Hacking News Social site (8) -
H Android (22) Komunikace(28) Databáze(39) Hardware(11) Infrastruktura(7) Mobil(18) LAN(26) Social site (6) Software(3) Virus(66) Web(724) VoIP (5) All
The attacker will reach out to you under a pretext, which can be very believable depending on how much effort they put into researching you. This pretext can then be used as a hook to verify information they already have, or gain new information. The attackers might also leverage information they previously acquired to give the impression that since they are authorized to know what they already know, they are authorized to know more.For example, knowing about a recent Internet outage at your office, a clever attacker might call you for a follow-up or even show up in person to gain valuable insights into how your network is secured—and where it’s vulnerable.
In this tactic, the social hackers will try to intercept data or even money by routing it along routes that they control. These requests could come in the form of a call from the “suppliers,” which will inform you of a change in their bank or email accounts. But it could also be as simple as adding somebody in cc of an email chain. You could for example get an email from a private account with the name of your business partner. Your “business partner” claims they currently can’t access their work email, asking you to resend the budget forecasts or blueprints.
The most common version of this tactic can come in the form of a USB stick you find near your car, or a free music in your mailbox. These come pre-filled with malware that infect your computer as soon as you insert the drives. In a well targeted attack, they are custom made for your computer and likely evade common anti-virus software. But baiting can also be much less technical. It could take the form of a free tour during which you are befriended and tricked into revealing sensitive information, or you have your equipment bugged.
Especially in large organizations, it can be difficult for each employee to at all times know who they are accountable to. Hackers exploit this by asserting their authority over people and pressuring them into revealing information, making changes to data structures, or giving up access to systems. In security-relevant departments, it is important to develop a clear chain of command, including a limited set of authentication methods (PGP works great for that). The people in that command have to learn to deny requests when they do not come from the appropriate channels or lack proper authentication. Imagine getting a request from someone in an overseas department who claims to have superiority over your boss, asking you for their travel details. Would you give it to them?
It’s great when people are helpful, and we usually assume that those around us have good intentions. But from a security standpoint, giving strangers the benefit of the doubt can be devastating. An attacker might appeal to your kindness. Often enough, asking for compromising information is all that it takes. Some rare compliments from a contractor can brighten up anybody’s day. So is it too much when they ask for a heads-up on the budget planning? Most likely it is.
The human mind quickly jumps to conclusions and sides with what is familiar to us. This is why we see the Virgin Mary on toast and that woman standing on Mars. Attackers can exploit that by playing with your associations, making it unclear who is calling you and being vague about what they are talking about. Often enough the attacker doesn’t know themselves who they supposed to impersonate, but the person being hacked fills the gaps for them. Who was that just now on the phone talking about some security audit? Must have been Adam. He always bugs people about that stuff. But if it wasn’t Adam, who did you just gave that password to?
Likejacking je škodlivý technika z podvádět uživatelům webových stránek na vyslání Facebook aktualizace stavu na místě neměli záměrně znamená " jako ". Pojem "likejacking" pochází z komentáře vyslán Corey Ballou v článku Jak na "Like" Cokoliv na webu (bezpečně) , který je jedním z prvních zdokumentovaných účtování, které vysvětlují možnost nebezpečné činnosti, pokud jde o Facebook je "jako" tlačítko. Podle článku v IEEE Spectrum , řešení likejacking byl vyvinut v jedné z Facebooku je hackathons ."Like" bookmarklet je k dispozici, že se vyhýbá možnost likejacking přítomny v tlačítko Facebook Like .
Cursorjacking je UI napravit technika změnit kurzor z místa, uživatel vnímá, objevil v roce 2010 Eddy Bordi, vědecký pracovník v Vulnerability.fr, pochvalná zmínka potřebovaný Marcus Niemietz prokázal to s ikonou vlastní kurzor, a v roce 2012 Mario Heiderich tím, že skryje kurzor. Jordi kněžiště objevil cursorjacking zranitelnost použitím blesku, HTML a JavaScript kód v prohlížeči Mozilla Firefox na Mac OS X systému (pevný ve Firefoxu 30,0), které vedou ke spuštění nežádoucího kódu a webcam špionáže (Ref: http://www.mozilla.org/security / announce/2014/mfsa2014-50.html ), závažnost této chyby je definována jako vysoká.