4 ms·
> If you're being asked for data by someone you don't know That's not how spear phishing or even phishing works. The email looks like it came from a fellow em
by josefresco 7y ago
> If you're being asked for data by someone you don't know
That's not how spear phishing or even phishing works. The email looks like it came from a fellow employee/boss/trusted party.
- Endy 7y agoWhat about the sending and reply-to address? If the account is actually compromised at a system level, that is an IT issue. Again, are people so trusting that they don't check when asked for confidential data?
- kaffeemitsahne 7y agoSending addresses can be spoofed.
- sh-run 7y agoEnd users should never see emails that fail DKIM or SPF checks. Sender address spoofing is a solved problem. If a company gets owned because they failed to implement SPF or DKIM properly, IT is at fault, not the employee.
- jkeuhlen 7y agoBut wouldn't you reply to the address it specified instead of the source of the spoofing? I thought that was why most phishing emails include a link rather than asking you to reply.
- bluGill 7y agoFrom and reply-to looks just like your company unless you catch the misspelling. "l" and "I" in the domain name go to different companies, but when everything else in the email looks just like any other email from IT you aren't going to notice that small difference - you probably won't even read the from/reply lines.
- the_snooze 7y agoThe address doesn't matter in some of these scams. It could be a message spoofed from your boss's real email address saying, "Hey Sam, I sent you the wrong account we need to wire money to. It's actually 123456. Can you fix that ASAP? Thanks!"
- nradov 7y agoThat's only true if you have a shitty enterprise email system. On a proper system such spear phishing attempts are blocked before reaching end users, or at least immediately obvious to anyone paying attention.
- alex_anglin 7y agoWith no false negatives, right?
- nradov 7y agoRight, no false negatives. It's trivial to determine whether a message purporting to come from one of your corporate domains was actually sent through an authorized internal server. Plus the IM integration in Outlook makes it super obvious which messages came from legitimate internal senders and which did not.