3 ms·

The most obvious phishing email I ever received was from some random domain informing me I had not take the required anti-phishing tracking and to please click

The most obvious phishing email I ever received was from some random domain informing me I had not take the required anti-phishing tracking and to please click the link to take it. Like a good employee, I sent the email to our spam@ account and didn't give it any more thought. A month later, my manager comes in and informs me that the anti-phishing training is not optional and I had a week to complete it.

cwyers 8y ago
That's amazing.
Wowfunhappy 8y ago
At a large company, shouldn't someone be monitoring the address where people report phishing, who can tell you if a reported message is legitimate? I work at a small company, so I don't know if this is how any IRL organizations work, but it's how I assumed the procedure went.
- TeMPOraL 8y ago
  Anecdote time: At one of my previous jobs, there was this big part of intranet that was used by sysadmins, and various other people from fields other than software development. My team didn't have to deal with it, so we weren't even aware of it, much less had access to it. One day, however, someone wanted me to review a document from there. I bounced off the "Unauthorized" error, and dutifully followed the instructions to fill in an appropriate box with a justification, and send a request to be granted access. The issue wasn't critical, so I didn't pester anyone about it, just patiently waited for the access, re-filing my request every other month. Many months later, with me still not getting access, I eventually brought this up to my boss, who then smiled and told me that this access request form literally goes to /dev/null. Apparently after some software migration, no one bothered to connect this to anything.
kiallmacinnes 8y ago
Back when I worked at HP, our anti-phishing training even had a joke in it about how, yes, all HP URLs look exactly like the phising URLs they were describing... What's with https://h20195.www2.hpe.com/ https://h20195.www2.hpe.com/? Why?

cwyers 8y ago

That's amazing.

Wowfunhappy 8y ago

At a large company, shouldn't someone be monitoring the address where people report phishing, who can tell you if a reported message is legitimate? I work at a small company, so I don't know if this is how any IRL organizations work, but it's how I assumed the procedure went.

TeMPOraL 8y ago
Anecdote time: At one of my previous jobs, there was this big part of intranet that was used by sysadmins, and various other people from fields other than software development. My team didn't have to deal with it, so we weren't even aware of it, much less had access to it. One day, however, someone wanted me to review a document from there. I bounced off the "Unauthorized" error, and dutifully followed the instructions to fill in an appropriate box with a justification, and send a request to be granted access. The issue wasn't critical, so I didn't pester anyone about it, just patiently waited for the access, re-filing my request every other month. Many months later, with me still not getting access, I eventually brought this up to my boss, who then smiled and told me that this access request form literally goes to /dev/null. Apparently after some software migration, no one bothered to connect this to anything.

kiallmacinnes 8y ago

Back when I worked at HP, our anti-phishing training even had a joke in it about how, yes, all HP URLs look exactly like the phising URLs they were describing... What's with https://h20195.www2.hpe.com/ https://h20195.www2.hpe.com/? Why?