18 ms·

GoDaddy employees told they were getting a holiday bonus in a phishing test

199 points by arkadiyt 6y ago

damm 6y ago
.... They didn't fail the test. They are having hard times and thought they were getting a holiday bonus which does happen. Where/Why they failed is because times are tough and if all you had to do is fill out a form for 650$ would you really not do it? It's not awareness it's people are effed and struggling
- burnthrow 6y ago
  In summary, they failed the test.
  - acdha 6y ago
    Alternatively, GoDaddy has failed to secure their work environment and are blaming the workers instead. Think about why we care about phishing: it’s mostly about people giving credentials to an attacker. Drop $20/person on some FIDO tokens and the risk factor drops considerably. Repeat for the risk of malware - if someone in accounting can run arbitrary software, they aren’t the root cause.
    - kenjackson 6y ago
      It’s defense in depth. Just because you have one line of defense doesn’t mean you shouldn’t have another. The way defense in depth typically works is assuming the previous lines of defense have been thwarted. Even if you can’t foresee that happening, assume it did. And it sounds like these employees were trained on this. The thing I don’t like is the XMas bonus aspect. But the general idea doesn’t seem unreasonable.
      - acdha 6y ago
        How much depth is it really adding, though? Harassing non-specialists seems to have relatively limited value – plenty of security staff get phished – and there is a risk of making people think of the security group as adversaries. I would certainly agree that the exercise could have some value but I think it would be wise to weigh that against the costs and especially to think about how you can make it supportive rather than punitive. In particular, most people are not only not given good tools for making untrained security decisions and many of them will be told to violate that advice regularly. For example, what percentage of vendors, outsourced HR, etc. will tell people to open unexpected attachments or click on links which are difficult to distinguish from phishing? SolarWinds was far from the only company training their customers to ignore security errors on installers, too.
    - at-fates-hands 6y ago
      > Alternatively, GoDaddy has failed to secure their work environment and are blaming the workers instead. This. I've worked at careless companies who don't deal with their security very well. I now work at a large health care company who takes security incredibly serious. All the USB ports are disabled. Nobody has admin rights on their laptops. You can't install any software unless you download and install from their internal app store which only allows apps that have passed a rigorous gambit of testing beforehand. And you have to put in a request for the software in the first place. It took me three months to get Photoshop approved because I was designated as a developer and not a web designer. It went through three escalations and took several debates between senior managers who finally approved my request. We don't have "phishing tests". If something pops up on the security team's radar, then they push it out as an email alert company wide. That's about it. Maybe if GoDaddy put as much effort into securing their network as they do putting together these stupid tests, they probably wouldn't need them to prove that yes, humans are fallible.
      - btilly 6y ago
        I'm sorry, but your 3 months to get Photoshop approved demonstrates why so many wouldn't want to work in such locked down environments. And what was the cost to the company in having those debates between senior managers? Just to get a standard tool that they already approved onto a developer machine? Can you imagine the overhead that they are causing themselves?
- NullPrefix 6y ago
  They failed the test the moment they started working at godaddy.
- DoofusOfDeath 6y ago
  I'm not sure I follow your logic. IIUC, a traditional phishing test involves: (a) Prior training for what employees are supposed to look for, and how to respond if they think they're being phished. (b) Unannounced drills to confirm that employees act in accordance to (a). If some GoDaddy employees did not act in accordance to the training, how is that anything but a failed test? [EDIT] I just realized that "how is that anything but a failed test" could sound reductive. FWIW, I would call this a test failure and also a really unwise test design.
  - jldugger 6y ago
    Honestly, blaming the employee here is the fallacy. Employees don't fail phishing tests, companies do.
- lazylizard 6y ago
  if they're still employed at godaddy why are they having hard times? if they're greedy for an extra $650 windfall... thats what a real phish will dangle as well?
  - notgoodrobot 6y ago
    Many people have spouses out of work right now. It's possible to have a job and be in a bad situation. Regardless of whether the employees actually need a bonus. Dangling the idea of a bonus as a test, shortly before the holidays and during a pandemic seems like a recipe for bad publicity or at least some frustrated employees.
- lawnchair_larry 6y ago
  What makes you think GoDaddy employees are struggling financially? They all have their jobs, and their costs are likely lower than pre-pandemic. Many are suffering and unable to work, but that wouldn’t include this set of people.
mikece 6y ago
This is hilarious but GoDaddy is going to be dealing with a lot of very pissed off employees because of this.
- kibwen 6y ago
  Seriously, this has to be satire, right? It's straight out of National Lampoon's Christmas Vacation. If true, then "what a cheap, lying, no-good, rotten, four-flushing, low-life, snake-licking, dirt-eating, inbred, overstuffed, ignorant, blood-sucking, dog-kissing, brainless, dickless, hopeless, heartless, fat-ass, bug-eyed, stiff-legged, spotty-lipped, worm-headed sack of monkey shit" company.
deleted 6y ago
[deleted]
selykg 6y ago
I’m so glad I don’t use GoDaddy. What a scummy company.
- acdha 6y ago
  They’ve been like this for ages, too, and there are so many better competitors.
DoofusOfDeath 6y ago
I'm curious if GoDaddy is setting itself up for a lawsuit from employees. IANAL, but I could imagine a court interpreting this as a promise for compensation.
- nickff 6y ago
  Would all pentests be regarded the same way? The most extreme example (I can think of) would be that the company gets a pentester to attempt to bribe employees to disclose privileged materials to an apparently unprivileged person. Would you see this 'as a promise for compensation'?
  - joecot 6y ago
    Do you consider: a) Being gifted a TV by a friend b) Someone telling you they'll help you steal a TV from your friend's house To be the same thing? Because one involves a perfectly reasonable and legal promise, and one does not. If you can't tell the difference, remind me not to invite you over.
    - otterley 6y ago
      An undelivered gift is not a contract. This is covered in first-year contract law.
      - joecot 6y ago
        While that may be the case, an undelivered gift is still worlds different than an undelivered bribe.
        otterley 6y ago
        I'm not sure what your point is.
        joecot 6y ago
tsimionescu 6y ago
I wonder what sociopath came up with this idea for a phishing test. It seems incredibly insensitive given the minute amount of difference it is likely to make - the way to tell a phishing email from a non-phishing email depends much more on the metadata than the actual contents, so there's no reason to play with people's emotions like this. Even the employees who immediately recognized it as phishing will have felt the disappointment.
- leetcrew 6y ago
  > the way to tell a phishing email from a non-phishing email depends much more on the metadata than the actual contents this is true, but people are also much more likely to skip the rational analysis step if the contents elicit an emotional response. it's hard do to an effective test without some sort of emotional and/or time sensitive call to action. I certainly agree it is cruel to tease employees with a fake bonus. but if they turned around and actually paid a holiday bonus in the same amount, I would say no harm was done ultimately.
superseeplus 6y ago
Are there any indications that the email is even a phishing email? The email is from an internal address. Do they mean to say that their internal email system can’t detect fake emails purporting to be from an internal address? This is cruel in multiple ways. Promising a non existent bonus and then blaming employees for failing a phishing test (which is not even a real phishing email or exposes deep seated IT inadequacies). Presumably this goes on their performance report too.
- agotterer 6y ago
  I was thinking the same thing. You shouldn’t fail by clicking a link sent by an internal email address. If the link took you to an external site and you entered your GoDaddy credentials or provided personal information, that might be a different story.
  - chris11 6y ago
    Entering personal info might also be understandable. My employer gives a Christmas gift. This year they asked us to update a form with our temporary address if we were in a different location.
    - vitus 6y ago
      Absolutely, in the context of a physical item being shipped to you (especially if they can't just distribute it at the office), if it's not through payroll. (e.g. we had site-specific fun events in lieu of the annual holiday party) But a cash bonus? That's the epitome of something that 1) should go through payroll and 2) should just get direct-deposited into your bank account as is the case with your regular paycheck. There's no reason why you'd need to provide any additional info.
  - vitus 6y ago
    > You shouldn’t fail by clicking a link sent by an internal email address. I disagree in making this broad of a claim -- insider threats are certainly an issue. And as a sibling commenter points out, email headers are easily spoofed. I'm not condoning GoDaddy's pentest (agreed with everyone else who sees this as a cruel prank), but also, um, why would you click a link if your company is telling you they're going to pay you a bonus? Wouldn't that just go through payroll as with everything else? edit: it looks like the phishing email provided the bonus as an opt-in? yeah, that ought to raise red flags that it's not just being applied across the board, but still, it's been a tough year, so people might not think as hard about it.
Animats 6y ago
What gets me is companies sending out legit emails that look like phishing attacks. I got one from one of the big banks, asking me to click on a link to get some benefit. I assumed it was a phish, but after a close look at the headers, it really was from the bank's usual server. I sent a note to the security incident report address for the bank, telling them they're training their users to click on phishing emails. They sent back some noncommittal answer.
- bloodorange 6y ago
  The only way to get them to make a reasonable response to these things is to make a redacted screenshot and shame them publicly on social media. Otherwise, your email is just an annoyance for someone who (perhaps proudly?) thinks "these customers think they are experts when we have a whole team dealing with security".
- dmix 6y ago
  Marketing teams at companies are always a risk vector for security IMO and their practices should be looked at by infosec people. Not just concerned citizens (but thank you for spending your time trying to help). I've seen some wonky stuff being put out by them and they are oblivious. As their work often crosses the line into actual web-dev stuff that has security implications. ie, landing pages and emails. And not 2FAing the countless marketing tools they use nor letting the more experienced devs know what they are up to.
- vegetablepotpie 6y ago
  It happens all the time at my work place. I work at a big company and I get emails from random people in the company to go to submit info to random places on the Internet, usually related to employee benefits or surveys. I always report them as suspicious and move on with my work. Once in a while you'll see a follow up email from the sender saying that they are aware of many people reporting the email as a phishing attempt and that reporting the email was wrong and that link to that particular website is a company approved tool and that employees are required to complete the survey at the link for some department or center's benefit. This wouldn't be a problem if we had internal websites with standard tools like a survey builder and such, but getting our IT contractor in my org to do the basic functions of their jobs takes a herculean effort, getting them to support a basic internal tool would be a multi-year campaign. I can appreciate how much easier (and cheaper) it can be to use external tools and train users to disobey IT and security recommendations about phishing. The problem with bureaucracies and hackers is that both will take the path of least resistance, and the hard problem of IT security in large orgs is how to separate the two into distinct categories.
neartheplain 6y ago
Sounds like a great way to get disgruntled employees leaking credentials on purpose.
lights0123 6y ago
while it's down https://webcache.googleusercontent.com/search?q=cache:wazH1FYIV6QJ:https://coppercourier.com/story/godaddy-employees-holiday-bonus-secruity-test/ https://webcache.googleusercontent.com/search?q=cache:wazH1F...
alanfranz 6y ago
What Domain did the email lead to? If the domain was suspicious they failed the test. Full stop.
- miked85 6y ago
  That's the problem. Many companies proxy all links, making the domain you are actually going to indecipherable even if you want to be careful and hover over the link to check first. It isn't like personal email.
legerdemain 6y ago
People, please! This corporate practice is called "ethical phishing." It's ethical because "ethical" is right there in the name!
tptacek 6y ago
An irony here is that there's some decent evidence that phishing simulations don't work; they appear not to meaningfully alter end-user behavior. So basically, this is just an IT department trolling its customers.
- RodgerTheGreat 6y ago
  or a security department justifying their paychecks
- tenebrisalietum 6y ago
  A company I used to work for conducted an operation with fake emails using KnowBe4. The helpdesk received an increase of "is this spam?" type tickets afterward. I think it helped for a time but don't have hard numbers. What got most people was the fake Amazon receipts.
  - technion 6y ago
    I think that's an understated point. We certainly haven't stopped phishing from being successful - but we have heavily increased the rate at which malicious emails get reported. Most of these bad emails do get sent to a lot of people after all. That makes it actionable - if something looks nasty I can detect every recipient and have it deleted from their inbox. I can report block malicious URLs on the firewall and report them to Google Safebrowse, and so on.
- scrooched_moose 6y ago
  My company has been sending out monthly tests for about 2 years now. There were some modest early gains (~33% -> 20%) but it's been stuck there for 12 months or so. They're not particularly convincing fakes either: "please update your password sent from @ourc0mpany.com" or "Dear Customer, your Worldwide Freight package has shipped" type things.
  - maccard 6y ago
    > Dear Customer, your Worldwide Freight package has shipped I had a package shipped from the US to the UK by my company's shipping provider a few months ago due to covid. I honest-to-god thought I was being phished. The email had one of those titles, a typo in the body, no tracking number, was sent from a third party domain. the template email told me to click a link to an external third party via a url shortner, and when you got there you had to enter your "email address and password" which turns out is actuallu my work SSO login and it checks via ldap. Insanity!
beamatronic 6y ago
Shitty and tone deaf
greencore 6y ago
My guess that the real story is that someone from above told HR department about salary raises but changed their mind after mass mail was sent. So they needed some excuse and came with this lame shit.
- lawnchair_larry 6y ago
  Not to be a total jerk, but has anyone told you that you have paranoid thoughts? This is obviously not the case. I am genuinely curious what might lead one to even be suspicious of this.
- hundchenkatze 6y ago
  Except the email was from an external domain.
  - Samantha97 6y ago
    Yeah but their shitty email client doesn't even tell them that its external.
    - hundchenkatze 6y ago
      I was replying to greencore's theory that Godaddy sent the email and then changed their mind, and is using the phish test as a cover. If that had been the case, then the email would have been sent from godaddy.com not gocladdy.com
jimsparkman 6y ago
My company ran something similar recently. The cyber security team opted for “an important change to your available PTO.” It was from an internal address but from a made up name. The company is large enough (1,300 people) that you wouldn’t know if the name was actually an employee in HR or not. Because IT runs software that proxies and mangles all the links in an email, it’s super hard to evaluate the legitimacy of a URL anyways. Of course, most people clicked the link.
- deleted 6y ago
  [deleted]
- alanfranz 6y ago
  Clicking the link shouldn't be enough to consider a target to have fallen to fishing. Sometimes, if a get a fishy email, I open it in a private tab within a browser I don't use, or even within a throwaway VM (if I feel something is REALLY strange).
  - geoduck14 6y ago
    Clicking a link is all it takes to download malicious code and send stuff to an attacker. Clicking a link is enough to consider a target to have failed.
    - cmeacham98 6y ago
      This is, uh, obviously not true. Feel free to provide me with a link that will "send stuff to an attacker" with only me clicking it and no other action.
    - technion 6y ago
      It shouldn't be though. If your threat vector includes teams with something like Chrome 0day, you've got bigger problems than employees clicking links. Malicious email in the wild is either a link to a phishing page, or a link to a page offering an executable. If I paste a URL urlscan.io and have a look at it, I can assess better whether it might be safe. Being told "url got hit, you compromised us" is really silly in my view.
xyzelement 6y ago
I am consistently surprised by people's attitudes as I read HN comments. Full disclosure, my old employer was very serious about phishing prevention (we sat on a ton of IP and people were out to get it) and did testing of this type as well. I did fall for a phish test around last review season because the phishing email had something about reviews in it. Let's be adult about it - it was a good test and I failed it because I wasn't vigilant enough. The fact that GoDaddy's email was "tempting for people around holiday season to click on" is - guess what - exactly what a moderately-sophisticated phishing attack would look like. One of the things IT teaches employees to look for in phishing emails is language that either doesn't make sense or seems designed to "get your guard down and act on it." In GoDaddy's case it included language like "it's free money, claim it now." Really - if you slowed down for a sec and thought about security, is this the language in which your employer emails you? Also, why does your employer need you to fill out any forms about your location - they know where you are. For all the talk on HN about security and companies not taking it seriously enough, here's a great example of a company taking it seriously (to the point of discomfort) to teach their staff about what phishing could look like, and HN is somehow objecting. PS: I bet there are no consequences for failing this test other than needing to retake the training which is right because the people who fell for it do need the reminder. If this was a real phish they'd have leaked real data. Perhaps even your data.
- galacticaactual 6y ago
  I explicitly told my penetration testers to avoid anything like this. Invoking and then revoking a bonus email in a year where folks are already hard hit financially and mentally under the guise of “education” is lazy and any security leader who does it is a fool. Effective security culture builds rapport with business units. This type of nonsense does the exact opposite. Yes you may have proven a tactical point, but you have just set yourself up to lose the war.
  - johnghanks 6y ago
    wasn't the bonus real, though?
  - otterley 6y ago
throwaway_avgo 6y ago
Broadcom just did the same thing: e-mail from the CEO inviting people to sign up for a holiday party. Headers were legit with DMARC pass, SPF pass. You were asked to click a URL that showed a Google Drive document but actually led to another site. That and some typos were the only clues that it wasn't legit.
- sschueller 6y ago
  Ah, that would explain why I didn't see you at the party last night. Too bad, we had a blast. /s In all seriousness how is a laymen supposed to know it's phishing? I assume Broadcom has specific places/processes to organize parties that people should know about? This kind of email is especially clever as it plays on FOMO which so many people seem to have.
ffpip 6y ago
https://web.archive.org/web/20201224174531/https://coppercourier.com/story/godaddy-employees-holiday-bonus-secruity-test/ https://web.archive.org/web/20201224174531/https://coppercou... Site seems down.
seg_lol 6y ago
Given what I know about GoDaddy, employees should know that anything involving a holiday bonus is most likely a scam/trap/mistake of some sort.
deleted 6y ago
[deleted]
xref 6y ago
Since the article doesn't seem to address it, the email was sent from “happyholiday@gocladdy.com” and tried to trick users with the kerning between “d” and “cl”, here's a screencap where the address is shown in a different font https://imgur.com/a/eqrijWx https://imgur.com/a/eqrijWx source: https://www.wfaa.com/article/news/godaddyunderfireforfakebonusemail/75-d6ab6d6e-e8bb-4269-a7ad-6d08bbc35ff2 https://www.wfaa.com/article/news/godaddyunderfireforfakebon...
- Samantha97 6y ago
  If the people running this actually cared about phishing, they would update their email system to put a giant red header at the top of all emails coming from an external source.
chris_st 6y ago
My last company would do this, and yeah, I think I got bit at least once. THEN, without any clue about the irony, they'd send us "important" emails with something to click in them... employee surveys, links to benefits information, etc. This must have been pointed out by other people than me, because once one of the emails had a line like, "AND YOU CAN CLICK ON THIS LINK, IT'S AUTHORIZED." I don't miss working there (though I do miss a lot of the people).
- dasudasu 6y ago
  "And now here is the secret code phrase to show this is legitimate: [...]" Not sure how you inform people about benefits without giving a link, if the intranet isn’t easy to navigate, short of including everything in the email all the time. So how should it be done anyway?
  - chris_st 6y ago
    Well, we did have an intranet (and yeah, the search was abysmal, so it was tough to navigate), and giving it a second's thought, maybe email each person a magic number, that they then enter into a single magic-number box on the intranet and you're magically whisked to the appropriate site? This just doesn't seem like rocket surgery.
Shivetya 6y ago
Ours was a claimed corporate greeting card. the simple matter is people click on stuff and while some attempts might be distasteful if not rude there does not seem to a good way to stop people from doing dumb things. short of banning all non internal mail and not allowing access to the internet except approved sites on corporate computers; then not allowing access from non corporate computers. all of our mail that comes from external sources is clearly marked yet people still click on enticing links. it is to the point it goes on your review if you fail too many phishing attempts and can requiring training and eventual termination
sloshnmosh 6y ago
This does not surprise me in the least. I have spoken with employees and supervisors at GoDaddy when reporting malware and ad fraud and they are the absolute worst. I see that the latest SolarWinds hack used GoDaddy for their initial CnC as well. The worst.
miked85 6y ago
I work for a company that sends phishing test emails like this (though not as bad). It has gotten to the point where legit company emails look just as suspect as phishing tests. I feel like I am just a part of some psychological experiment now.
neilv 6y ago
This is a bad mistake that could happen in many organizations. But if we'd blanked out the company name in the headline, and used HN comment voting to collectively guess at which well-known tech-ish company this happened, I would've been very curious to see which ones percolated to the top.
miked85 6y ago
I have wondered why GPG signed emails aren't more common for internal company email? It seems like it would solve at least part of the problem.
- xenophonf 6y ago
  This is a great question, but the answer is pretty mundane. Building out, operating, and maintaining the kind of tooling and infrastructure you need to make this work is really freaking hard even with good client-side support for digitally signed email. GPG and similar tools are really hard to use, really hard to support, and really hard to integrate with platforms and services. Even organizations that have rolled out smartcards to all their users and live entirely in a Microsoft world tend not to use digital signatures. Sometimes, integrations break, which results in the email client (or some other tool) breaking, and then the business stops while the integration gets fixed, if that's even possible. And Goddess help you if you're trying to support more than just Outlook on PCs, which has relatively good S/MIME support, all things considered. It's really, really non-trivial to do what you're asking.
theginger 6y ago
A generic low quality phishing email test gives you an indication of how exposed to this risk you are. A well made highly targeted phishing test gives you an indication of how good at make phishing emails you are.
rbirkby 6y ago
These corporate phishing test emails come from phishd and similar services. Very easy to fingerprint them with smtp headers and set up mail rules to bounce them to your corporate phishing sink...
terracatta 6y ago
This is beyond the pale, way worse than the scenarios I've seen in the while when I wrote https://honest.security https://honest.security We HAVE to as an industry disavow & replace this behavior with techniques to build trust between the security team and the rest of the employees. The people, not the technology are the real eyes and ears on the ground. They are a massively beneficial resource for a security team of any size. Why would you squander that relationship with cheap trickery and deceit?
rendall 6y ago
There are two unrelated issues: 1) Pentest 2) No bonuses Yes, the pentest surfaced security issues. It also underscored that GoDaddy isn't giving bonuses. I think it was great security, but tonedeaf.
iamleppert 6y ago
Any employee of The Company found to be in violation of our new policy of no bonuses will be subject to immediate action, up to and including termination of employment. Any employee found to be ignorant enough to believe they could possibly be receiving anything for the holiday season besides basal survival shall be forced to work over Christmas making hand-written copies of The Employee Handbook until such a time that the CEO returns from his vacation. The Board of Directors and Principal Shareholders shall meet shortly before the stroke of midnight on December 31st, 2020 to determine the fate of any other employees and to henceforth distribute The Employee Handbook, 2021 Edition.
sp332 6y ago
Here's a professional penetration tester and social engineer, Jayson Street: For the record I’m not just disgusted & disappointed by the horrific actions taken by #GoDaddy executives who signed off on this gross betrayal of employees disguised as a phishing exercise! I’m extremely sad that anyone claiming to be in InfoSec would help with it!!! https://twitter.com/jaysonstreet/status/1342213216122892293 https://twitter.com/jaysonstreet/status/1342213216122892293 Digital forensics and incident response professional (and risk management expert) Leslie Carhart: This is one of the cruelest and most counterproductive moves I have ever heard of inside our industry... stunningly unethical... objectively negative as it spoils the fragile relationship between infosec and staff for future IR, reporting, and policy adherence. https://twitter.com/hacks4pancakes/status/1342186189718237188 https://twitter.com/hacks4pancakes/status/134218618971823718... CEO of social engineering training company SocialProof Security, Rachel Tobac: They have to trust you as a helper so you can support and keep them safe... if it’s a pretext that makes them feel you and your team are insensitive or rude. They’ll just remember they distrust you personally more — when you need their trust! https://twitter.com/RachelTobac/status/1342194628024406016 https://twitter.com/RachelTobac/status/1342194628024406016
- sp332 6y ago
  *Lesley, whoops.
rhodozelia 6y ago
A friends company had a test phishing email to see how many people clicked the link, and then sent out another email after the test with a link to a video everyone had to watch about not clicking links in emails... it is amazing that authenticated email is not a solved problem!
unixhero 6y ago
Good phising emails are propermy localized, in the local language, contain no typos and manipulate the user with one of the three Dantes inferno sins: Greed Lust Fear
chrisbennet 6y ago
They could have done this in a much nicer way. When they click on the (fake) phishing link, bring up a page that tells that them that it is a test and add some gentle instructions so they can avoid it next time. What I do to confirm a non-obvious phishing email, is look at the real "From" address. The other day I got an email from "Accουnt-alert@amazon.com" Looking at the actual email address revealed that it was from "remimbersrs-qwrdvcxwet-exp-2020-3111538818484262@legger-3.com"
- Too 6y ago
  Can't believe email clients still allow such basic tricks to not be spotted instantly.
joestandring 6y ago
This may be an effective test or it may not, I don't care. It is extremely tasteless to offer this kind of incentive to employees especiay during a year where many are struggling financially. This would be slightly more acceptable if the bonus was actually given to the employees. People who really dont see the issue with this most likely havent been in a situation where a bonus can be a lifesaver.

199 points by arkadiyt 6y ago

damm 6y ago

.... They didn't fail the test. They are having hard times and thought they were getting a holiday bonus which does happen. Where/Why they failed is because times are tough and if all you had to do is fill out a form for 650$ would you really not do it? It's not awareness it's people are effed and struggling

burnthrow 6y ago
In summary, they failed the test.
- acdha 6y ago
  Alternatively, GoDaddy has failed to secure their work environment and are blaming the workers instead. Think about why we care about phishing: it’s mostly about people giving credentials to an attacker. Drop $20/person on some FIDO tokens and the risk factor drops considerably. Repeat for the risk of malware - if someone in accounting can run arbitrary software, they aren’t the root cause.
  - kenjackson 6y ago
    It’s defense in depth. Just because you have one line of defense doesn’t mean you shouldn’t have another. The way defense in depth typically works is assuming the previous lines of defense have been thwarted. Even if you can’t foresee that happening, assume it did. And it sounds like these employees were trained on this. The thing I don’t like is the XMas bonus aspect. But the general idea doesn’t seem unreasonable.
    - acdha 6y ago
      How much depth is it really adding, though? Harassing non-specialists seems to have relatively limited value – plenty of security staff get phished – and there is a risk of making people think of the security group as adversaries. I would certainly agree that the exercise could have some value but I think it would be wise to weigh that against the costs and especially to think about how you can make it supportive rather than punitive. In particular, most people are not only not given good tools for making untrained security decisions and many of them will be told to violate that advice regularly. For example, what percentage of vendors, outsourced HR, etc. will tell people to open unexpected attachments or click on links which are difficult to distinguish from phishing? SolarWinds was far from the only company training their customers to ignore security errors on installers, too.
  - at-fates-hands 6y ago
    > Alternatively, GoDaddy has failed to secure their work environment and are blaming the workers instead. This. I've worked at careless companies who don't deal with their security very well. I now work at a large health care company who takes security incredibly serious. All the USB ports are disabled. Nobody has admin rights on their laptops. You can't install any software unless you download and install from their internal app store which only allows apps that have passed a rigorous gambit of testing beforehand. And you have to put in a request for the software in the first place. It took me three months to get Photoshop approved because I was designated as a developer and not a web designer. It went through three escalations and took several debates between senior managers who finally approved my request. We don't have "phishing tests". If something pops up on the security team's radar, then they push it out as an email alert company wide. That's about it. Maybe if GoDaddy put as much effort into securing their network as they do putting together these stupid tests, they probably wouldn't need them to prove that yes, humans are fallible.
    - btilly 6y ago
      I'm sorry, but your 3 months to get Photoshop approved demonstrates why so many wouldn't want to work in such locked down environments. And what was the cost to the company in having those debates between senior managers? Just to get a standard tool that they already approved onto a developer machine? Can you imagine the overhead that they are causing themselves?
NullPrefix 6y ago
They failed the test the moment they started working at godaddy.
DoofusOfDeath 6y ago
I'm not sure I follow your logic. IIUC, a traditional phishing test involves: (a) Prior training for what employees are supposed to look for, and how to respond if they think they're being phished. (b) Unannounced drills to confirm that employees act in accordance to (a). If some GoDaddy employees did not act in accordance to the training, how is that anything but a failed test? [EDIT] I just realized that "how is that anything but a failed test" could sound reductive. FWIW, I would call this a test failure and also a really unwise test design.
- jldugger 6y ago
  Honestly, blaming the employee here is the fallacy. Employees don't fail phishing tests, companies do.
lazylizard 6y ago
if they're still employed at godaddy why are they having hard times? if they're greedy for an extra $650 windfall... thats what a real phish will dangle as well?
- notgoodrobot 6y ago
  Many people have spouses out of work right now. It's possible to have a job and be in a bad situation. Regardless of whether the employees actually need a bonus. Dangling the idea of a bonus as a test, shortly before the holidays and during a pandemic seems like a recipe for bad publicity or at least some frustrated employees.
lawnchair_larry 6y ago
What makes you think GoDaddy employees are struggling financially? They all have their jobs, and their costs are likely lower than pre-pandemic. Many are suffering and unable to work, but that wouldn’t include this set of people.

mikece 6y ago

This is hilarious but GoDaddy is going to be dealing with a lot of very pissed off employees because of this.

kibwen 6y ago
Seriously, this has to be satire, right? It's straight out of National Lampoon's Christmas Vacation. If true, then "what a cheap, lying, no-good, rotten, four-flushing, low-life, snake-licking, dirt-eating, inbred, overstuffed, ignorant, blood-sucking, dog-kissing, brainless, dickless, hopeless, heartless, fat-ass, bug-eyed, stiff-legged, spotty-lipped, worm-headed sack of monkey shit" company.

deleted 6y ago

[deleted]

selykg 6y ago

I’m so glad I don’t use GoDaddy. What a scummy company.

acdha 6y ago
They’ve been like this for ages, too, and there are so many better competitors.

DoofusOfDeath 6y ago

I'm curious if GoDaddy is setting itself up for a lawsuit from employees. IANAL, but I could imagine a court interpreting this as a promise for compensation.

nickff 6y ago
Would all pentests be regarded the same way? The most extreme example (I can think of) would be that the company gets a pentester to attempt to bribe employees to disclose privileged materials to an apparently unprivileged person. Would you see this 'as a promise for compensation'?
- joecot 6y ago
  Do you consider: a) Being gifted a TV by a friend b) Someone telling you they'll help you steal a TV from your friend's house To be the same thing? Because one involves a perfectly reasonable and legal promise, and one does not. If you can't tell the difference, remind me not to invite you over.
  - otterley 6y ago
    An undelivered gift is not a contract. This is covered in first-year contract law.
    - joecot 6y ago
      While that may be the case, an undelivered gift is still worlds different than an undelivered bribe.
      - otterley 6y ago
        I'm not sure what your point is.
        joecot 6y ago

tsimionescu 6y ago

I wonder what sociopath came up with this idea for a phishing test. It seems incredibly insensitive given the minute amount of difference it is likely to make - the way to tell a phishing email from a non-phishing email depends much more on the metadata than the actual contents, so there's no reason to play with people's emotions like this. Even the employees who immediately recognized it as phishing will have felt the disappointment.

leetcrew 6y ago
> the way to tell a phishing email from a non-phishing email depends much more on the metadata than the actual contents this is true, but people are also much more likely to skip the rational analysis step if the contents elicit an emotional response. it's hard do to an effective test without some sort of emotional and/or time sensitive call to action. I certainly agree it is cruel to tease employees with a fake bonus. but if they turned around and actually paid a holiday bonus in the same amount, I would say no harm was done ultimately.

superseeplus 6y ago

Are there any indications that the email is even a phishing email? The email is from an internal address. Do they mean to say that their internal email system can’t detect fake emails purporting to be from an internal address? This is cruel in multiple ways. Promising a non existent bonus and then blaming employees for failing a phishing test (which is not even a real phishing email or exposes deep seated IT inadequacies). Presumably this goes on their performance report too.

agotterer 6y ago
I was thinking the same thing. You shouldn’t fail by clicking a link sent by an internal email address. If the link took you to an external site and you entered your GoDaddy credentials or provided personal information, that might be a different story.
- chris11 6y ago
  Entering personal info might also be understandable. My employer gives a Christmas gift. This year they asked us to update a form with our temporary address if we were in a different location.
  - vitus 6y ago
    Absolutely, in the context of a physical item being shipped to you (especially if they can't just distribute it at the office), if it's not through payroll. (e.g. we had site-specific fun events in lieu of the annual holiday party) But a cash bonus? That's the epitome of something that 1) should go through payroll and 2) should just get direct-deposited into your bank account as is the case with your regular paycheck. There's no reason why you'd need to provide any additional info.
- vitus 6y ago
  > You shouldn’t fail by clicking a link sent by an internal email address. I disagree in making this broad of a claim -- insider threats are certainly an issue. And as a sibling commenter points out, email headers are easily spoofed. I'm not condoning GoDaddy's pentest (agreed with everyone else who sees this as a cruel prank), but also, um, why would you click a link if your company is telling you they're going to pay you a bonus? Wouldn't that just go through payroll as with everything else? edit: it looks like the phishing email provided the bonus as an opt-in? yeah, that ought to raise red flags that it's not just being applied across the board, but still, it's been a tough year, so people might not think as hard about it.

Animats 6y ago

What gets me is companies sending out legit emails that look like phishing attacks. I got one from one of the big banks, asking me to click on a link to get some benefit. I assumed it was a phish, but after a close look at the headers, it really was from the bank's usual server. I sent a note to the security incident report address for the bank, telling them they're training their users to click on phishing emails. They sent back some noncommittal answer.

bloodorange 6y ago
The only way to get them to make a reasonable response to these things is to make a redacted screenshot and shame them publicly on social media. Otherwise, your email is just an annoyance for someone who (perhaps proudly?) thinks "these customers think they are experts when we have a whole team dealing with security".
dmix 6y ago
Marketing teams at companies are always a risk vector for security IMO and their practices should be looked at by infosec people. Not just concerned citizens (but thank you for spending your time trying to help). I've seen some wonky stuff being put out by them and they are oblivious. As their work often crosses the line into actual web-dev stuff that has security implications. ie, landing pages and emails. And not 2FAing the countless marketing tools they use nor letting the more experienced devs know what they are up to.
vegetablepotpie 6y ago
It happens all the time at my work place. I work at a big company and I get emails from random people in the company to go to submit info to random places on the Internet, usually related to employee benefits or surveys. I always report them as suspicious and move on with my work. Once in a while you'll see a follow up email from the sender saying that they are aware of many people reporting the email as a phishing attempt and that reporting the email was wrong and that link to that particular website is a company approved tool and that employees are required to complete the survey at the link for some department or center's benefit. This wouldn't be a problem if we had internal websites with standard tools like a survey builder and such, but getting our IT contractor in my org to do the basic functions of their jobs takes a herculean effort, getting them to support a basic internal tool would be a multi-year campaign. I can appreciate how much easier (and cheaper) it can be to use external tools and train users to disobey IT and security recommendations about phishing. The problem with bureaucracies and hackers is that both will take the path of least resistance, and the hard problem of IT security in large orgs is how to separate the two into distinct categories.

neartheplain 6y ago

Sounds like a great way to get disgruntled employees leaking credentials on purpose.

lights0123 6y ago

while it's down https://webcache.googleusercontent.com/search?q=cache:wazH1FYIV6QJ:https://coppercourier.com/story/godaddy-employees-holiday-bonus-secruity-test/ https://webcache.googleusercontent.com/search?q=cache:wazH1F...

alanfranz 6y ago

What Domain did the email lead to? If the domain was suspicious they failed the test. Full stop.

miked85 6y ago
That's the problem. Many companies proxy all links, making the domain you are actually going to indecipherable even if you want to be careful and hover over the link to check first. It isn't like personal email.

legerdemain 6y ago

People, please! This corporate practice is called "ethical phishing." It's ethical because "ethical" is right there in the name!

tptacek 6y ago

An irony here is that there's some decent evidence that phishing simulations don't work; they appear not to meaningfully alter end-user behavior. So basically, this is just an IT department trolling its customers.

RodgerTheGreat 6y ago
or a security department justifying their paychecks
tenebrisalietum 6y ago
A company I used to work for conducted an operation with fake emails using KnowBe4. The helpdesk received an increase of "is this spam?" type tickets afterward. I think it helped for a time but don't have hard numbers. What got most people was the fake Amazon receipts.
- technion 6y ago
  I think that's an understated point. We certainly haven't stopped phishing from being successful - but we have heavily increased the rate at which malicious emails get reported. Most of these bad emails do get sent to a lot of people after all. That makes it actionable - if something looks nasty I can detect every recipient and have it deleted from their inbox. I can report block malicious URLs on the firewall and report them to Google Safebrowse, and so on.
scrooched_moose 6y ago
My company has been sending out monthly tests for about 2 years now. There were some modest early gains (~33% -> 20%) but it's been stuck there for 12 months or so. They're not particularly convincing fakes either: "please update your password sent from @ourc0mpany.com" or "Dear Customer, your Worldwide Freight package has shipped" type things.
- maccard 6y ago
  > Dear Customer, your Worldwide Freight package has shipped I had a package shipped from the US to the UK by my company's shipping provider a few months ago due to covid. I honest-to-god thought I was being phished. The email had one of those titles, a typo in the body, no tracking number, was sent from a third party domain. the template email told me to click a link to an external third party via a url shortner, and when you got there you had to enter your "email address and password" which turns out is actuallu my work SSO login and it checks via ldap. Insanity!

beamatronic 6y ago

Shitty and tone deaf

greencore 6y ago

My guess that the real story is that someone from above told HR department about salary raises but changed their mind after mass mail was sent. So they needed some excuse and came with this lame shit.

lawnchair_larry 6y ago
Not to be a total jerk, but has anyone told you that you have paranoid thoughts? This is obviously not the case. I am genuinely curious what might lead one to even be suspicious of this.
hundchenkatze 6y ago
Except the email was from an external domain.
- Samantha97 6y ago
  Yeah but their shitty email client doesn't even tell them that its external.
  - hundchenkatze 6y ago
    I was replying to greencore's theory that Godaddy sent the email and then changed their mind, and is using the phish test as a cover. If that had been the case, then the email would have been sent from godaddy.com not gocladdy.com

jimsparkman 6y ago

My company ran something similar recently. The cyber security team opted for “an important change to your available PTO.” It was from an internal address but from a made up name. The company is large enough (1,300 people) that you wouldn’t know if the name was actually an employee in HR or not. Because IT runs software that proxies and mangles all the links in an email, it’s super hard to evaluate the legitimacy of a URL anyways. Of course, most people clicked the link.

deleted 6y ago
[deleted]
alanfranz 6y ago
Clicking the link shouldn't be enough to consider a target to have fallen to fishing. Sometimes, if a get a fishy email, I open it in a private tab within a browser I don't use, or even within a throwaway VM (if I feel something is REALLY strange).
- geoduck14 6y ago
  Clicking a link is all it takes to download malicious code and send stuff to an attacker. Clicking a link is enough to consider a target to have failed.
  - cmeacham98 6y ago
    This is, uh, obviously not true. Feel free to provide me with a link that will "send stuff to an attacker" with only me clicking it and no other action.
  - technion 6y ago
    It shouldn't be though. If your threat vector includes teams with something like Chrome 0day, you've got bigger problems than employees clicking links. Malicious email in the wild is either a link to a phishing page, or a link to a page offering an executable. If I paste a URL urlscan.io and have a look at it, I can assess better whether it might be safe. Being told "url got hit, you compromised us" is really silly in my view.

xyzelement 6y ago

I am consistently surprised by people's attitudes as I read HN comments. Full disclosure, my old employer was very serious about phishing prevention (we sat on a ton of IP and people were out to get it) and did testing of this type as well. I did fall for a phish test around last review season because the phishing email had something about reviews in it. Let's be adult about it - it was a good test and I failed it because I wasn't vigilant enough. The fact that GoDaddy's email was "tempting for people around holiday season to click on" is - guess what - exactly what a moderately-sophisticated phishing attack would look like. One of the things IT teaches employees to look for in phishing emails is language that either doesn't make sense or seems designed to "get your guard down and act on it." In GoDaddy's case it included language like "it's free money, claim it now." Really - if you slowed down for a sec and thought about security, is this the language in which your employer emails you? Also, why does your employer need you to fill out any forms about your location - they know where you are. For all the talk on HN about security and companies not taking it seriously enough, here's a great example of a company taking it seriously (to the point of discomfort) to teach their staff about what phishing could look like, and HN is somehow objecting. PS: I bet there are no consequences for failing this test other than needing to retake the training which is right because the people who fell for it do need the reminder. If this was a real phish they'd have leaked real data. Perhaps even your data.

galacticaactual 6y ago
I explicitly told my penetration testers to avoid anything like this. Invoking and then revoking a bonus email in a year where folks are already hard hit financially and mentally under the guise of “education” is lazy and any security leader who does it is a fool. Effective security culture builds rapport with business units. This type of nonsense does the exact opposite. Yes you may have proven a tactical point, but you have just set yourself up to lose the war.
- johnghanks 6y ago
  wasn't the bonus real, though?
- otterley 6y ago

throwaway_avgo 6y ago

Broadcom just did the same thing: e-mail from the CEO inviting people to sign up for a holiday party. Headers were legit with DMARC pass, SPF pass. You were asked to click a URL that showed a Google Drive document but actually led to another site. That and some typos were the only clues that it wasn't legit.

sschueller 6y ago
Ah, that would explain why I didn't see you at the party last night. Too bad, we had a blast. /s In all seriousness how is a laymen supposed to know it's phishing? I assume Broadcom has specific places/processes to organize parties that people should know about? This kind of email is especially clever as it plays on FOMO which so many people seem to have.

ffpip 6y ago

https://web.archive.org/web/20201224174531/https://coppercourier.com/story/godaddy-employees-holiday-bonus-secruity-test/ https://web.archive.org/web/20201224174531/https://coppercou... Site seems down.

seg_lol 6y ago

Given what I know about GoDaddy, employees should know that anything involving a holiday bonus is most likely a scam/trap/mistake of some sort.

deleted 6y ago

[deleted]

xref 6y ago

Since the article doesn't seem to address it, the email was sent from “happyholiday@gocladdy.com” and tried to trick users with the kerning between “d” and “cl”, here's a screencap where the address is shown in a different font https://imgur.com/a/eqrijWx https://imgur.com/a/eqrijWx source: https://www.wfaa.com/article/news/godaddyunderfireforfakebonusemail/75-d6ab6d6e-e8bb-4269-a7ad-6d08bbc35ff2 https://www.wfaa.com/article/news/godaddyunderfireforfakebon...

Samantha97 6y ago
If the people running this actually cared about phishing, they would update their email system to put a giant red header at the top of all emails coming from an external source.

chris_st 6y ago

My last company would do this, and yeah, I think I got bit at least once. THEN, without any clue about the irony, they'd send us "important" emails with something to click in them... employee surveys, links to benefits information, etc. This must have been pointed out by other people than me, because once one of the emails had a line like, "AND YOU CAN CLICK ON THIS LINK, IT'S AUTHORIZED." I don't miss working there (though I do miss a lot of the people).

dasudasu 6y ago
"And now here is the secret code phrase to show this is legitimate: [...]" Not sure how you inform people about benefits without giving a link, if the intranet isn’t easy to navigate, short of including everything in the email all the time. So how should it be done anyway?
- chris_st 6y ago
  Well, we did have an intranet (and yeah, the search was abysmal, so it was tough to navigate), and giving it a second's thought, maybe email each person a magic number, that they then enter into a single magic-number box on the intranet and you're magically whisked to the appropriate site? This just doesn't seem like rocket surgery.

Shivetya 6y ago

Ours was a claimed corporate greeting card. the simple matter is people click on stuff and while some attempts might be distasteful if not rude there does not seem to a good way to stop people from doing dumb things. short of banning all non internal mail and not allowing access to the internet except approved sites on corporate computers; then not allowing access from non corporate computers. all of our mail that comes from external sources is clearly marked yet people still click on enticing links. it is to the point it goes on your review if you fail too many phishing attempts and can requiring training and eventual termination

sloshnmosh 6y ago

This does not surprise me in the least. I have spoken with employees and supervisors at GoDaddy when reporting malware and ad fraud and they are the absolute worst. I see that the latest SolarWinds hack used GoDaddy for their initial CnC as well. The worst.

miked85 6y ago

I work for a company that sends phishing test emails like this (though not as bad). It has gotten to the point where legit company emails look just as suspect as phishing tests. I feel like I am just a part of some psychological experiment now.

neilv 6y ago

This is a bad mistake that could happen in many organizations. But if we'd blanked out the company name in the headline, and used HN comment voting to collectively guess at which well-known tech-ish company this happened, I would've been very curious to see which ones percolated to the top.

miked85 6y ago

I have wondered why GPG signed emails aren't more common for internal company email? It seems like it would solve at least part of the problem.

xenophonf 6y ago
This is a great question, but the answer is pretty mundane. Building out, operating, and maintaining the kind of tooling and infrastructure you need to make this work is really freaking hard even with good client-side support for digitally signed email. GPG and similar tools are really hard to use, really hard to support, and really hard to integrate with platforms and services. Even organizations that have rolled out smartcards to all their users and live entirely in a Microsoft world tend not to use digital signatures. Sometimes, integrations break, which results in the email client (or some other tool) breaking, and then the business stops while the integration gets fixed, if that's even possible. And Goddess help you if you're trying to support more than just Outlook on PCs, which has relatively good S/MIME support, all things considered. It's really, really non-trivial to do what you're asking.

theginger 6y ago

A generic low quality phishing email test gives you an indication of how exposed to this risk you are. A well made highly targeted phishing test gives you an indication of how good at make phishing emails you are.

rbirkby 6y ago

These corporate phishing test emails come from phishd and similar services. Very easy to fingerprint them with smtp headers and set up mail rules to bounce them to your corporate phishing sink...

terracatta 6y ago

This is beyond the pale, way worse than the scenarios I've seen in the while when I wrote https://honest.security https://honest.security We HAVE to as an industry disavow & replace this behavior with techniques to build trust between the security team and the rest of the employees. The people, not the technology are the real eyes and ears on the ground. They are a massively beneficial resource for a security team of any size. Why would you squander that relationship with cheap trickery and deceit?

rendall 6y ago

There are two unrelated issues: 1) Pentest 2) No bonuses Yes, the pentest surfaced security issues. It also underscored that GoDaddy isn't giving bonuses. I think it was great security, but tonedeaf.

iamleppert 6y ago

Any employee of The Company found to be in violation of our new policy of no bonuses will be subject to immediate action, up to and including termination of employment. Any employee found to be ignorant enough to believe they could possibly be receiving anything for the holiday season besides basal survival shall be forced to work over Christmas making hand-written copies of The Employee Handbook until such a time that the CEO returns from his vacation. The Board of Directors and Principal Shareholders shall meet shortly before the stroke of midnight on December 31st, 2020 to determine the fate of any other employees and to henceforth distribute The Employee Handbook, 2021 Edition.

sp332 6y ago

Here's a professional penetration tester and social engineer, Jayson Street: For the record I’m not just disgusted & disappointed by the horrific actions taken by #GoDaddy executives who signed off on this gross betrayal of employees disguised as a phishing exercise! I’m extremely sad that anyone claiming to be in InfoSec would help with it!!! https://twitter.com/jaysonstreet/status/1342213216122892293 https://twitter.com/jaysonstreet/status/1342213216122892293 Digital forensics and incident response professional (and risk management expert) Leslie Carhart: This is one of the cruelest and most counterproductive moves I have ever heard of inside our industry... stunningly unethical... objectively negative as it spoils the fragile relationship between infosec and staff for future IR, reporting, and policy adherence. https://twitter.com/hacks4pancakes/status/1342186189718237188 https://twitter.com/hacks4pancakes/status/134218618971823718... CEO of social engineering training company SocialProof Security, Rachel Tobac: They have to trust you as a helper so you can support and keep them safe... if it’s a pretext that makes them feel you and your team are insensitive or rude. They’ll just remember they distrust you personally more — when you need their trust! https://twitter.com/RachelTobac/status/1342194628024406016 https://twitter.com/RachelTobac/status/1342194628024406016

sp332 6y ago
*Lesley, whoops.

rhodozelia 6y ago

A friends company had a test phishing email to see how many people clicked the link, and then sent out another email after the test with a link to a video everyone had to watch about not clicking links in emails... it is amazing that authenticated email is not a solved problem!

unixhero 6y ago

Good phising emails are propermy localized, in the local language, contain no typos and manipulate the user with one of the three Dantes inferno sins: Greed Lust Fear

chrisbennet 6y ago

They could have done this in a much nicer way. When they click on the (fake) phishing link, bring up a page that tells that them that it is a test and add some gentle instructions so they can avoid it next time. What I do to confirm a non-obvious phishing email, is look at the real "From" address. The other day I got an email from "Accουnt-alert@amazon.com" Looking at the actual email address revealed that it was from "remimbersrs-qwrdvcxwet-exp-2020-3111538818484262@legger-3.com"

Too 6y ago
Can't believe email clients still allow such basic tricks to not be spotted instantly.

joestandring 6y ago

This may be an effective test or it may not, I don't care. It is extremely tasteless to offer this kind of incentive to employees especiay during a year where many are struggling financially. This would be slightly more acceptable if the bonus was actually given to the employees. People who really dont see the issue with this most likely havent been in a situation where a bonus can be a lifesaver.