5 ms·

Can't speak to whether a reprimand is warranted or not and I think many here will disagree, but unless your job is investigating phishing, you shouldn't do this

Can't speak to whether a reprimand is warranted or not and I think many here will disagree, but unless your job is investigating phishing, you shouldn't do this because you ARE ultimately putting the corporate network at risk unnecessarily - what if it was a real link and happened to exploit a zero day on your box? Management wouldn't accept your reasoning for following the link I suspect.

Dylan16807 7y ago
The risk of hitting an exploit on the command line, especially with something like wget, is enough orders of magnitude lower that I think it falls under acceptable. The standard cannot be zero risk because that's impossible. Even shutting off the internet link doesn't get you all the way to zero.
- kss238 7y ago
  The issue isn't how much risk there is in opening it. The problem is that regardless of how much or little risk there is in opening the link, it wasn't op's job to examine it. It was unnecessary risk to open the link.
  - Dylan16807 7y ago
    It's unnecessary to look at something on imgur, too, but that doesn't mean you should get reprimanded if that causes a hack somehow.
  - cloacaFaec 7y ago
    it wasn't op's job to examine it Your brand of narrow minded thinking is... Well? Let's just call it pathetic. A brain dead employee, following the letter of the law, by the book, to the bitter end, is, by many orders of magnitude, a greater liability than one that assesses risk and adopts personal responsibility to further investigate a hazard, before taking additional action. Let's say you have an employee, and they smell smoke, but they aren't the fire warden so they ignore it. Not their responsibility. Instead, they go on lunch break. The fire spreads. The building burns to the ground. Would you be happy that they stayed in their little box, kept their head down, and avoided engaging with a potential hazard? Before you answer, I bet you're already locked and loaded to distinguish "fire" as a completely different class of circumstances. And you know what? You'll be completely fucking wrong about that, no matter how you try to twist words and wriggle out of the truth.
  - overgard 7y ago
    I mean, it's not my job to refill the office coffee pot when I take the last cup of coffee, either, but since I'm decent to my coworkers I'd probably do it. Not the OP, but since I know how to open a malicious link safely in wget I would happily do that for similar reasons, and if I got reprimanded for it "not being my job"... I'd start looking for a new job where I'm respected for what I'm able to do.
jsty 7y ago
Considering that from what I recall Lynx doesn't execute javascript, it would have to be one esoteric zero-day
- onion2k 7y ago
  Downloading and executing code is only one way a browser session can be abused. At the very least you're giving away everything your browser (even Lynx) puts in the headers of a request. That's often a heck of a lot of useful information for an attacker. Lynx supports cookies too so it would be possible to track a user between sessions. I don't know how that might benefit an attacker but I'm not an attacker[1]. I think a reasonably paranoid approach like "Hackers might think of ways to abuse this that I haven't thought of" is best. Unless your job is to take a risk and visit a phishing site, don't take the risk. Even with Lynx. [1] Exactly what an attacker would say!
  - BeetleB 7y ago
    >At the very least you're giving away everything your browser (even Lynx) puts in the headers of a request. Which you're giving away any time you browse any external web site. >Lynx supports cookies too so it would be possible to track a user between sessions. You're downloading cookies for most external web sites. If the worst you do is the same as going to espn.com, then reprimand people for going to any external web site.
    - onion2k 7y ago
      The point is that you're giving data to a known phishing site by visiting the link in a phishing email. It's true that ESPN might also be a phishing site but it's less likely.
      - BeetleB 7y ago
        And my point is the data you're giving is not important.
  - Scoundreller 7y ago
MisterTea 7y ago
I doubt most if not all exploits would work in lynx/links. But your point is spot on, don't take it upon yourself to do things that aren't in your job description. Otherwise you become that person who takes it upon themselves to "fix" things and makes the problem worse for the people responsible for fixing things.
- Scoundreller 7y ago
  When I got outed for doing that, I got a thank you card. I made my own signs for wayfinding (Main Building ——>, and “Floor 7” when the stairwell was missing it). Some are still up a few years later.
- overgard 7y ago
  > don't take it upon yourself to do things that aren't in your job description That's a great way to never go anywhere in your career.
maxk42 7y ago
My job is not investigating phishing but security is everyone's job. Reporting what was obviously a targeted phishing attack to the people who do investigate phishing is a basic expectation. Now before you try to tell me "well you should've forwarded the email and been done with it" those guys are going to be pissed as fuck if I pass along every spam link trying to sell me boner pills, so I've got a duty to make sure it's a credible threat. As somebody who knows how to safely investigate such a link and did exactly that it was ridiculous to be penalized. Security (albeit not for email) is a part of my job. I don't think people should be trained not to use their brains when it comes to security threats. If people used their brains more often phishing would hardly be a problem to begin with.
- thomasdub 7y ago
  "Now before you try to tell me "well you should've forwarded the email and been done with it" those guys are going to be pissed as fuck if I pass along every spam link trying to sell me boner pills" I know you say the team would be pissed, but it's actually the exact opposite! Firstly, most sophisticated companies have automated the abuse inbox management process, but even when it's not automated, I'd rather 100 easily ignorable reports about boner pills than one person not send an actual spear-phishing email. Plus we can use the generic spam reports to better train our spam filters so please do keep sending them, even the Nigerian prince stuff.

Dylan16807 7y ago

The risk of hitting an exploit on the command line, especially with something like wget, is enough orders of magnitude lower that I think it falls under acceptable. The standard cannot be zero risk because that's impossible. Even shutting off the internet link doesn't get you all the way to zero.

kss238 7y ago
The issue isn't how much risk there is in opening it. The problem is that regardless of how much or little risk there is in opening the link, it wasn't op's job to examine it. It was unnecessary risk to open the link.
- Dylan16807 7y ago
  It's unnecessary to look at something on imgur, too, but that doesn't mean you should get reprimanded if that causes a hack somehow.
- cloacaFaec 7y ago
  it wasn't op's job to examine it Your brand of narrow minded thinking is... Well? Let's just call it pathetic. A brain dead employee, following the letter of the law, by the book, to the bitter end, is, by many orders of magnitude, a greater liability than one that assesses risk and adopts personal responsibility to further investigate a hazard, before taking additional action. Let's say you have an employee, and they smell smoke, but they aren't the fire warden so they ignore it. Not their responsibility. Instead, they go on lunch break. The fire spreads. The building burns to the ground. Would you be happy that they stayed in their little box, kept their head down, and avoided engaging with a potential hazard? Before you answer, I bet you're already locked and loaded to distinguish "fire" as a completely different class of circumstances. And you know what? You'll be completely fucking wrong about that, no matter how you try to twist words and wriggle out of the truth.
- overgard 7y ago
  I mean, it's not my job to refill the office coffee pot when I take the last cup of coffee, either, but since I'm decent to my coworkers I'd probably do it. Not the OP, but since I know how to open a malicious link safely in wget I would happily do that for similar reasons, and if I got reprimanded for it "not being my job"... I'd start looking for a new job where I'm respected for what I'm able to do.

jsty 7y ago

Considering that from what I recall Lynx doesn't execute javascript, it would have to be one esoteric zero-day

onion2k 7y ago
Downloading and executing code is only one way a browser session can be abused. At the very least you're giving away everything your browser (even Lynx) puts in the headers of a request. That's often a heck of a lot of useful information for an attacker. Lynx supports cookies too so it would be possible to track a user between sessions. I don't know how that might benefit an attacker but I'm not an attacker[1]. I think a reasonably paranoid approach like "Hackers might think of ways to abuse this that I haven't thought of" is best. Unless your job is to take a risk and visit a phishing site, don't take the risk. Even with Lynx. [1] Exactly what an attacker would say!
- BeetleB 7y ago
  >At the very least you're giving away everything your browser (even Lynx) puts in the headers of a request. Which you're giving away any time you browse any external web site. >Lynx supports cookies too so it would be possible to track a user between sessions. You're downloading cookies for most external web sites. If the worst you do is the same as going to espn.com, then reprimand people for going to any external web site.
  - onion2k 7y ago
    The point is that you're giving data to a known phishing site by visiting the link in a phishing email. It's true that ESPN might also be a phishing site but it's less likely.
    - BeetleB 7y ago
      And my point is the data you're giving is not important.
- Scoundreller 7y ago

MisterTea 7y ago

I doubt most if not all exploits would work in lynx/links. But your point is spot on, don't take it upon yourself to do things that aren't in your job description. Otherwise you become that person who takes it upon themselves to "fix" things and makes the problem worse for the people responsible for fixing things.

Scoundreller 7y ago
When I got outed for doing that, I got a thank you card. I made my own signs for wayfinding (Main Building ——>, and “Floor 7” when the stairwell was missing it). Some are still up a few years later.
overgard 7y ago
> don't take it upon yourself to do things that aren't in your job description That's a great way to never go anywhere in your career.

maxk42 7y ago

My job is not investigating phishing but security is everyone's job. Reporting what was obviously a targeted phishing attack to the people who do investigate phishing is a basic expectation. Now before you try to tell me "well you should've forwarded the email and been done with it" those guys are going to be pissed as fuck if I pass along every spam link trying to sell me boner pills, so I've got a duty to make sure it's a credible threat. As somebody who knows how to safely investigate such a link and did exactly that it was ridiculous to be penalized. Security (albeit not for email) is a part of my job. I don't think people should be trained not to use their brains when it comes to security threats. If people used their brains more often phishing would hardly be a problem to begin with.

thomasdub 7y ago
"Now before you try to tell me "well you should've forwarded the email and been done with it" those guys are going to be pissed as fuck if I pass along every spam link trying to sell me boner pills" I know you say the team would be pissed, but it's actually the exact opposite! Firstly, most sophisticated companies have automated the abuse inbox management process, but even when it's not automated, I'd rather 100 easily ignorable reports about boner pills than one person not send an actual spear-phishing email. Plus we can use the generic spam reports to better train our spam filters so please do keep sending them, even the Nigerian prince stuff.