3 ms·

This is an interesting discussion. I can see the author's point - maybe, as a thought experiment, an attacker could latch onto the fact that someone is out of t

This is an interesting discussion. I can see the author's point - maybe, as a thought experiment, an attacker could latch onto the fact that someone is out of the office and use that as a wedge. Along the lines of "John and I had a payment planned, but he's out of the office, can you send it to [fake destination]?" But, like other people have noted, you also have to weigh the chance of that happening in real life. It seems like the amount of planning on the attacker's part would be significant enough that if they could pull it off, they would have found easier targets by then.

EvanAnderson 8y ago
I actually did see a situation just like that, and it amounted to lucky diligence on the part of a third-party that the situation was detected before it was too late. A guy in an Accounts Receivable role got phished. He went on a two week vacation, and bright-and-early on the first day he was out the phisher sent out emails as the vacationing AR person to a number of Customers advising them that remittance processing was being handled by a new third-party. They directed all the Customers to that third-party's "new" bank account. The attacker helpfully put a rule on the guy's Inbox to move new messages from every domain that the attacker emailed directly to "Deleted Items". One of the Customers thought it seemed a bit fishy and called-in to confirm that very first day.
volkl48 8y ago
Even that would be hard to use in real life, as an "out of office message" does not mean that their colleagues can't easily reach them. If you're some outsider you don't know if that person is really unreachable or if their colleagues can easily reach them on Slack/send them a text/whatever if they have some important question. And if you are internal/close enough to know their time off plans and that they're going backpacking in the Canadian Arctic, you didn't need the message to tell you they're out of office.

EvanAnderson 8y ago

I actually did see a situation just like that, and it amounted to lucky diligence on the part of a third-party that the situation was detected before it was too late. A guy in an Accounts Receivable role got phished. He went on a two week vacation, and bright-and-early on the first day he was out the phisher sent out emails as the vacationing AR person to a number of Customers advising them that remittance processing was being handled by a new third-party. They directed all the Customers to that third-party's "new" bank account. The attacker helpfully put a rule on the guy's Inbox to move new messages from every domain that the attacker emailed directly to "Deleted Items". One of the Customers thought it seemed a bit fishy and called-in to confirm that very first day.

volkl48 8y ago

Even that would be hard to use in real life, as an "out of office message" does not mean that their colleagues can't easily reach them. If you're some outsider you don't know if that person is really unreachable or if their colleagues can easily reach them on Slack/send them a text/whatever if they have some important question. And if you are internal/close enough to know their time off plans and that they're going backpacking in the Canadian Arctic, you didn't need the message to tell you they're out of office.