295 votes
Accepted

Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?

An IP address can be set up in DNS to resolve to any host name, by whoever is in control of that IP address. For example, if I am in control of the netblock 203.0.113.128/28, then I can set up 203.0....
user's user avatar
  • 7,795
211 votes
Accepted

Is Starbucks spoofing me?

As @Adonalsium mentions in the comments, Data Valet manages the Starbucks public WiFi. They're trying to redirect you to the "agree to terms" page to login to the WiFi. Go to a page in a web browser ...
nbering's user avatar
  • 4,038
104 votes

How can caller ID be faked?

Ars Technica did a superb piece on this a couple of years ago. A woman who is a real estate agent and publishes her cell phone, was inundated with junk calls. What was odd about these was They were ...
Machavity's user avatar
  • 3,818
91 votes
Accepted

Is it possible to spoof an IP address to an exact number?

You can change your IP to whatever you want; that's trivial. But that will not work the way you want to. Let's say the store's ISP is Apple Networks, and their IP range is 1.2.3.0 to 1.2.3.255. You ...
ThoriumBR's user avatar
  • 54.1k
90 votes
Accepted

Someone called someone else with my phone number

Someone placed a call to 'the guy', and spoofed the caller id to make it look like the call came from your phone number. Caller-id spoofing is not uncommon, and there are even VOIP services that ...
mti2935's user avatar
  • 23.4k
54 votes
Accepted

Why is "hovering over" a link in an email considered safe? Or is it harmful?

One of my employers told us that if we receive a suspicious email with links, we have to hover over the link (to check that it is not spoofed) before clicking it. When you mouseover a link, the ...
Arminius's user avatar
  • 44.8k
48 votes

How could a public DNS server return bad results?

How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8? They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and ...
Steffen Ullrich's user avatar
47 votes

How to be mean to some people that stole my phone

Offensive defense is the type of attack you are looking to perform. You have been the victim of a technological crime, you are the target of a phishing campaign, and you want to get even. This is a ...
Connor Peoples's user avatar
43 votes

How wise is it to use a tool for portspoofing at your server to confuse attackers?

Multiple problems here. Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence. You're burning CPU ...
Ryan Gooler's user avatar
39 votes

Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?

I think you MUST be concerned if anyone has unauthorized access to your server. As others mentioned there isn't much work for faking reverse DNS host name. Maybe they want you to believe it's okay for ...
Koorosh Pasokhi's user avatar
33 votes

How can caller ID be faked?

Security of the PSTN is horrifically poor. It's very easy to spoof anyone's number on Caller ID, without having to hack into any of their systems. As such, Caller ID provides no real assurance of who ...
Joseph Sible-Reinstate Monica's user avatar
30 votes

How can caller ID be faked?

The CallerID displayed on the phone was never designed to be secure. Most VoIP (telephone over the internet) providers will allow the end user to set the outgoing number to be whatever they want. ...
Steve Sether's user avatar
  • 21.6k
28 votes

How to be mean to some people that stole my phone

I've just checked on Whois.us. Both domains are registered to the same person, with a stated address in London. Try talking to the internet fraud team from your local police. Chances are they're ...
Graham's user avatar
  • 621
21 votes

Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?

So should you be concerned if it was the FBI, or is it ok if it was just some casual hacker? From the logs, someone successfully logged onto a host you control. It should be assumed compromised ...
s3c's user avatar
  • 311
21 votes

How could a public DNS server return bad results?

unfortunately they are not doing so! They are doing so, and your typescript shows it happening, with nslookup querying that IP address and getting answers from it. Your confusion stems in part from ...
JdeBP's user avatar
  • 701
21 votes
Accepted

Can an SSH server in password mode be impersonated if I ignore the fingerprint warning?

... if I enter my password and the client allows the connection, then it has authenticated the server. Neither password based nor key based authentication of the client against the server will ...
Steffen Ullrich's user avatar
19 votes

Somebody is spoofing my email to send spam messages, and I have no idea how to block

I have now added this : v=spf1 include:_spf.google.com ~all The ~all at the end just causes a soft fail, that is that mail will still be delivered. If you want to have a permanent fail use -all. Of ...
Steffen Ullrich's user avatar
19 votes
Accepted

Spam email "via" my domain, but SPF record exists

Having an SPF record in your DNS records helps the recipient know which email server is legtimiate for your domain. The recipient looks up the sending domain for the valid server IPs and then decides ...
schroeder's user avatar
  • 129k
17 votes
Accepted

How Concerning Is This X-CU-modified: FAKECU Text Attack?

From my understanding the message originally tried to fool the user into clicking some seemingly expected link (as shown in the text) which in reality is a different link (href attribute in the actual ...
Steffen Ullrich's user avatar
15 votes

How to be mean to some people that stole my phone

Call the police and sue them in court! That will show them you can be mean. Moreover, it will be legal and you will stay out of trouble.
A. Hersean's user avatar
  • 10.6k
14 votes
Accepted

Is hacking Wi-Fi THAT easy? (just spoof, and it's hacked?)

No, it is not that easy. But it depends on the network. First, most Wi-Fi devices will remember all Wi-Fi networks they connect to, and also whether that network is encrypted or not and using which ...
Dubu's user avatar
  • 330
14 votes

How to be mean to some people that stole my phone

The attackers are skilled enough to not enable the phone and to set up a fake Find My iPhone site. This clearly shows they understand fairly well how the iPhones security features work and are trying ...
Tom's user avatar
  • 10.4k
14 votes

Is it possible to spoof an IP address to an exact number?

You can spoof your IP to whatever you want it to be. Pick a number, any number! However, you can't use it to trick a HTTP server into believing your are someone you are not. The TCP handshake protects ...
Anders's user avatar
  • 65.6k
13 votes

List of visually similar characters, for detecting spoofing and social engineering attacks

There are different approaches for homograph attacks. The success depends on the used font. For example in some fonts the small letter l looks very much like the capitalized letter I. And in others ...
Marc Ruef's user avatar
  • 1,110
13 votes

Are SSL browser sessions kept alive across requests?

TL;DR: HTTP sessions and SSL sessions are different entities and there is no mapping from one to the other. Onto the specifics... When a client requests an SSL web resource via a browser (ie: a ...
Neil Smithline's user avatar
13 votes
Accepted

Did somebody try to spoof my wifi network?

While this is probably not enough information to determine with certainty what happened, I am wondering: is this how a (failed?) wifi spoofing attack would look like from the victim's point of ...
LSerni's user avatar
  • 22.8k
13 votes

How could a public DNS server return bad results?

In short, your are being MITMed. The censor you're facing is doing something to your DNS requests directed at 8.8.8.8 so that you get non-genuine responses. There are many ways to achieve this, and ...
twisteroid ambassador's user avatar
12 votes

Are SSL browser sessions kept alive across requests?

HTTP sessions and TLS sessions are independent. HTTP keeps track of session usually with HTTP cookies. Requests from a single HTTP session can be sent over multiple TLS connections each with their own ...
Lie Ryan's user avatar
  • 31.5k
11 votes

List of visually similar characters, for detecting spoofing and social engineering attacks

Try looking under the term "Homoglyph" instead of "homograph". For instance, this might be what you wanted: https://codebox.net/pages/homoglyph-detection It contains code and dictionaries.
J Kimball's user avatar
  • 2,137
11 votes

Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?

Kill it with fire. Like yesterday. The FBI DITU or any other cyber unit from any Alphabet Soup to include Army CYBERCOM is NOT in the business of simply accessing your system from fbi.gov, someone is ...
VaeInimicus's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible