The Stack Overflow podcast is back! Listen to an interview with our new CEO.
297

An IP address can be set up in DNS to resolve to any host name, by whoever is in control of that IP address. For example, if I am in control of the netblock 203.0.113.128/28, then I can set up 203.0.113.130 to reverse-resolve to presidential-desktop.oval-office.whitehouse.gov. I don't need control of whitehouse.gov to do this, though it can help in some ...


210

As @Adonalsium mentions in the comments, Data Valet manages the Starbucks public WiFi. They're trying to redirect you to the "agree to terms" page to login to the WiFi. Go to a page in a web browser that is not protected by ssl (neverssl.com is great for this), and it will redirect you to the portal page so you can agree, and then this will go away. The ...


101

Ars Technica did a superb piece on this a couple of years ago. A woman who is a real estate agent and publishes her cell phone, was inundated with junk calls. What was odd about these was They were fully automated calls They never played a message They used a different number every time They detailed her nightmare On the first night, France went to bed, ...


82

You can change your IP to whatever you want; that's trivial. But that will not work the way you want to. Let's say the store's ISP is Apple Networks, and their IP range is 1.2.3.0 to 1.2.3.255. You note that and get home. Your home network is from Avocado Networks, and their IP range is 2.3.4.5. You change your IP to 1.2.3.123 and wait. Nothing happens. You ...


53

One of my employers told us that if we receive a suspicious email with links, we have to hover over the link (to check that it is not spoofed) before clicking it. When you mouseover a link, the value of the href attribute is displayed in the status bar. Since this is the link target, it can give you an idea about where the link is going. would someone ...


49

Offensive defense is the type of attack you are looking to perform. You have been the victim of a technological crime, you are the target of a phishing campaign, and you want to get even. This is a very normal response and I can tell you that many organizations, governments, and individuals attempt this on their own daily. There is a major issue with any ...


47

How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8? They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and answer the query themselves. This is not that hard to do. How can I get around this without VPN? A properly configured VPN (i.e. no DNS leaks) can get ...


45

Multiple problems here. Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence. You're burning CPU to respond to the reconnaissance phase of an attack. This can be used against you. Depending on how this is set up, I can kill your server by forcing your ...


39

I think you MUST be concerned if anyone has unauthorized access to your server. As others mentioned there isn't much work for faking reverse DNS host name. Maybe they want you to believe it's okay for a government agency to have access to your server so you won't investigate the incident anymore. You should backup all your server logs for later analysis and ...


38

Actually, you can't. Whenever you need IP traffic to be bidirectional, IP spoofing is no use. The contacted server would not reply to you but to someone else, the address you spoofed. IP spoofing is then normally "useful" only to disrupt communications - you send harmful packets, and you don't want them being traceable to yourself. In specific situations ...


30

Security of the PSTN is horrifically poor. It's very easy to spoof anyone's number on Caller ID, without having to hack into any of their systems. As such, Caller ID provides no real assurance of who actually called you. There are even services available that the general public can use (for a small fee) to spoof any number they want.


28

I've just checked on Whois.us. Both domains are registered to the same person, with a stated address in London. Try talking to the internet fraud team from your local police. Chances are they're overworked, but if they've got some free time then they may be able to go to TLDsolutions.com and trace the payments. For most countries this would be a dead loss, ...


28

The CallerID displayed on the phone was never designed to be secure. Most VoIP (telephone over the internet) providers will allow the end user to set the outgoing number to be whatever they want. There's good reasons for this, one of which is your incoming provider doesn't have to be (and often isn't) your outgoing provider. This is commonly seen in spam ...


20

There are many VoIP services that provide ID-spoofing functionality Jumblo: Create an account and add some credit to it (10 Euros minimum excluding VAT), then install their Android app, login, the go to Settings and choose "Add Caller ID" then add the number. (Requires SMS verification) * Skype: You can create an online number (15 Euros minimum) then add ...


20

So should you be concerned if it was the FBI, or is it ok if it was just some casual hacker? From the logs, someone successfully logged onto a host you control. It should be assumed compromised regardless of who it was. Scrap it and rebuild. Also keep in mind that a reverse DNS entry can be created by anyone who has control of a specific IP block. It doesn'...


20

unfortunately they are not doing so! They are doing so, and your typescript shows it happening, with nslookup querying that IP address and getting answers from it. Your confusion stems in part from a misconception of what 8.8.8.8 is. It is an anycast IP address. Traffic sent to it is routed to the network interfaces of multiple machines around the world, ...


19

Sniffing and snooping should be synonyms. They refer to listening to a conversation. For example, if you login to a website that uses no encryption, your username and password can be sniffed off the network by someone who can capture the network traffic between you and the web site. Spoofing refers to actively introducing network traffic pretending to be ...


19

Yes, it is possible and almost trivial to make your phone call appear to come from a different number. Since many calls originate from within internal networks (e.g. PBX systems), the phone companies have a mechanism allowing the caller to indicate which phone number the call originates from. Traditionally there has been no restriction on which outgoing ...


19

I have now added this : v=spf1 include:_spf.google.com ~all The ~all at the end just causes a soft fail, that is that mail will still be delivered. If you want to have a permanent fail use -all. Of course this only affects mail server which check the SPF records, which are not all.


18

You've already taken the most important first step to protecting yourself, and that it to recognize that caller-id information can be spoofed, and is not entirely trustworthy. The second step is to apply that knowledge, and stop relying on caller-id. If someone calls you and asks for personal information, even if the caller-id appears to be the legitimate ...


17

Having an SPF record in your DNS records helps the recipient know which email server is legtimiate for your domain. The recipient looks up the sending domain for the valid server IPs and then decides what to do with the email. If the sending IP is on the list, then the email is likely OK. If the sending IP is not on the list, then it should be treated ...


17

From my understanding the message originally tried to fool the user into clicking some seemingly expected link (as shown in the text) which in reality is a different link (href attribute in the actual link), i.e. something like <a href=http://attacker> http://example.com </a> This trick was successfully neutralized by some secure mail gateway ...


16

Make a demonstration video. I have found that demonstration videos are an incredibly powerful way to communicate security issues, capturing the attention of managers who would otherwise dismiss this as "geeks talking geek". Try to make the video as real life as possible. Include an example that is not just "oh look, this shouldn't happen" but actually ...


16

Call the police and sue them in court! That will show them you can be mean. Moreover, it will be legal and you will stay out of trouble.


15

Despite what Wikipedia may say, they are not the same. Roughly speaking, DNS cache poisoning is one way to do DNS spoofing, but there are other ways to do it, too. DNS spoofing refers to the broad category of attacks that spoof DNS records. It is a category of attacks (an end goal of the attack, rather than a particular attack mechanism). There are many ...


14

Is it possible to spoof the IP once a TCP handshake was performed successfully? No. A TCP session is defined by four items: Source IP address Source IP port Destination IP address Destination port This comes from RFC 793: To provide for unique addresses within each TCP, we concatenate an internet address identifying the TCP with a port identifier to ...


14

This is a basic and quite popular scam that uses social engineering to make gullible people believe there's something wrong with their computer in order to sell them some fake security solution and/or possibly steal data from the machine in the process. The scammers are often based in India and use VoIP providers to call at cheap rates and appear as a local ...


14

While this is probably not enough information to determine with certainty what happened, I am wondering: is this how a (failed?) wifi spoofing attack would look like from the victim's point of view? Yes (which is not the same as saying that it happened). Specifically, someone nearby could have used airdump-ng or equivalent to get your AP's SSID and MAC ...


14

The attackers are skilled enough to not enable the phone and to set up a fake Find My iPhone site. This clearly shows they understand fairly well how the iPhones security features work and are trying to trick you into revealing the credentials that will let them get around those. Unless you are highly skilled yourself, they probably have the upper hand in ...


13

No, this is not possible. Depending on the key exchange mechanism in use, there are (slightly) different mechanisms for proving the identity of the server. This is defined in RFC4253 where it requires "explicit server authentication." In the case of RSA (RFC 4432), the server signs a piece of data provided by the client (actually a hash of several pieces) ...


Only top voted, non community-wiki answers of a minimum length are eligible