5 ms·

How hard is it to make people understand what a business email should or shouldn't include? If you're being asked for data by someone you don't know, either ask

by Endy 7y ago

How hard is it to make people understand what a business email should or shouldn't include? If you're being asked for data by someone you don't know, either ask a manager or someone connected to the account in question. Are people really so gullible & trusting?

josefresco 7y ago
> If you're being asked for data by someone you don't know That's not how spear phishing or even phishing works. The email looks like it came from a fellow employee/boss/trusted party.
- Endy 7y ago
  What about the sending and reply-to address? If the account is actually compromised at a system level, that is an IT issue. Again, are people so trusting that they don't check when asked for confidential data?
  - kaffeemitsahne 7y ago
    Sending addresses can be spoofed.
    - sh-run 7y ago
      End users should never see emails that fail DKIM or SPF checks. Sender address spoofing is a solved problem. If a company gets owned because they failed to implement SPF or DKIM properly, IT is at fault, not the employee.
    - jkeuhlen 7y ago
      But wouldn't you reply to the address it specified instead of the source of the spoofing? I thought that was why most phishing emails include a link rather than asking you to reply.
  - bluGill 7y ago
    From and reply-to looks just like your company unless you catch the misspelling. "l" and "I" in the domain name go to different companies, but when everything else in the email looks just like any other email from IT you aren't going to notice that small difference - you probably won't even read the from/reply lines.
  - the_snooze 7y ago
    The address doesn't matter in some of these scams. It could be a message spoofed from your boss's real email address saying, "Hey Sam, I sent you the wrong account we need to wire money to. It's actually 123456. Can you fix that ASAP? Thanks!"
- nradov 7y ago
  That's only true if you have a shitty enterprise email system. On a proper system such spear phishing attempts are blocked before reaching end users, or at least immediately obvious to anyone paying attention.
  - alex_anglin 7y ago
    With no false negatives, right?
    - nradov 7y ago
      Right, no false negatives. It's trivial to determine whether a message purporting to come from one of your corporate domains was actually sent through an authorized internal server. Plus the IM integration in Outlook makes it super obvious which messages came from legitimate internal senders and which did not.
jquinby 7y ago
What about an email from someone you know (coworker, relative) via a spoofed or compromised account?
- Endy 7y ago
  I learned to look at reply-to back when I used Juno & Netscape Communicator. Heck, Communicator used to warn you if reply-to differed from the displayed name.
xvector 7y ago
> Are people really so gullible & trusting? Yes, and it is not a “bad” thing outside the niche of security I think. We should all hope to live a life where we can implicitly trust other human beings.
- stcredzero 7y ago
  In small town America in the 70's and 80's of my childhood, life was pretty darn close to this.
galangalalgol 7y ago
The tests I have seen are more like a macro enabled office document attatched to an email that says it is from an address actually on the corporate email server. And it has a line like "review my schedule update, a week less for test creation is fine right?". Except I don't work with the sender and the corporate firewall as marked as having actually been sent from outside.
oceanghost 7y ago
Have you ever worked for a big company? (Think several US offices, half a dozen European and Asian offices, 500m in revenue). Someone forwards me an e-mail from our Dutch office that says, essentially, "The world is burning down, we are boarding a plane in a couple of hours to go to IFA (show), and we don't have the latest copy of product X to demo for customers." I do builds by hand of this product because I can't get resources allocated to automate it I have never heard of any of these people before. I reply asking, "I am sure I can accommodate you, but, Who are you and why I haven't been told about this before now?" To my shock, the guy replies, "I'm the European Vice President for product X, we didn't ask before now because it has never been a problem in the past. Who are you?" I reply, "I'm the only person in the entire world with the encryption keys to provision the product, and that has to be done on one single computer in Santa Ana. It's only a fluke that I am here today-- my car wouldn't start this morning, and I had planned to take the day off to fix it, and then by some miracle an hour later it started. That's why it's important to know about things ahead of time." That's what working at a big organization is like, you interact with people who don't know all the time. And frankly, nobody is ever allocated time for "security" in their schedule. My dance card at that company was scheduled for 8 hours of development a day, no e-mail answering, no security, no time to do the build system. No time for meetings. Nothing.
- 0xffff2 7y ago
  Maybe that's how it is at your big organization. I'm sure glad my big organization is different.
  - oceanghost 7y ago
    I suspect the world runs on more chaos than anyone would like to believe. But when your big org is hiring, let me know :)
    - Endy 7y ago
      Hail Eris.
- ben509 7y ago
nucleardog 7y ago
> If you're being asked for data by someone you don't know, either ask a manager or someone connected to the account in question. Most cases I've seen of successful (or nearly successful) spearphishing would have been solved by someone picking up a phone and calling their co-worker. "I know you sent me an email, but can you just explain again why you want me to buy $1000 in iTunes gift cards and email them to you?" "I got that invoice you sent. Just wanted to confirm the amounts -- $50k wire transfer?"
Nasrudith 7y ago
I suspect hiring practices and company culture may be selecting for gullability either accidentally or deliberately in many cases (cynically the gullible are easier to motivate cheaply). Like how "being a team player" is used to refer to willingness to work unpaid overtime as opposed to actual ability to cooperate. If they value "responsiveness to their authority over procedure" then people will send the entire financial records to "the CEO" for fear of getting fired otherwise.
ben509 7y ago
The trouble is that people have a ton of intuitive buttons to push, and being intuitive they're not usually aware of them. (In straight cons, the buttons are often emotional, which is why the term con comes from building "confidence." Phishing is more faking authenticity than appealing to emotion.) Skepticism and rational thinking require effort, and thus as people are rushed or tired, those are the first defenses to fail. You can train to recognize patterns of phishing, but learning those patterns takes time, repetition and effort. All that a good phish requires is finding the right buttons to push on the right person, and they have many potential victims to press them on, and little to no consequence to getting it wrong. So, the answer is people are not particularly gullible, but the weak links are a constantly changing, largely unknown dynamic and the phishers can hammer at all of them simultaneously until they get through.

by Endy 7y ago

josefresco 7y ago

> If you're being asked for data by someone you don't know That's not how spear phishing or even phishing works. The email looks like it came from a fellow employee/boss/trusted party.

Endy 7y ago
What about the sending and reply-to address? If the account is actually compromised at a system level, that is an IT issue. Again, are people so trusting that they don't check when asked for confidential data?
- kaffeemitsahne 7y ago
  Sending addresses can be spoofed.
  - sh-run 7y ago
    End users should never see emails that fail DKIM or SPF checks. Sender address spoofing is a solved problem. If a company gets owned because they failed to implement SPF or DKIM properly, IT is at fault, not the employee.
  - jkeuhlen 7y ago
    But wouldn't you reply to the address it specified instead of the source of the spoofing? I thought that was why most phishing emails include a link rather than asking you to reply.
- bluGill 7y ago
  From and reply-to looks just like your company unless you catch the misspelling. "l" and "I" in the domain name go to different companies, but when everything else in the email looks just like any other email from IT you aren't going to notice that small difference - you probably won't even read the from/reply lines.
- the_snooze 7y ago
  The address doesn't matter in some of these scams. It could be a message spoofed from your boss's real email address saying, "Hey Sam, I sent you the wrong account we need to wire money to. It's actually 123456. Can you fix that ASAP? Thanks!"
nradov 7y ago
That's only true if you have a shitty enterprise email system. On a proper system such spear phishing attempts are blocked before reaching end users, or at least immediately obvious to anyone paying attention.
- alex_anglin 7y ago
  With no false negatives, right?
  - nradov 7y ago
    Right, no false negatives. It's trivial to determine whether a message purporting to come from one of your corporate domains was actually sent through an authorized internal server. Plus the IM integration in Outlook makes it super obvious which messages came from legitimate internal senders and which did not.

jquinby 7y ago

What about an email from someone you know (coworker, relative) via a spoofed or compromised account?

Endy 7y ago
I learned to look at reply-to back when I used Juno & Netscape Communicator. Heck, Communicator used to warn you if reply-to differed from the displayed name.

xvector 7y ago

> Are people really so gullible & trusting? Yes, and it is not a “bad” thing outside the niche of security I think. We should all hope to live a life where we can implicitly trust other human beings.

stcredzero 7y ago
In small town America in the 70's and 80's of my childhood, life was pretty darn close to this.

galangalalgol 7y ago

The tests I have seen are more like a macro enabled office document attatched to an email that says it is from an address actually on the corporate email server. And it has a line like "review my schedule update, a week less for test creation is fine right?". Except I don't work with the sender and the corporate firewall as marked as having actually been sent from outside.

oceanghost 7y ago

Have you ever worked for a big company? (Think several US offices, half a dozen European and Asian offices, 500m in revenue). Someone forwards me an e-mail from our Dutch office that says, essentially, "The world is burning down, we are boarding a plane in a couple of hours to go to IFA (show), and we don't have the latest copy of product X to demo for customers." I do builds by hand of this product because I can't get resources allocated to automate it I have never heard of any of these people before. I reply asking, "I am sure I can accommodate you, but, Who are you and why I haven't been told about this before now?" To my shock, the guy replies, "I'm the European Vice President for product X, we didn't ask before now because it has never been a problem in the past. Who are you?" I reply, "I'm the only person in the entire world with the encryption keys to provision the product, and that has to be done on one single computer in Santa Ana. It's only a fluke that I am here today-- my car wouldn't start this morning, and I had planned to take the day off to fix it, and then by some miracle an hour later it started. That's why it's important to know about things ahead of time." That's what working at a big organization is like, you interact with people who don't know all the time. And frankly, nobody is ever allocated time for "security" in their schedule. My dance card at that company was scheduled for 8 hours of development a day, no e-mail answering, no security, no time to do the build system. No time for meetings. Nothing.

0xffff2 7y ago
Maybe that's how it is at your big organization. I'm sure glad my big organization is different.
- oceanghost 7y ago
  I suspect the world runs on more chaos than anyone would like to believe. But when your big org is hiring, let me know :)
  - Endy 7y ago
    Hail Eris.
ben509 7y ago

nucleardog 7y ago

> If you're being asked for data by someone you don't know, either ask a manager or someone connected to the account in question. Most cases I've seen of successful (or nearly successful) spearphishing would have been solved by someone picking up a phone and calling their co-worker. "I know you sent me an email, but can you just explain again why you want me to buy $1000 in iTunes gift cards and email them to you?" "I got that invoice you sent. Just wanted to confirm the amounts -- $50k wire transfer?"

Nasrudith 7y ago

I suspect hiring practices and company culture may be selecting for gullability either accidentally or deliberately in many cases (cynically the gullible are easier to motivate cheaply). Like how "being a team player" is used to refer to willingness to work unpaid overtime as opposed to actual ability to cooperate. If they value "responsiveness to their authority over procedure" then people will send the entire financial records to "the CEO" for fear of getting fired otherwise.

ben509 7y ago

The trouble is that people have a ton of intuitive buttons to push, and being intuitive they're not usually aware of them. (In straight cons, the buttons are often emotional, which is why the term con comes from building "confidence." Phishing is more faking authenticity than appealing to emotion.) Skepticism and rational thinking require effort, and thus as people are rushed or tired, those are the first defenses to fail. You can train to recognize patterns of phishing, but learning those patterns takes time, repetition and effort. All that a good phish requires is finding the right buttons to push on the right person, and they have many potential victims to press them on, and little to no consequence to getting it wrong. So, the answer is people are not particularly gullible, but the weak links are a constantly changing, largely unknown dynamic and the phishers can hammer at all of them simultaneously until they get through.