3 ms·

The thing that's missing in this article is the "attacks" were done by phishing with email attachments and if one didn't know about that risk they had to ignore

by oblib 9y ago

The thing that's missing in this article is the "attacks" were done by phishing with email attachments and if one didn't know about that risk they had to ignore thousands of warnings about it over a lot years. Back in 2000 I woke up with an email in my box with the subject "I love you" with an attachment. I took one look at it and deleted it. I thought about calling my partner at the time and warning him about it but he'd been coding with me for a few years so I figured he'd know what he was looking at. I was wrong. He clicked on it and it deleted thousands of photos off his computer. How people fall for that two decades later is not related to "warning" them. We've all been warned for decades.

x1798DE 9y ago
It's not a huge difference, but there is a softened between phishing and spear-phishing. It's a lot easier for a specifically crafted spear-phishing campaign to get through whatever mental heuristics you use to identify scams than the broad phishing campaigns you usually see. "Dear X, This email is to set up a meeting to discuss Kaylee's performance in school. Please click here to sign in to our new parent conference scheduling software. Signed, Y, Kaylee's School, Principal"
- oblib 9y ago
  Yes, that kind of scam can suck some in but it's up to management to educate employees on what to be aware of and how to detect and react to it. The threat is so constant and pervasive though that it's hard for me to imagine that management in any government agency hasn't educated employees about how to deal with these kinds of threats, but not impossible because I don't have to imagine someone did bite. I just can't make the leap that the FBI is to blame though. That's just a leap too far.
  - weaksauce 9y ago
    They share some of the blame. The FBI could have said to the parties involved, "you are going to be targeted by scammers looking to get your emails, be extra vigilant with what you click on." It's a difference between targeted attacking and fish net hacking or phishing without a target.

by oblib 9y ago

x1798DE 9y ago

It's not a huge difference, but there is a softened between phishing and spear-phishing. It's a lot easier for a specifically crafted spear-phishing campaign to get through whatever mental heuristics you use to identify scams than the broad phishing campaigns you usually see. "Dear X, This email is to set up a meeting to discuss Kaylee's performance in school. Please click here to sign in to our new parent conference scheduling software. Signed, Y, Kaylee's School, Principal"

oblib 9y ago
Yes, that kind of scam can suck some in but it's up to management to educate employees on what to be aware of and how to detect and react to it. The threat is so constant and pervasive though that it's hard for me to imagine that management in any government agency hasn't educated employees about how to deal with these kinds of threats, but not impossible because I don't have to imagine someone did bite. I just can't make the leap that the FBI is to blame though. That's just a leap too far.
- weaksauce 9y ago
  They share some of the blame. The FBI could have said to the parties involved, "you are going to be targeted by scammers looking to get your emails, be extra vigilant with what you click on." It's a difference between targeted attacking and fish net hacking or phishing without a target.