly ignore the issue you might be liable for any future damages by fraudulent credit card charges.


42

All software is a security risk, but in this case their claim is misleading. Just like all advice is potentially bad and and all transactions are potentially fraudulent. "Risk" just means your security isn't guarenteed, with is true in 100% of cases. But in the case of AdBlock Plus, the software is well-understood and developed by a team that has a track ...


40

As Polynomial mentioned, this is part of ICANN-mandated WHOIS verification. The reason it goes to domainadmin.com is that ICANN doesn't actually run the verification -- rather, like just about all ICANN things, they set policies that are then implemented by others (remember, your .com domain is in a registry operated by Verisign, and was registered by a ...


Only top voted, non community-wiki answers of a minimum length are eligible