4 ms·

Repeat after me: Everyone can be spearphished. I mean it. Everyone.

by busterarm 7y ago

naniwaduni 7y ago
Introducing an attack vector to get arbitrary people fired by policy can't possibly go wrong!
- stcredzero 7y ago
  That should be an Internet rule: Don't set up any mechanism that puts severe power in the hands of anonymous strangers. It will get exploited!
stcredzero 7y ago
My wife has 4 degrees, including a PhD from Stanford. She's working on another one. She got phished at work.
nradov 7y ago
No I can't be spearphished. Prove me wrong.
- umvi 7y ago
  Since you are making the more extraordinary claim, you need to provide evidence that your computer usage practices are 100% infallible to sophisticated attacks against you by people who know a lot about you.
  - 0xffff2 7y ago
    How do you prove this though? It's the classic "you can't prove a negative" scenario. I have no particular desire to associate this account with my real name or I would post my work email here just to let people try.
  - nradov 7y ago
    No I don't have to do that. The onus isn't on me. I don't know where you came up with such a silly idea.
    - busterarm 7y ago
      The historical record of confidence tricks goes back 400 years. Little changes. There's a con out there for everyone just like there's a lid for every pot.
      - nradov 7y ago
        Oh sure everyone can be vulnerable to certain cons. Fortunately all spear phishing attacks can be very easily avoided through technical means. I guess those who down voted me must be unfamiliar with the functionality available in current enterprise email systems.
        busterarm 7y ago
        That's great. Not all spearphishing comes in via email though. See Dark Caracal or Magic Hound for relevant history here. Also fraudulent invoices are another form of spearphishing that you'll still have a pretty hard time against. I don't know, I'm also on the operations side in a large enterprise and I help with our internal phishing efforts. Pretty sure I'm familiar with the same tools that you are and I vehemently disagree with your assessment.
swizzler 7y ago
A favorite example of mine even if it's contrived: https://twitter.com/sc00bzt/status/730903007014076416 https://twitter.com/sc00bzt/status/730903007014076416
- 52-6F-62 7y ago
  Oh that's funny!

Repeat after me: Everyone can be spearphished. I mean it. Everyone.

naniwaduni 7y ago

Introducing an attack vector to get arbitrary people fired by policy can't possibly go wrong!

stcredzero 7y ago
That should be an Internet rule: Don't set up any mechanism that puts severe power in the hands of anonymous strangers. It will get exploited!

stcredzero 7y ago

My wife has 4 degrees, including a PhD from Stanford. She's working on another one. She got phished at work.

nradov 7y ago

No I can't be spearphished. Prove me wrong.

umvi 7y ago
Since you are making the more extraordinary claim, you need to provide evidence that your computer usage practices are 100% infallible to sophisticated attacks against you by people who know a lot about you.
- 0xffff2 7y ago
  How do you prove this though? It's the classic "you can't prove a negative" scenario. I have no particular desire to associate this account with my real name or I would post my work email here just to let people try.
- nradov 7y ago
  No I don't have to do that. The onus isn't on me. I don't know where you came up with such a silly idea.
  - busterarm 7y ago
    The historical record of confidence tricks goes back 400 years. Little changes. There's a con out there for everyone just like there's a lid for every pot.
    - nradov 7y ago
      Oh sure everyone can be vulnerable to certain cons. Fortunately all spear phishing attacks can be very easily avoided through technical means. I guess those who down voted me must be unfamiliar with the functionality available in current enterprise email systems.
      - busterarm 7y ago
        That's great. Not all spearphishing comes in via email though. See Dark Caracal or Magic Hound for relevant history here. Also fraudulent invoices are another form of spearphishing that you'll still have a pretty hard time against. I don't know, I'm also on the operations side in a large enterprise and I help with our internal phishing efforts. Pretty sure I'm familiar with the same tools that you are and I vehemently disagree with your assessment.

swizzler 7y ago

A favorite example of mine even if it's contrived: https://twitter.com/sc00bzt/status/730903007014076416 https://twitter.com/sc00bzt/status/730903007014076416

52-6F-62 7y ago
Oh that's funny!