4 ms·

On the PDF one, it tells you in the "intro" blurb that the sender's email address is wrong. Should be .edu and it's .org.

cbanek 8y ago
Ah thanks, I must have missed that. If it's the wrong address then definitely suspect.
verbify 8y ago
I don't know if that would be enough in real life for me. I know some organisations use two different domains (e.g. they did a transition but they don't want to turn off .org just in case something still uses it, the IT team forgot that Sam has two Outlook profiles, one is on .org). And while pdfs can be attack vectors, they're not an especially strong one - it's not like running an exe with administrator privileges. Comparatively giving a third party access to your emails should definitely raise flags.
- Zarel 8y ago
  They even had a legitimate example, of Dropbox sending an email from dropboxemail.com. I honestly think this should never be done because users shouldn't be expected to know which domains you do and don't own.
  - verbify 8y ago
    Your first point is definitely correct - their guide is confused at best. As to your second point, I agree in terms of 'best practices', but in terms of teaching about phishing, the fact is, companies do use multiple domains (and some deliverability guides actively encourage different domains for marketing emails and transactional emails - companies should use subdomains for this, but not all are that savvy). Given that companies are sending from multiple domains, I think the litmus test for phishing is: "Is the email trying to get me to give me information? E.g. a login on the wrong site, sending card details or anything like that" Your pdf reader should allow you to open a pdf without being compromised (just as your browser should allow you to click a dodgy link without being compromised). So I think that item should pass the litmus test (unlike the email reading one).
yellowapple 8y ago
I took that to be a hint along the lines of "schools should have .edu domains", which is unrealistic; lots of academic institutions use non-.edu domains, for better or worse (in fact, the school district in which I attended uses (DISTRICT).net to this day, and (DISTRICT).edu isn't even registered!). If that blurb was meant to be taken as "You happen to know that your school only has a .edu domain", then yeah, this would have been conclusively phishing. Otherwise, just because it might be malicious doesn't mean it's phishing.
beatgammit 8y ago
On my phone, I didn't see the TLD, and depending on the type of school, a .org is completely reasonable (e.g. private school). In fact, the types of schools I would be interested in a financial report from would potentially not use a .edu TLD. And PDFs are mostly harmless if you don't use Adobe Reader, since it's either a small attack vector or in a sandbox.
tjpnz 8y ago
That's a very US-centric view.

cbanek 8y ago

Ah thanks, I must have missed that. If it's the wrong address then definitely suspect.

verbify 8y ago

I don't know if that would be enough in real life for me. I know some organisations use two different domains (e.g. they did a transition but they don't want to turn off .org just in case something still uses it, the IT team forgot that Sam has two Outlook profiles, one is on .org). And while pdfs can be attack vectors, they're not an especially strong one - it's not like running an exe with administrator privileges. Comparatively giving a third party access to your emails should definitely raise flags.

Zarel 8y ago
They even had a legitimate example, of Dropbox sending an email from dropboxemail.com. I honestly think this should never be done because users shouldn't be expected to know which domains you do and don't own.
- verbify 8y ago
  Your first point is definitely correct - their guide is confused at best. As to your second point, I agree in terms of 'best practices', but in terms of teaching about phishing, the fact is, companies do use multiple domains (and some deliverability guides actively encourage different domains for marketing emails and transactional emails - companies should use subdomains for this, but not all are that savvy). Given that companies are sending from multiple domains, I think the litmus test for phishing is: "Is the email trying to get me to give me information? E.g. a login on the wrong site, sending card details or anything like that" Your pdf reader should allow you to open a pdf without being compromised (just as your browser should allow you to click a dodgy link without being compromised). So I think that item should pass the litmus test (unlike the email reading one).

yellowapple 8y ago

I took that to be a hint along the lines of "schools should have .edu domains", which is unrealistic; lots of academic institutions use non-.edu domains, for better or worse (in fact, the school district in which I attended uses (DISTRICT).net to this day, and (DISTRICT).edu isn't even registered!). If that blurb was meant to be taken as "You happen to know that your school only has a .edu domain", then yeah, this would have been conclusively phishing. Otherwise, just because it might be malicious doesn't mean it's phishing.

beatgammit 8y ago

On my phone, I didn't see the TLD, and depending on the type of school, a .org is completely reasonable (e.g. private school). In fact, the types of schools I would be interested in a financial report from would potentially not use a .edu TLD. And PDFs are mostly harmless if you don't use Adobe Reader, since it's either a small attack vector or in a sandbox.

tjpnz 8y ago

That's a very US-centric view.