163 votes

Roles to play when tailgaiting into a residential building

There are some basic social engineering approaches to use that work in most situations, not just tailgating: urgency authority curiosity pretexting Urgency Be someone with a specific task to ...
schroeder's user avatar
  • 129k
138 votes
Accepted

Defence methods against tailgating

This is not a problem that has a social solution. No amount of corporate policy will save you. Humans are social animals. In the end, if people can let other people in, they will. Even if you may be ...
Anders's user avatar
  • 65.6k
117 votes

Advised to block all traffic to/from specific IP addresses

If you spoke to the FI on a separate channel, you actually spoke to the FI, and they know about this, then by definition, it is not a phish. What strikes me as odd is "but they can't (won't) provide ...
schroeder's user avatar
  • 129k
102 votes
Accepted

Why is a link in an email more dangerous than a link from a web search?

The results of a search engine are based on previously collected data, i.e. the engine does not starts to scanning the whole internet when doing a search but it looks through an index of seen and ...
Steffen Ullrich's user avatar
86 votes

Why is a link in an email more dangerous than a link from a web search?

Let me use an analogy: It's for the same reason we tell our children not to take sweets from strangers, but at the same time we allow them to buy some in the supermarket with their pocket money. Or ...
Marcel's user avatar
  • 4,086
83 votes

Roles to play when tailgaiting into a residential building

Just stand outside the door at some distance talking on your phone. Don't look at the door, don't look at the person coming to open it, don't look like you want to get in. Don't ask to be let in. Don'...
Anders's user avatar
  • 65.6k
70 votes
Accepted

Does this mean Target's twitter was successfully attacked?

Yes, Target did have their account hacked. In fact, quite a lot of verified account holders have been hacked to further this scam. The scammers do this to impersonate other accounts, including Elon ...
forest's user avatar
  • 66.6k
69 votes
Accepted

Why is social engineering often excluded from bug bounties?

Because Human Factor vulnerabilities are complex, undefined, non-linear, and often not repeatable in a predictable way. Being able to successfully soceng one person is not enough for an organisation ...
schroeder's user avatar
  • 129k
63 votes

Defence methods against tailgating

You protect yourself by politely challenging people who are trying to get in without using the controls. You simply ask to see their pass or offer to escort them to reception/security. I use the ...
schroeder's user avatar
  • 129k
51 votes
Accepted

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is ...
LSerni's user avatar
  • 22.8k
43 votes

Roles to play when tailgaiting into a residential building

The main element, as you've said, is to not look like you're waiting for your mark to arrive. What you need is a prop that gives a visual indication why you're standing outside the door. Useful props ...
Richard's user avatar
  • 939
39 votes

Advised to block all traffic to/from specific IP addresses

I would lean away from this being a social engineering attempt and more towards a peer FI being uber-cautious regarding information disclosure - they may have had some kind of incident involving these ...
Doomgoose's user avatar
  • 746
39 votes

Defence methods against tailgating

The cheap solution is to put up scary “no tailgating - everyone must badge in at this door - no exceptions - don’t risk your job - report all tailgate requests to Joe at 123-456-7890” signs at each ...
John Deters's user avatar
  • 34.2k
38 votes

Why is social engineering often excluded from bug bounties?

We want to find unknown, fixable vulnerabilities The goal of penetration testing is to obtain actionable results - to have someone find vulnerabilities that the organization did not know that they ...
Peteris's user avatar
  • 8,419
33 votes

Is it a good idea to use non-ASCII names in the U.S.?

There are even Chinese people in the US. They name their children 李某. Would that be a problem? No. Some systems support these names, some use versions converted to ASCII through romanization (李某 → ...
Esa Jokinen's user avatar
  • 18.9k
33 votes

Why is a link in an email more dangerous than a link from a web search?

One reason might be that links in emails can be "personalized", links in web searches can not. A common tactic that spammers use is to send out links containing some token representing your ...
ManfP's user avatar
  • 531
31 votes

Does this mean Target's twitter was successfully attacked?

Target has since confirmed my suspicion: Hard Fork article “Early this morning, Target’s Twitter account was inappropriately accessed” a company spokesperson told Hard Fork in an email. “The access ...
Oddthinking's user avatar
  • 1,859
28 votes

How do hackers make the victim access an XSS attack URL?

the user did some actions that they won't do as usual Clicking on a link does seem like a usual action for most users. See for example this study, in which 56% of users clicked on links in E-Mails ...
tim's user avatar
  • 29.6k
28 votes

Defence methods against tailgating

(Just a passer-by opinion) Obviously, a physical gate would work the best. In case you don't want to install these, you may try to request all employees to challenge tailgaters, as schroeder ...
Petr's user avatar
  • 381
22 votes

Song Lyrics as passphrases

As with any password guessability/strength question, likely the most important factor is "who's the attacker". For online password guessing attacks, by an attacker who doesn't know you, the most ...
Rory McCune's user avatar
  • 62.2k
20 votes

Why do the large majority of big organizations have "known bad" password policies?

[ "Why does someone else do something I consider dumb?" is always a very open-ended question subject to speculation (and is not a great fit for Stack Exchange.) But because this problem is so ...
John Deters's user avatar
  • 34.2k
20 votes

Is it a good idea to use non-ASCII names in the U.S.?

I don't live in the US but I live in a street that has (if written correctly) 2 German Umlauts in their name. I never had a problem with my passport or with US authorities, visa waiver programs or ...
nvoigt's user avatar
  • 1,092
19 votes

Song Lyrics as passphrases

Sorry, but you're not the first person to think of this so you can bet that this technique will be automated in some password cracking software. It's always best to assume that the hacker knows your ...
Gareth Charnock's user avatar
18 votes

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

There are two different scenarios. This would be a valid question if the keyboard is used only for password typing. A numeric keypad on a door, that's something you shouldn’t post on social media. But ...
Dilan's user avatar
  • 181
18 votes
Accepted

Can firewall stop social engineering attacks?

Generally: No, a Firewall is not to stop social engineering attacks. The reason for this answer lies in the nature of Social Engineering - Social Engineering is about manipulation people, not about ...
Lukas's user avatar
  • 3,188
17 votes
Accepted

How to protect yourself against OSINT?

Open source intelligence has been around for sometime even though it's received attention only in the recent past. Here's what I do to keep a check on myself. Step 1: Hack yourself Have you ever ...
Izy-'s user avatar
  • 873
16 votes

Roles to play when tailgaiting into a residential building

Buy one of these: Look rushed, and knock on the window/door until someone lets you in. Once inside ask for a random name, and have a screenshot of the doordash app on your phone. (Preferably with ...
kingsfoil's user avatar
  • 265
14 votes
Accepted

What is the point of an attack using spam without any URL or attached file

It's a Nigerian email scam (as @Sravan commented). If you contact that email the scammer will promise you a lot of money and ask for a small fee for document copies, then a little more for document ...
ThoriumBR's user avatar
  • 53.9k
14 votes

Defence methods against tailgating

As a receptionist, I am trained to vet everyone who comes into the building. If I do not recognize that person, I immediately ask if they need help with anything, and who they have come to see. If ...
William Michael's user avatar
13 votes

List of visually similar characters, for detecting spoofing and social engineering attacks

There are different approaches for homograph attacks. The success depends on the used font. For example in some fonts the small letter l looks very much like the capitalized letter I. And in others ...
Marc Ruef's user avatar
  • 1,110

Only top scored, non community-wiki answers of a minimum length are eligible