211
votes
Accepted
Is Starbucks spoofing me?
As @Adonalsium mentions in the comments, Data Valet manages the Starbucks public WiFi. They're trying to redirect you to the "agree to terms" page to login to the WiFi. Go to a page in a web browser ...
- 4,028
103
votes
How can caller ID be faked?
Ars Technica did a superb piece on this a couple of years ago. A woman who is a real estate agent and publishes her cell phone, was inundated with junk calls. What was odd about these was
They were ...
- 3,798
93
votes
Accepted
Is it possible to spoof an IP address to an exact number?
You can change your IP to whatever you want; that's trivial. But that will not work the way you want to.
Let's say the store's ISP is Apple Networks, and their IP range is 1.2.3.0 to 1.2.3.255. You ...
- 55.5k
90
votes
Accepted
Someone called someone else with my phone number
Someone placed a call to 'the guy', and spoofed the caller id to make it look like the call came from your phone number. Caller-id spoofing is not uncommon, and there are even VOIP services that ...
- 24k
54
votes
Accepted
Why is "hovering over" a link in an email considered safe? Or is it harmful?
One of my employers told us that if we receive a suspicious email with links, we have to hover over the link (to check that it is not spoofed) before clicking it.
When you mouseover a link, the ...
- 45.1k
48
votes
How could a public DNS server return bad results?
How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8?
They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and ...
- 208k
47
votes
How to be mean to some people that stole my phone
Offensive defense is the type of attack you are looking to perform. You have been the victim of a technological crime, you are the target of a phishing campaign, and you want to get even. This is a ...
- 1,451
43
votes
How wise is it to use a tool for portspoofing at your server to confuse attackers?
Multiple problems here.
Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence.
You're burning CPU ...
- 759
33
votes
How can caller ID be faked?
Security of the PSTN is horrifically poor. It's very easy to spoof anyone's number on Caller ID, without having to hack into any of their systems. As such, Caller ID provides no real assurance of who ...
29
votes
How can caller ID be faked?
The CallerID displayed on the phone was never designed to be secure. Most VoIP (telephone over the internet) providers will allow the end user to set the outgoing number to be whatever they want. ...
- 21.6k
27
votes
How to be mean to some people that stole my phone
I've just checked on Whois.us. Both domains are registered to the same person, with a stated address in London.
Try talking to the internet fraud team from your local police. Chances are they're ...
- 845
22
votes
Accepted
Can an SSH server in password mode be impersonated if I ignore the fingerprint warning?
... if I enter my password and the client allows the connection, then it has authenticated the server.
Neither password based nor key based authentication of the client against the server will ...
- 208k
21
votes
How could a public DNS server return bad results?
unfortunately they are not doing so!
They are doing so, and your typescript shows it happening, with nslookup querying that IP address and getting answers from it.
Your confusion stems in part from ...
- 701
19
votes
Accepted
Spam email "via" my domain, but SPF record exists
Having an SPF record in your DNS records helps the recipient know which email server is legtimiate for your domain. The recipient looks up the sending domain for the valid server IPs and then decides ...
- 132k
17
votes
Accepted
How Concerning Is This X-CU-modified: FAKECU Text Attack?
From my understanding the message originally tried to fool the user into clicking some seemingly expected link (as shown in the text) which in reality is a different link (href attribute in the actual ...
- 208k
14
votes
Accepted
Is hacking Wi-Fi THAT easy? (just spoof, and it's hacked?)
No, it is not that easy. But it depends on the network.
First, most Wi-Fi devices will remember all Wi-Fi networks they connect to, and also whether that network is encrypted or not and using which ...
- 330
14
votes
How to be mean to some people that stole my phone
Call the police and sue them in court! That will show them you can be mean. Moreover, it will be legal and you will stay out of trouble.
- 10.7k
14
votes
How to be mean to some people that stole my phone
The attackers are skilled enough to not enable the phone and to set up a fake Find My iPhone site. This clearly shows they understand fairly well how the iPhones security features work and are trying ...
- 10.7k
14
votes
Is it possible to spoof an IP address to an exact number?
You can spoof your IP to whatever you want it to be. Pick a number, any number! However, you can't use it to trick a HTTP server into believing your are someone you are not. The TCP handshake protects ...
- 65.8k
13
votes
Accepted
Did somebody try to spoof my wifi network?
While this is probably not enough information to determine with
certainty what happened, I am wondering: is this how a (failed?) wifi
spoofing attack would look like from the victim's point of ...
- 23k
13
votes
How could a public DNS server return bad results?
In short, your are being MITMed. The censor you're facing is doing something to your DNS requests directed at 8.8.8.8 so that you get non-genuine responses. There are many ways to achieve this, and ...
11
votes
Why is "hovering over" a link in an email considered safe? Or is it harmful?
This could only be achieved with JavaScript. You can set the link to anything, and then write an onclick action that sends the user somewhere else:
<a href="http://example.com" onclick="window....
- 29.8k
9
votes
How wise is it to use a tool for portspoofing at your server to confuse attackers?
I assume the effectiveness will be very limited.
First of all, exploiting port scanning tools will rarely be useful because most pentesters will use VMs and other confined environments when ...
- 1,990
9
votes
Is it possible to spoof an IP address to an exact number?
Practically yes, you can spoof it but it won't help in too many situations.
The IP protocol specifies that each IP packet must have a header which contains the IP address of the source of the packet. ...
- 8,939
8
votes
Spam email "via" my domain, but SPF record exists
Just having a SPF record does not mean that nobody is able to use your email address as the claimed recipient for spoofed messages.
First, SPF only cares about the SMTP envelope and not about the ...
- 208k
8
votes
Can an SSH server in password mode be impersonated if I ignore the fingerprint warning?
Your question seems to revolve around the idea of mutual authentication between an SSH client and SSH server based on a password. Protocols like PAKE and SRP aim to solve this problem. With PAKE/SRP,...
- 24k
7
votes
Bank asked for a cross login?
Disclaimer: IANAL
1 is this common now?! conversely is it brand new?
First time I read of it, but I know that many online banking system propose to aggregate your other bank accounts on their ...
- 26.9k
7
votes
Accepted
Do major ISPs still ignore IP spoofing?
I first saw the original referenced question and answered there, but I'll copy/paste my answer here since and add some more details to your additional questions:
ISP's should implement anti-spoofing. ...
- 6,948
6
votes
Accepted
How can GNSS spoofing be so easy? Don't the satellites sign their messages?
Ultimately, the answer is that there is no way of preventing jamming and fine spoofing in GPS or a GPS-like system due to the inherent principles of which it operates.
RF systems are always subject ...
- 783
5
votes
Accepted
Is it acceptable to enable relay of emails in an internal email server in a corporate network?
The above method can be used by an internal adversary to spoof and send emails to any internal employee as anyone else. Isn't this vulnerable?
Yes. There is a university of applied sciences in my ...
- 6,284
Only top scored, non community-wiki answers of a minimum length are eligible