186
votes
Accepted
Why do phishing e-mails use faked e-mail addresses instead of the real one?
While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF),...
- 208k
153
votes
Accepted
Company does not want any names on phishing reports
This initial campaign established a baseline first. So, yes, it's normal. "How do we as a company stand? To what level do we need to train? Do we have, as a whole, secure users or do we have, as a ...
- 2,788
129
votes
Company does not want any names on phishing reports
No, because by giving names you are assigning blame, security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web ...
- 3,270
103
votes
Accepted
Why is a link in an email more dangerous than a link from a web search?
The results of a search engine are based on previously collected data; i.e. the engine does not start to scan the whole internet when doing a search, but it looks through an index of seen and stored ...
- 208k
101
votes
When is phishing education going too far?
I think there is an underlying problem that you will need to address. Why do the users care that they are failing?
Phishing simulations should, first and foremost, be an education tool not a testing ...
- 132k
97
votes
Accepted
What is the purpose of a targeted email without any meaningful content?
Attempting to send a message to a non-existant email address will typically result in a “bounceback” message with an error code like 510 or 550 invalid address. If you try several addresses and there ...
- 1,745
95
votes
Is there any definitive way to tell if an email is a phishing attempt?
There are a number of both technical and non-technical ways that someone can identify a phishing attempt.
Communicate out of Band. The easiest reliable way is to communicate with the proposed sender ...
- 9,227
86
votes
Why is a link in an email more dangerous than a link from a web search?
Let me use an analogy:
It's for the same reason we tell our children not to take sweets from strangers, but at the same time we allow them to buy some in the supermarket with their pocket money.
Or ...
- 4,143
85
votes
Accepted
Is this account change PDF email (supposedly from Paypal) an exploit?
This is just regular malware spam.
The evil part of this message is likely the attached PDF it mentions. It likely contains an exploit which targets a vulnerability in one or more PDF readers and ...
- 49.5k
84
votes
Accepted
New Hires get phishing emails very quickly - Reasoning and how to stop
Presumably, your MX record is suffering from a directory harvest attack (DHA). There are lots of ways to do this and unless you're very savvy at pouring through your mail logs, most of them are (by ...
- 12.1k
77
votes
Are there any security risks in replying to an SMS message?
Some telephone or SMS numbers allow for an additional charge that is automatically recovered by your phone provider and reversed to the owner of the number. This is mainly used (legally) for some TV ...
- 26.9k
77
votes
Accepted
How could a scammer know the apps on my phone / iTunes account?
It's a game of probability and chances are high that you might have one of the most popular apps in history installed on your device.
My guess is that the scammer does not know anything about you. ...
- 1,470
76
votes
Accepted
Are non-English speakers better protected from (international) phishing?
There is a really, really good paper on this here.
Tl;dr:
95% of spam is in English
In f.ex. Germany only 17% of the spam is in German
In Scandinavia it's less than 1% in the local language
...
- 3,036
59
votes
When is phishing education going too far?
We have been getting push back from end users that they have no way of distinguishing a legitimate email that they would receive day to day from truly malicious phishing emails.
This is an indication ...
- 1,608
58
votes
Redacting URLs as an email-phishing preventative?
First of all, it would be a usability nightmare.
Second, it wouldn't even fix the problem it purports to. While it could be effective to phishing mails designed for 'normal' clients, attacks designed ...
- 19.1k
56
votes
Accepted
Another domain is using our web app's IP address. How to prevent it?
Our web application is being mimicked by another domain ...
The domain in question is configured to resolve to the same IP address as yours. That's why it looks like they mimic you when in fact it is ...
- 208k
54
votes
Accepted
What is the purpose of hiding spam links in some obscure forum posts?
It could be an attempt to boost the spam sites in search engine results by creating backlinks to it, which is a common SEO technique (although debatable how effective it is, as search engines can ...
- 16.5k
50
votes
How to protect against SIM swap scammers?
You don't use SMS for a second factor.
SMS is not secure by any means. The text is on clear, the traffic is on clear, and it's trivially easy to get a new SIM by pretending to be the victim. I once ...
- 55.5k
49
votes
Company does not want any names on phishing reports
I think the correct angle to look at this, is to ask the following question:
With the amount of people that failed the test, what (security) goals would be accomplished if the company had these names?...
- 8,021
48
votes
Apart from losing €40, is there any further risk if someone has my prepaid credit card number and home address?
Call the credit card company! They have procedures for this including blocking your credit card and replacing it. You might even be able to get the 40€ back.
There is a lot of articles about this ...
- 663
45
votes
Browser is accepting italic/bold Unicode as part of SPAM email's URL
Previous answers both tell part of the story here, but there's a few different aspects to understand.
Firstly, why do these code points exist? Unicode has the ambition to replace all previous ways of ...
- 3,920
43
votes
Is a safelinks.protection.outlook.com link phishing?
Depending whether this is an organizational email or Outlook.com, it's one of the following:
Office 365 Advanced Threat Protection ATP Safe Links.
Advanced Outlook.com security for Office 365 ...
- 19.4k
41
votes
Is it ever safe to open a suspicious HTML file (e.g. email attachment)?
Editors, and common libraries used by editors, may have vulnerabilities like buffer overflows. Your attacker would need to know (or guess) what editor you use and craft an exploit specifically for ...
- 519
38
votes
Accepted
Why doesn't Gmail make it clearer that emails have been signed by DKIM and delivered over TLS?
TL;DR: Mail delivery using TLS and signing using DKIM are weak protections, compared to accessing a web site using HTTPS. They should not be assumed to provide the same security and the indicators ...
- 208k
37
votes
Accepted
Is it illegal to DDoS a phishing page?
If you do a DDoS by sending large amounts of traffic to that site, you're very likely creating a lot of collateral damage since other services in (parts of) the network will suffer as well if the ...
- 6,948
37
votes
When is phishing education going too far?
There's one possible point to make that I haven't seen in other answers, but have seen in the real world.
Users say they "have no way of distinguishing a legitimate email that they would receive day ...
- 2,766
35
votes
Accepted
How can I trust that this is Google?
How do I trust that I am typing my password for google
You do not.
Apps should allow you to do that through actual Safari browser in another window, where you can see the address bar.
- 778
35
votes
Are there any security risks in replying to an SMS message?
One useful thing an attacker could gather is what your response time is at different times during the day and also things like your sleep schedule. If you leave your phone at home when you go jogging ...
- 14.3k
Only top scored, non community-wiki answers of a minimum length are eligible