This is how hackers hack you using simple social engineering

What people said

Derelicts · 2019-03 · Reference

Social hacking is alive and well. During my studies in computer engineering we had lectures on cybersecurity and the person used the following example [VIDEO] Human error is still one of the most popular hacking techniques. By getting an e-mail address you can check haveibeenpwnd to see if there were any leaks related to that e-mail address and there's already a lot that you have on a person that you don't actually know. Recently there was an increase in phishing schemes where hackers obtained the passwords of really old leaks (from myspace, armorgames etc. etc.) and sent letters to people with legit passwords trying to extort money. This was a hugely successful campaign. I'm not saying don't mention your name in public but for sure use a password manager and a VPN if you're on public wi-fi a lot. And don't shout your cred card number while buying coffee.

Read the original HN comment ↗

michaelbuckbee · 2018-08 · Reference

Cellphone accounts can be readily compromised via social engineering (aka tricking the CSR into changing things). Here's a pretty hilarious and effective example where a crying baby background was used: [VIDEO]

Read the original HN comment ↗

Buge · 2018-04 · Reference

>Only if you define easier as 'badly designed process'. I'd be interested to know what a good process is. >That is unfortunate, but why do you believe this will always be the case? I don't believe most (if any) online accounts that I have provide enough profit to the service owner to hire and train employees with enough expertise, time, and resources to properly determine a valid recovery attempt from a fake one. Social engineering employees just seems so easy from what I've seen. It's so reliable it can be done on stage: [LINK] [VIDEO] It just takes a single slip up and you lose. Whereas attackers can just keep trying. >Maybe this can be an opt-in for the more 'security-minded' minority. Yeah I agree it's a good idea. In fact that's what I've done on my primary google account [LINK] But that implementation isn't perfect, it requires giving up some features and buying U2F keys. Preferably you could opt into exactly the protection you want, so you could get the recovery security without having to buy security keys for example. I agree there could be better implementations, but they would cost more. I think it's a three way tradeoff between cost, easy recover, and security. When I hear someone advocating for easier recovery without advocating for higher cost, then I immediately think there will be a lowering of security.

Read the original HN comment ↗