# Best Social Engineering (Phishing ) Attacks? **URL:** \ **Category:** Factual Questions\ **Created:** [September 10, 2018, 3:36pm UTC](https://boards.straightdope.com/t/best-social-engineering-phishing-attacks/821108 "2018-09-10T15:36:58Z")\ **Posts on this page:** 7\ **Page:** 2
**Author:** ![Dewey\_Finn](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dewey_finn/32/4222_2.png) [@Dewey\_Finn](https://boards.straightdope.com/u/Dewey_Finn)\ **Post date:** [September 11, 2018, 7:24pm UTC](https://boards.straightdope.com/t/best-social-engineering-phishing-attacks/821108/21 "2018-09-11T19:24:51Z")
One I remember involved the celebrity Paris Hilton, who was known for appearing in public carrying her pet chihuahua Tinkerbell. Someone called her cell phone company, answered the security question (What’s your pet’s name?) and accessed her voicemail messages, which were then posted on the internet. In this case, the “social engineering” required someone to be foolish enough to use public information for the security question on her account. ---
**Author:** ![Projammer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/projammer/32/559_2.png) [@Projammer](https://boards.straightdope.com/u/Projammer)\ **Post date:** [September 11, 2018, 7:30pm UTC](https://boards.straightdope.com/t/best-social-engineering-phishing-attacks/821108/22 "2018-09-11T19:30:39Z")
> [@Musicat](#): > > I think the most successful phishing attempts are ones that are narrowly targeted, such as these, targeted to financial agents. The average person wouldn’t be as easily fooled. That’s actually known as spear phishing. Spear phishing has the same goal as normal phishing, but the attacker first gathers information about the intended target. This information is used to personalize the spear-phishing attack. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [September 11, 2018, 7:40pm UTC](https://boards.straightdope.com/t/best-social-engineering-phishing-attacks/821108/23 "2018-09-11T19:40:54Z")
Not quite phishing or traditional electronic social engineering, but still relying on human nature: A colleague (who is a security expert who does penetration testing) told me of an attacker who used a drone to drop a USB drive inside a company’s perimeter fence (this detail was confirmed by CCTV after the fact) - dropping it near the picnic benches used by staff for their breaks. The drive was picked up by a member of staff, who plugged it into their computer (probably initially to try to identify the owner) - the drive contained a document named “Management Salaries”, which piqued the curiosity of the staff member, who opened it- of course, the document was actually infected with a trojan. ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [September 11, 2018, 7:44pm UTC](https://boards.straightdope.com/t/best-social-engineering-phishing-attacks/821108/24 "2018-09-11T19:44:04Z")
> [@Sailboat](#): > > What really got me was they referred to an upgrade that the IT department had pushed out the day before. Sure, actual malicious phishers might have been able to assume that a Windows update would be pushed out by our internal IT on a specific date, I guess. But it felt like our IT folks using insider knowledge to trick us was something of a low blow. Low blows are fine, in that real attackers will use any knowledge and any techniques they have access to in order to gain a foothold. What was questionable about what your company did is that they likely weren’t testing anything worth testing. Unless there’s more to the story than you said, the only thing they proved is that you’ll click a link in an email sent from within the company which not only looks entirely reasonable, but demonstrates knowledge of non-publicized company practices. How does that tell them anything they didn’t already know? What the Hell was the point of that? If anything, they demonstrated a flaw in their email software: First, if a sender can send an email which apparently comes from inside the organization from outside the organization, the flaw isn’t in the minds of the recipients, the flaw is in the email system, and, second, if a sender inside the organization can spoof their from address, that’s also a flaw in the email system. It’s like they’re testing to see if you lock your door, but they bring a crowbar and fail you if they’re able to break it open. They’ve tested the wrong thing. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [September 11, 2018, 7:48pm UTC](https://boards.straightdope.com/t/best-social-engineering-phishing-attacks/821108/25 "2018-09-11T19:48:18Z")
Just remembered another one - a member of our finance team received a spoofed email purporting to be from the Managing Director, requesting an urgent transfer of money to a client via an unconventional route - the MD was travelling at the time, so the request seemed initially plausible - the detail that triggered suspicion was the signoff at the end of the message - it said ‘Have a great day!’ - not something the genuine individual is expected to have said. ---
**Author:** ![Leaffan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leaffan/32/299_2.png) [@Leaffan](https://boards.straightdope.com/u/Leaffan)\ **Post date:** [September 11, 2018, 8:54pm UTC](https://boards.straightdope.com/t/best-social-engineering-phishing-attacks/821108/26 "2018-09-11T20:54:54Z")
I fell for an internal phishing test a few years back. I had been off work for a bit due to medical issues and received an apparent legitimate email from IT stating that my credentials needed to be verified. “Please click this link and confirm your login credentials.” I read this on my work Blackberry and, since I had been off work for a while, considered it to be a valid request. On a PC I would have hovered over the link to see where it was directed. On a Blackberry I didn’t know how to do that, so I just went ahead only to get a “gotcha!” message from IT. Yeah thanks. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [September 11, 2018, 9:06pm UTC](https://boards.straightdope.com/t/best-social-engineering-phishing-attacks/821108/27 "2018-09-11T21:06:54Z")
I just received this email, with a US Bank logo at the top: > [@](#): > > Your credit card was billed at Apple Online Store for $2,513.56. > > Please don’t reply to this email. If you would like to contact us, please sign in to U.S. Bank On-line at [usbank.com](http://usbank.com) and contact Customer Service. > > You’re getting this e mail because you registered for alerts via U.S. Bank Online Banking. If you no longer want to receive these alerts, sign in to U.S. Bank Online at [usbank.com](http://usbank.com) to temporarily terminate or permanently erase this alert. > > [link]Get Your Receipt[/link] It included this helpful advice: > [@](#): > > EMAIL SECURITY INFORMATION > Defending your privacy is our priority. We’ll never make a request through e-mail for your personal data like your Personal ID, SSN, PIN or Bank account Number. For your safety, never share this information with anybody, at any time. If you receive an e mail requesting your personal information, or would like to report a shady e-mail, send it to [fraud\_help@usbank.com](mailto:fraud_help@usbank.com) \ or call U.S. Bank Customer Service immediately at 800-US-BANKS. And very helpfully, included a link: > [@](#): > > [link]Get more details about spotting on-line scam issues.[/link] Since I don’t bank at US Bank, I know this is not a valid threat. If I did bank there, I might be tempted to click on one of the links, all of which are bogus. [Previous page](https://boards.straightdope.com/t/best-social-engineering-phishing-attacks/821108.md?page=1)