8 ms·
I'm a tech professional and security is a regular part of my jobs. At one point -- while contracting for a Fortune 500 client that shall remain unnamed -- I re
by maxk42 7y ago
I'm a tech professional and security is a regular part of my jobs. At one point -- while contracting for a Fortune 500 client that shall remain unnamed -- I received an email that was quite clearly phishing. Curious as to what the payload was and whether it was worth reporting, I fired up lynx and followed the link in the email from the command line.
I was promptly informed that I had failed the test and I would be receiving a formal reprimand.
Did that make the company more secure?
- Sohcahtoa82 7y agoDid you alter the URL at all? Every phishing test campaign I've seen has a URL in the form of like http://totallylegit.your-company.com/somePath/login?id=12345678 http://totallylegit.your-company.com/somePath/login?id=12345.... I'd change the id= to some other value before testing to mess with their tracking.
- grimjack00 7y agoUnless you're certain how that ID is generated and/or linked to your identity, you've probably just put someone else at your company on the naughty list.
- barbecue_sauce 7y ago"We just got a new alert that an employee fell for the phishing attempt!" "But... this employee has been dead for 20 years..."
- csours 7y agoSeems like you should just hit all the IDs to be safe. Or put your own personalized message in the ID parameter. id=SSBsaWtlIFN3ZWRpc2ggUGhpc2g
- Sohcahtoa82 7y agoJust change it something incredibly unlikely. Like "id=1".
- paulmd 7y agoBe a good guy greg and write a quick curl script to hit all 25k other links. If everyone is in trouble then no one is in trouble!
- dboat 7y agoPresumably you were able to explain your case and have the reprimand expunged from your record. As long as they are reasonable in that way I don't think occasionally testing the people handling sensitive data is a bad idea.
- dvtrn 7y agoShould it be expunged though? They've indicated they were aware it was quite clearly a phishing attempt, but they still accessed the link. If the test was to see if a user would try accessing the link, then this user failed the test. Why should that be expunged? Curiosity shouldn't preclude security, and intent shouldn't preclude policy if the operator operated knowingly. This isn't to attack maxk42, but to engage the question head on.
- Dylan16807 7y agoThe goal is "don't be phished", right? Measuring http requests is a proxy for that, and not a completely accurate one.
- closeparen 7y ago> intent shouldn't preclude policy Oh boy, I hope I never work in this kind of organization.
- dvtrn 7y agoI was hoping implicit in this statement, along with other contexts offered that this would have been read with "information security" in mind, on me to communicate that better next time.
- overgard 7y agoI think a better idea for the person involved is to work at a company that isn't run by self-serious bureaucrats.
- ryanjshaw 7y agoCan't speak to whether a reprimand is warranted or not and I think many here will disagree, but unless your job is investigating phishing, you shouldn't do this because you ARE ultimately putting the corporate network at risk unnecessarily - what if it was a real link and happened to exploit a zero day on your box? Management wouldn't accept your reasoning for following the link I suspect.
- Dylan16807 7y agoThe risk of hitting an exploit on the command line, especially with something like wget, is enough orders of magnitude lower that I think it falls under acceptable. The standard cannot be zero risk because that's impossible. Even shutting off the internet link doesn't get you all the way to zero.
- kss238 7y agoThe issue isn't how much risk there is in opening it. The problem is that regardless of how much or little risk there is in opening the link, it wasn't op's job to examine it. It was unnecessary risk to open the link.
- Dylan16807 7y agoIt's unnecessary to look at something on imgur, too, but that doesn't mean you should get reprimanded if that causes a hack somehow.
- cloacaFaec 7y agoit wasn't op's job to examine it Your brand of narrow minded thinking is... Well? Let's just call it pathetic. A brain dead employee, following the letter of the law, by the book, to the bitter end, is, by many orders of magnitude, a greater liability than one that assesses risk and adopts personal responsibility to further investigate a hazard, before taking additional action. Let's say you have an employee, and they smell smoke, but they aren't the fire warden so they ignore it. Not their responsibility. Instead, they go on lunch break. The fire spreads. The building burns to the ground. Would you be happy that they stayed in their little box, kept their head down, and avoided engaging with a potential hazard? Before you answer, I bet you're already locked and loaded to distinguish "fire" as a completely different class of circumstances. And you know what? You'll be completely fucking wrong about that, no matter how you try to twist words and wriggle out of the truth.
- dearrifling 7y agoCounting opening a mail as failing is ridiculous. A a phising test should only count captured logins.
- Scoundreller 7y agoWhen I see one of these, I actually do go onto my Corp iPhone to delete the email instead of Outlook/Windows. It may not be a perfect approach since we do use it for MFA...
- Kalium 7y agoFollowing a link can readily enough expose someone to risks. Phishing isn't always just about entering logins.
- dearrifling 7y agoThat's true for any email, not just phising. Unless you can verify and trust all senders.
- Kalium 7y agoYup. This is why people are taught not to click links in emails for things like banking. It's a dangerous world out there, even for seemingly innocuous things.
- alkonaut 7y agoIf I’m curious I’ll open the link off the company network. Easiest way I can think of is just opening with a browser on my private iPhone while on a 4G connection.
- chelmzy 7y agoIt would still trigger the fail. Typically the link contains an identifier and the landing page is hosted on a public facing web server.
- alkonaut 7y agoYeah - I’d be wary of doing it without changing the parameters for that reason. But obviously you can’t check a link without checking a link. It would also be interesting to hear whether someone actually considers me to have failed anything when visiting a (faux) attacker’s link on my own device off the company network and entering no credentials.
- Scoundreller 7y agoThey’re probably not that advanced with it. If anything, you’ll upset IT with extra paperwork to grant you the exemption from the hit.
- greedo 7y agoI wonder what happens when a bot crawls one of the phishing sites and triggers all the unique links...
- alkonaut 7y agoNext time I’ll try that. Hit all the Id’s but my own and take the day off when everyone else is sent to reeducation camp.
- goguy 7y agoThe fact you visited the link would let them know that company x has an current employee named y. Whilst that information might not be sensitive it could be used at a later date to extract sensitive company information.
- thrower123 7y agoThey could also look you up on LinkedIn. There should be a line drawn between real security-conscious workplaces, and the kind of self-important chickenshit places that seem to delight in playing games and harassing their employees with this kind of thing.
- megaremote 7y agoYes, it does. You should have been let go.
- overgard 7y agoReally, you'd fire every engineer that shows an ounce of curiosity? I'm glad I don't work where you work.