Hacker News new | ask | show | jobs
by 0x3f 5 days ago
Seems pretty relevant to a social engineering attack to have more correct pieces of info to give to support.
1 comments
john_strinlai 5 days ago
by "what happened here" i mean this specific post. in this specific post, address information was not required.
link
0x3f 4 days ago
That's not clear to me.

> He convinced them the domain registered in my name and address really belonged to his club

Convinced how? Often such things are via "knowing things" about the account holder.

link
john_strinlai 4 days ago
the author explicitly said they had domain privacy on. so we know that the caller did not have the address information.

and we can be certain that domain privacy wouldn't have helped in this case (because it didn't).

https://news.ycombinator.com/item?id=49028611

>Convinced how? Often such things are via "knowing things" about the account holder.

i have some experience with social engineering attacks (former infosec turned teacher) and it was probably a combination of:

    - caller confidence that they were the club owner/manager (because they were)
    - offering/sending club-specific information that matched information on the site (flyers, pamphlets, etc.)
    - "call the number on the website and i will answer it"
    - an official college website page that had the caller listed as an owner/manager of the club
    - some poor 20-something year old working in a hellish, windowless tier 1 tech support center
link