17 ms·

I am consistently surprised by people's attitudes as I read HN comments. Full disclosure, my old employer was very serious about phishing prevention (we sat on

I am consistently surprised by people's attitudes as I read HN comments. Full disclosure, my old employer was very serious about phishing prevention (we sat on a ton of IP and people were out to get it) and did testing of this type as well. I did fall for a phish test around last review season because the phishing email had something about reviews in it. Let's be adult about it - it was a good test and I failed it because I wasn't vigilant enough. The fact that GoDaddy's email was "tempting for people around holiday season to click on" is - guess what - exactly what a moderately-sophisticated phishing attack would look like. One of the things IT teaches employees to look for in phishing emails is language that either doesn't make sense or seems designed to "get your guard down and act on it." In GoDaddy's case it included language like "it's free money, claim it now." Really - if you slowed down for a sec and thought about security, is this the language in which your employer emails you? Also, why does your employer need you to fill out any forms about your location - they know where you are. For all the talk on HN about security and companies not taking it seriously enough, here's a great example of a company taking it seriously (to the point of discomfort) to teach their staff about what phishing could look like, and HN is somehow objecting. PS: I bet there are no consequences for failing this test other than needing to retake the training which is right because the people who fell for it do need the reminder. If this was a real phish they'd have leaked real data. Perhaps even your data.

galacticaactual 6y ago
I explicitly told my penetration testers to avoid anything like this. Invoking and then revoking a bonus email in a year where folks are already hard hit financially and mentally under the guise of “education” is lazy and any security leader who does it is a fool. Effective security culture builds rapport with business units. This type of nonsense does the exact opposite. Yes you may have proven a tactical point, but you have just set yourself up to lose the war.
- johnghanks 6y ago
  wasn't the bonus real, though?
- otterley 6y ago
  This one is tricky. Effective phishing preys on the weak and the vulnerable. For better or worse, we do have to train people -- even weak and vulnerable people -- not to fall for scams, and there's no better way we know of than to do training exercises. Cruel though it may sound, unless we can think of a better way, I think it's the most effective option. The fact that employees are failing this proves the point, and until we can show that they are no longer falling for it, it shows how vulnerable we remain from an infosec posture.
  - galacticaactual 6y ago
    Again, while you may be proving a point and obtain a localized victory, it is Pyrrhic. There are other phishing scenarios that can be tailored for the proclivities of each team. Overdue POs for purchasing. “Hey I saw some source code leaked on this site” for engineering. Etc etc. The only reason you would have to send something like this is because you are lazy, need to generalize quickly, and blast it to the company. And you will teach a lesson. And you will kill any goodwill to the security team as a byproduct.
    - otterley 6y ago
      How would this other form of exercise you propose demonstrate that the staff isn't vulnerable to a fictitious promise of a bonus sent by a malicious outside actor? I disagree that one can characterize the simulation of a specific scenario as "lazy." Is it unusually attractive to the target? Yes. Lazy? No.
      - galacticaactual 6y ago
        Ask yourself what the purpose of proving this point is other than a vanity metric. Then ask yourself whether that should be the actual goal. Because it seems to me the actual goal is to have a workforce with generally high awareness and caution around phishing risks in general - and that can be built without goodwill-destroying tactics like this.
        6y ago
- axaxs 6y ago
  Why not have both? That is, plan to provide a real bonus and amount, even if it's just 100 bucks. Beforehand, send out said phishing email, and collect data. Provide the bonus to everyone. Once the holiday is over, notify employees who failed the test of how easy it is to prey on people's emotion and to be careful, that email was in fact in no way tied to the bonus.
  - mcphage 6y ago
    That might be fine, but that’s not what GoDaddy did.
  - deleted 6y ago
    [deleted]
- shmageggy 6y ago
  GoDaddy doing something unethical?! Color me shocked.
- deleted 6y ago
  [deleted]
- kryogen1c 6y ago
  > Yes you may have proven a tactical point, but you have just set yourself up to lose the war. you glossed over this point, but it is nonobvious. how exactly does making your users skeptical of email "lose the war"? are they going to type in their passwords out of spite now? the gp is exactly right. if you have a line you wont cross to train your users, then youre leaving a vulnerability. if you want to make the argument that the vuln is worth not "being mean" to your employees, then make that argument, but don't pretend its more secure.
  - bluntfang 6y ago
    if you make your employees feel bad on purpose and have a track record of insensitivity, they won't like you. People who don't like you won't act in your interest to a high capacity. I don't think GP was ambiguous at all, to be honest. This point was extremely clear. It feels like you came to the discussion with an axe to grind.
  - WrtCdEvrydy 6y ago
    > if you have a line you wont cross to train your users, then youre leaving a vulnerability. How about a phishing test that downloads something that nukes your hard drive?
    - Supermancho 6y ago
      > > if you have a line you wont cross to train your users, then youre leaving a vulnerability. > How about a phishing test that downloads something that nukes your hard drive? The phishing weakness opens that possibility. The act of wiping the HD does nothing to improve behavior or identify weakness.
    - inerte 6y ago
      How about gov sec launching nuclear attacks on every major country?
    - utucuro 6y ago
      Now that's a good idea - where I work, our security policy is such that I should be able to destroy any (company) computing equipment an end user is using and the loss of data should be restricted to their unsaved changes. A test like you propose would be a very memorable reminder for information security awareness, and so might be really effective before infrastructure upgrades if restricted to people with hardware about to be phased out, you need to nuke old hard drives at that point anyway...
- Alex3917 6y ago
  > Effective security culture builds rapport with business units. This type of nonsense does the exact opposite. But these emails presumably weren't even coming from the company's domain, since they were phishing emails.
  - jdbernard 6y ago
    Unless I misread the article, these were from the company's domain: > Sent by Happyholiday@Godaddy.com
    - Alex3917 6y ago
      You misread the article. The article is saying that the emails said they were from the godaddy.com, but it doesn't say that they were actually sent from godaddy.com.
  - horsawlarway 6y ago
    Internal domain, custom image with GoDaddy logo, no obvious spelling problems or mistakes. Go look at the image in the article. I don't work there so maybe something in it should have set off red flags for employees, but generally speaking - That's a very high quality phishing attempt.
fileeditview 6y ago
It might be a realistic scenario and thus a "good" test. It still is a total dick move to do this as an employer. Some things you just should not do to your employees. There are a million other fishing scenarios that are realistic where you don't have to be promised money by your employer.
- xyzelement 6y ago
  It's a choice between comfort and survival. There are more humane ways to train an army than to make them think of situations where someone is trying to kill them, but... if that comes at the expense of worse training (and therefore actual higher likelihood of death) then it doesn't do anyone favors. The fact that so many people fell for this test means there's something (obviously!) around this scenario that makes it particularly sensitive and mistake-prone for people. Your IT department may chose to avoid it, but people trying to phish you, won't.
  - galacticaactual 6y ago
    A company is not an army. You don’t train your employees on active shooter drills by having a guy barge in shooting blanks. Source: was in the army.
    - xyzelement 6y ago
      Thank you for your service. Hopefully you can appreciate the tradeoff between mental/emotional discomfort and an actual problem that was the point of my analogy.
      - thereare5lights 6y ago
        They don't. That's why they disagreed with you. The tradeoff here is an idiotic one. You don't set your own building on fire in order to test fire safety. You don't destroy company morale to test phishing security. It's really that simple.
lights0123 6y ago
I'm unfamiliar with corporate expectations regarding phishing emails—are you not supposed to click on links sent from an internal email address? The article clearly shows the email coming from an @godaddy.com address, and I'd think that them misconfiguring SPF/whatever is a much bigger deal.
- xyzelement 6y ago
  I don't remember the exact language of the training but there's a "use your head" element. Someone you don't know is emailing you something that doesn't really make sense - stop and don't comply. There are lots of reasons the email could have internal addresses (a misconfiguration, a similar-looking domain, an internal threat, whatever) - don't rely on that if other red flags are up.
  - treis 6y ago
    How crappy of a company would you have to be where a year end bonus doesn't really make sense.
    - xyzelement 6y ago
      If you read the text of the GoDaddy phish, there's something like "CLICK HERE NOW TO CLAIM YOUR FREE MONEY BEFORE ITS TOO LATE". If it was just a notification "btw you'll find a little extra something in your check this month" without requiting any weird action from the employee (which btw is how this would look if it was real) then it's a totally different thing.
tsimionescu 6y ago
Security is important, but it does not trump any other consideration. Will they next send employees emails claiming their loved ones are in danger, because that is something real hackers might do? Would you consider that ethical behavior? It's actually a pretty common scam, at least in my country (normally done to defraud old people, not to steal company secrets, but still). I'd expect to see a very convincing study that would show that this type of emotional response is crucial for accurately training people to recognize real phishing before I accepted in any way that this was ethical. Absent strong evidence in this regard, this is utterly disgusting.
- xyzelement 6y ago
  I guess that's subjective. In my old company, people generally just felt "yup, people are out to get us, and this test is making me realize how vulnerable I am to screwing it up and is therefore a good reminder." However this one makes you feel, how would you feel if this was the real phish and you were the one who leaked sensitive customer data because you fell for it?
  - tsimionescu 6y ago
    You are assuming that seeing real emotional stakes in the phishing exercise actually helps with recognizing the same in a real phishing email. I very much doubt the validity of this argument. Note: I'm not against testing your employees for phishing attempts. That is extremely valuable. I'm against using something with an emotional impact as the pretext of the phish, when I believe a more neutral pretext will do just as well. A separate note is that according to the pictures shown, it seems this is also a particularly bad example, as the email has legitimate headers, showing that it's coming from godaddy.com - so it would only rely on employees distrusting the contents to recognize it as phishing, which is a bad lesson to teach.
    - xyzelement 6y ago
      Sorry tsimionescu but I read your post as follows: It's ok for company to prepare its users for phishing, except for the kind of phishing where the attackers: (a) devised an emotional hook (b) put in effort to make it look legit. You can see how that creates a vulnerability, right, because a moderately sophisticated phisher would aim to do (a) and (b) every time.
philplckthun 6y ago
We actually don't know what the usual communiqués internally at GoDaddy look like. In a vacuum we can also judge this to be an effective test. In practice there are many unknowns and factors we don't know about though. In my opinion phishing is also an issue at scale when we talk about companies; meaning, there's a likelihood that some will always be more likely to fall for it. Given how the world has been this year and what some employees maybe have gone through the employees that will fall for this particular phishing emails may actually need more support from their employer. Either way, this isn't a vacuum and we are talking about a test that is unnecessarily cruel. Edit: just to make this more constructive, there are always alternatives. Instead of relying on emails only employees could be informed to check in via a second channel in all matters relating to money or a company's IP.
staticassertion 6y ago
I have a lot of thoughts on this, having worked on security teams, and now running a company. 1. Employees and customers are who the company should be serving. It isn't "employees at the cost of customers", or vice versa. If your business can't do both it shouldn't exist. In this case the thought was "It's worth making employees upset because this addresses a real customer concern". 2. Phishing tests are silly. You should just assume someone will get phished. If you want to do trainings, do trainings. Or, better yet, make phishing pointless - at my company anything important is gated by a U2F token, among other things. We are simply 'immune' to most types of phishing - the one major source left being wire transfer fraud, which is fairly easy to avoid. We only do phishing training for compliance purposes. 3. This is the wrong kind of security. It's "blame the user" security. It's a silly, backwards, outdated, ineffective attitude. If the goal is "Make sure people report phishing", you can do that without trickery. Just send an email and request that users report it to whoever is responsible - you'll soon find who does or does not know how to do so. 4. (Editing in) Security teams should be aware of how what they're going to do is impacting the company. The impact of this phishing test has had public impact on the company - that's a disaster. A security team is about managing risk, and here they've instead subjected the company to concrete, public scrutiny. This was simply the wrong call. Having trust in your security team is really important. Security teams need to do outreach, they need to be friendly, and be people who everyone feels good about going to with a problem. Building animosity for the sake of phishing protection is far more dangerous. > If this was a real phish they'd have leaked real data. Perhaps even your data. That's the security team's problem, not the victims!
- xyzelement 6y ago
  The term "defense in depth" comes to mind. Of course, ideally the IT team has screened out the phishing attempt and secured systems as much as they can. If they do it perfectly, then your comment applies and nothing else matters. If, however, the security team cannot be perfect, some amount of bad stuff will land with the users. This seems realistic. So training people to be security-minded is useful. It's the next line of defense. How do you train your users? "Just send an email and request that users report it to whoever is responsible" as you mention is one thing. But you can also imagine someone complying with that but then falling for a well crafted phish (that happened to me, as I mention elsewhere in this thread.) Being confronted with falling for something makes people take the threat more seriously. It takes someone's attitude from "it can't happen to me" to "oh, it did happen to me." >> at my company anything important is gated by a U2F token, among other things. We are simply 'immune' to most types of phishing I don't know your business' threats but that seems naïve. Imagine your sales team gets a phish email asking them to list your biggest customers, including contact info and revenue "so that we can send them an appropriate thank you gift for the holidays." If someone replies to this/fills out the form, you have leaked critical information even though nobody has penetrated your system (so your tokens don't help.) Even if this type of thing isn't a problem for your business, you can imagine it is for many.
tokamak-teapot 6y ago
“Really - if you slowed down for a sec and thought about security, is this the language in which your employer emails you?” Yes. Friendly language is becoming common in corporate emails. “Also, why does your employer need you to fill out any forms about your location - they know where you are.” They very often do, because things aren’t wired together within the company - and because many schemes are administered by a third party. Filling out forms with details that ‘the company knows’ is commonplace. Companies even add ‘Warning: External email’ to subject lines of emails from outside the company, but then fail to whitelist trusted third parties, so employees get used to flagged emails actually being legitimate ... and then getting used to ignoring the warnings.
ics 6y ago
Regarding the "it's free money, claim it now" language... my employer also does regular phishing tests yet I wouldn't be surprised to get this as a legitimate email. Benefits from company partners, wellness incentives, etc. all read something like this and you never really know who the company gave permission to contact you until the message comes. A few anecdotal email subjects, all to my work address, from a 15,000 head company on the S&P 500: 1. "Claim your check now! $1.50 is waiting for you" Apparently a legitimate email refunding me for one time the vending machine failed to read my card properly (but had my work ID scanned). 2. "You could be earning an additional $1000 per week– find out before it's too late" Something about our 401k but included a link to some survey that HR required we fill out. 3. "Reminder: Claim your wellness check now" I expected this to contain a link to the health survey we're supposed to complete which gives me a $5/week discount on the health insurance I get through the company. Turns out this was actually related to some other company wellness incentive which gave us gift cards for participating in various events (bike to work month, etc.). I could probably dig out more but I passed all of those along to the corporate email check to make sure and each was verified as legitimate. I'm sure plenty of other companies have made attempts to increase "social engagement" without realizing the consequences it has for security.
deleted 6y ago
[deleted]
vmception 6y ago
> Really - if you slowed down for a sec and thought about security, is this the language in which your employer emails you? That is the weakest part of your argument. Companies are notoriously incompetent, yes, even domain registrars or whatever you categorize GoDaddy as. And what if they used better language? What then? Would you simply move the goal post to another way to victim blame? I know to avoid a lot of things because of experience, I know a lot of legitimate things act like illegitimate things. And a lot of illegitimate things can masquerade adequately as competent legitimate things. For example: I know to look at the DKIM and SPF headers in an email, specifically because email clients do not show you when someone is spoofing an email address with the exact same domain name. Not a phishing domain name, the exact same one. This is a real, ongoing UI problem. And there are other flaws out there too.
LeonB 6y ago
I wonder if you’re capable of seeing that both of these are true: 1. It’s a good test 2. It’s a bad test That’s the thing that gets me. Are people (HN readers, other people) generally able to only see one of those points — or do they see both but dismiss one? In your case, @xyzelement, do you see both? I know you see what’s good about the test, but do you also see why it’s a bad test?
- xyzelement 6y ago
  >> In your case, @xyzelement, do you see both? I know you see what’s good about the test, but do you also see why it’s a bad test? I totally see why some people reacted negatively to it, though I think ideally mature people can see that it is a useful test and is trying to teach them something and thus get over it. My personal value system is that I chose tough love versus coddling because the former breeds stronger and more capable people. It's not for everyone, but for example I want people who run security for my firm to err on the former. It's a tradeoff. I don't want to work at a place that's more vulnerable because it (rightly or wrongly) assumed that employees aren't mature enough to go through a real exercise. That's just my view.
  - LeonB 6y ago
    Okay, thanks for the response. It sounds like “maturity” and “coddling” etc have a specific meaning in your value system. If someone else sees the benefit of this test but considers it needlessly harmful/cruel (and disproportionately so for different people) — I wouldn’t guess that “immaturity” is in the top 5 of the reasons why they would think that. So I found that surprising. Cheers.
    - xyzelement 6y ago
      LeonB, I appreciate this discourse and let me explain why I see maturity as a factor here. Let's assume that phishing is a real threat, and testing like this moves the needle on people's vigilance (as it has for me when I failed something like it last year.) Let's also assume that if this was a real phish, there would be really bad emotional and financial consequences. EG: imagine being the one who fell for a real phish and actually caused a huge data leak that ended up in the news and put your company out of business. Regardless of how we feel about it, the above threats are real. So we can either chose to be "nice" but increase people's vulnerability to real painful consequences , or we can chose to be "tough" because we realize that in the long run it creates greater actual security for everyone. To me that's "tough love" - harsher short term decisions to help everyone in the long run. It indeed feels adult and mature to take the tough and unpopular decision that aims to address the real risk, and conversely irresponsible to say "we can't deal with the problem because it'll be unpopular and someone may get upset." There's maturity on the flip side too. When I failed the phishing test, it was a wakeup call. In retrospect I should have caught it but I wasn't careful enough. So I am grateful the company did it because it taught me a valuable lesson that will keep me safer in the future. If my response was instead "those fuckers tricked me" or whatever, it would have been childish, because it ignores that the risk is real and that it's really I who has the power to do better.
runarberg 6y ago
First you should establish that this "training" is effective in raising security standards. I’m skeptical it does. When working as a life guard we never did live testing (i.e. training without knowing it is training) simply because results are mixed at best. Trainees are stressed in a live scenario and are unlikely to really "learn" anything from the experience. Worst case scenario, trainees will experience stress to a level where they will be harmed by the experience. Second security should not fail on a successful phishing attempt. If a worker opens a phishing email and it compromise your security, you’ve got bigger problems. Thirdly, don’t discount workers experience of having failed a task. It is extremely unpleasant and stressful. Workers health matters, and to subject us to unessisary stress levels is simply evil. There is no excuse. Find a better way to secure your system.
fortran77 6y ago
Exactly right. And godaddy employees have been phished and social-engineered to transfer domains. Good for them for trying to train their employees.
TechBro8615 6y ago
I don’t see any problem with the phishing test. But if you’re going to do it like this, when it’s over you should actually give your employees the bonus. Otherwise it’s just tasteless.
tlogan 6y ago
There are two things an employee will learn from this test: - I’m never going to get bonus - regardless of what they promised me - don’t trust security team: they are cruel and they will probably hurt me and my family in order to get promoted Sure security team did a great phishing job. Did they improved security? Nope.
industriousthou 6y ago
Yeah, it makes sense to test for this kind of thing, but they should have planned to give the bonuses to everyone regardless of how they responded to the phishing attempt.
twirlock 6y ago
They could have sent any email they wanted, and they chose to disappoint their employees about nonexistent bonuses during the holiday season of a pandemic. The consequence for the test should have been a mass exodus of their more talented engineers.
glouwbug 6y ago
I've never understood why phishers wouldn't just brush up a little on their english, or at least have their phishing email reviewed by a friend. I mean, proper English is so much more effective. At least learn some proper grammar before launching an attack
smsm42 6y ago
There are scammers that call people and claim their relative is in danger or badly hurt or in hospital dying and they need to urgently do this and that to help them - and people are deceived exactly because the stress makes their response less measured and more susceptible to deceit. That doesn't mean that ethical company would employ such tactics in a pentest. There's a limit of how far you can go in simulation. Surely, real criminals could do it - but the company can maintain vigilance without resorting to essentially replicating the villains and causing almost as much harm to the victims as the real villains do. I'm astonished how nobody at GD could predict what emotional harm would such a trick cause. There's a lot of ways to test it without such a cruel method. Even reviews - that you mentioned - would work as well without being cruel.
koonsolo 6y ago
Are you managing people or customer expectations? If so, how many already left because of the rational explanations of your lack of empathy? If not, keep it that way, you don't have the emotional capacity to lead others. If my employer pulls this prank on me, they can either give a formal apology to everyone, give me the actual bonus, or find another developer.
supergirl 6y ago
> Also, why does your employer need you to fill out any forms about your location - they know where you are. pff, this happens all the time (although not for bonuses, but for things like branded cloths or surveys). you can't expect HR to automate this kind of stuff every time. it's much easier to just design a google form than to make a script that calls APIs.

galacticaactual 6y ago

I explicitly told my penetration testers to avoid anything like this. Invoking and then revoking a bonus email in a year where folks are already hard hit financially and mentally under the guise of “education” is lazy and any security leader who does it is a fool. Effective security culture builds rapport with business units. This type of nonsense does the exact opposite. Yes you may have proven a tactical point, but you have just set yourself up to lose the war.

johnghanks 6y ago
wasn't the bonus real, though?
otterley 6y ago
This one is tricky. Effective phishing preys on the weak and the vulnerable. For better or worse, we do have to train people -- even weak and vulnerable people -- not to fall for scams, and there's no better way we know of than to do training exercises. Cruel though it may sound, unless we can think of a better way, I think it's the most effective option. The fact that employees are failing this proves the point, and until we can show that they are no longer falling for it, it shows how vulnerable we remain from an infosec posture.
- galacticaactual 6y ago
  Again, while you may be proving a point and obtain a localized victory, it is Pyrrhic. There are other phishing scenarios that can be tailored for the proclivities of each team. Overdue POs for purchasing. “Hey I saw some source code leaked on this site” for engineering. Etc etc. The only reason you would have to send something like this is because you are lazy, need to generalize quickly, and blast it to the company. And you will teach a lesson. And you will kill any goodwill to the security team as a byproduct.
  - otterley 6y ago
    How would this other form of exercise you propose demonstrate that the staff isn't vulnerable to a fictitious promise of a bonus sent by a malicious outside actor? I disagree that one can characterize the simulation of a specific scenario as "lazy." Is it unusually attractive to the target? Yes. Lazy? No.
    - galacticaactual 6y ago
      Ask yourself what the purpose of proving this point is other than a vanity metric. Then ask yourself whether that should be the actual goal. Because it seems to me the actual goal is to have a workforce with generally high awareness and caution around phishing risks in general - and that can be built without goodwill-destroying tactics like this.
      - 6y ago
axaxs 6y ago
Why not have both? That is, plan to provide a real bonus and amount, even if it's just 100 bucks. Beforehand, send out said phishing email, and collect data. Provide the bonus to everyone. Once the holiday is over, notify employees who failed the test of how easy it is to prey on people's emotion and to be careful, that email was in fact in no way tied to the bonus.
- mcphage 6y ago
  That might be fine, but that’s not what GoDaddy did.
- deleted 6y ago
  [deleted]
shmageggy 6y ago
GoDaddy doing something unethical?! Color me shocked.
deleted 6y ago
[deleted]
kryogen1c 6y ago
> Yes you may have proven a tactical point, but you have just set yourself up to lose the war. you glossed over this point, but it is nonobvious. how exactly does making your users skeptical of email "lose the war"? are they going to type in their passwords out of spite now? the gp is exactly right. if you have a line you wont cross to train your users, then youre leaving a vulnerability. if you want to make the argument that the vuln is worth not "being mean" to your employees, then make that argument, but don't pretend its more secure.
- bluntfang 6y ago
  if you make your employees feel bad on purpose and have a track record of insensitivity, they won't like you. People who don't like you won't act in your interest to a high capacity. I don't think GP was ambiguous at all, to be honest. This point was extremely clear. It feels like you came to the discussion with an axe to grind.
- WrtCdEvrydy 6y ago
  > if you have a line you wont cross to train your users, then youre leaving a vulnerability. How about a phishing test that downloads something that nukes your hard drive?
  - Supermancho 6y ago
    > > if you have a line you wont cross to train your users, then youre leaving a vulnerability. > How about a phishing test that downloads something that nukes your hard drive? The phishing weakness opens that possibility. The act of wiping the HD does nothing to improve behavior or identify weakness.
  - inerte 6y ago
    How about gov sec launching nuclear attacks on every major country?
  - utucuro 6y ago
    Now that's a good idea - where I work, our security policy is such that I should be able to destroy any (company) computing equipment an end user is using and the loss of data should be restricted to their unsaved changes. A test like you propose would be a very memorable reminder for information security awareness, and so might be really effective before infrastructure upgrades if restricted to people with hardware about to be phased out, you need to nuke old hard drives at that point anyway...
Alex3917 6y ago
> Effective security culture builds rapport with business units. This type of nonsense does the exact opposite. But these emails presumably weren't even coming from the company's domain, since they were phishing emails.
- jdbernard 6y ago
  Unless I misread the article, these were from the company's domain: > Sent by Happyholiday@Godaddy.com
  - Alex3917 6y ago
    You misread the article. The article is saying that the emails said they were from the godaddy.com, but it doesn't say that they were actually sent from godaddy.com.
- horsawlarway 6y ago
  Internal domain, custom image with GoDaddy logo, no obvious spelling problems or mistakes. Go look at the image in the article. I don't work there so maybe something in it should have set off red flags for employees, but generally speaking - That's a very high quality phishing attempt.

fileeditview 6y ago

It might be a realistic scenario and thus a "good" test. It still is a total dick move to do this as an employer. Some things you just should not do to your employees. There are a million other fishing scenarios that are realistic where you don't have to be promised money by your employer.

xyzelement 6y ago
It's a choice between comfort and survival. There are more humane ways to train an army than to make them think of situations where someone is trying to kill them, but... if that comes at the expense of worse training (and therefore actual higher likelihood of death) then it doesn't do anyone favors. The fact that so many people fell for this test means there's something (obviously!) around this scenario that makes it particularly sensitive and mistake-prone for people. Your IT department may chose to avoid it, but people trying to phish you, won't.
- galacticaactual 6y ago
  A company is not an army. You don’t train your employees on active shooter drills by having a guy barge in shooting blanks. Source: was in the army.
  - xyzelement 6y ago
    Thank you for your service. Hopefully you can appreciate the tradeoff between mental/emotional discomfort and an actual problem that was the point of my analogy.
    - thereare5lights 6y ago
      They don't. That's why they disagreed with you. The tradeoff here is an idiotic one. You don't set your own building on fire in order to test fire safety. You don't destroy company morale to test phishing security. It's really that simple.

lights0123 6y ago

I'm unfamiliar with corporate expectations regarding phishing emails—are you not supposed to click on links sent from an internal email address? The article clearly shows the email coming from an @godaddy.com address, and I'd think that them misconfiguring SPF/whatever is a much bigger deal.

xyzelement 6y ago
I don't remember the exact language of the training but there's a "use your head" element. Someone you don't know is emailing you something that doesn't really make sense - stop and don't comply. There are lots of reasons the email could have internal addresses (a misconfiguration, a similar-looking domain, an internal threat, whatever) - don't rely on that if other red flags are up.
- treis 6y ago
  How crappy of a company would you have to be where a year end bonus doesn't really make sense.
  - xyzelement 6y ago
    If you read the text of the GoDaddy phish, there's something like "CLICK HERE NOW TO CLAIM YOUR FREE MONEY BEFORE ITS TOO LATE". If it was just a notification "btw you'll find a little extra something in your check this month" without requiting any weird action from the employee (which btw is how this would look if it was real) then it's a totally different thing.

tsimionescu 6y ago

Security is important, but it does not trump any other consideration. Will they next send employees emails claiming their loved ones are in danger, because that is something real hackers might do? Would you consider that ethical behavior? It's actually a pretty common scam, at least in my country (normally done to defraud old people, not to steal company secrets, but still). I'd expect to see a very convincing study that would show that this type of emotional response is crucial for accurately training people to recognize real phishing before I accepted in any way that this was ethical. Absent strong evidence in this regard, this is utterly disgusting.

xyzelement 6y ago
I guess that's subjective. In my old company, people generally just felt "yup, people are out to get us, and this test is making me realize how vulnerable I am to screwing it up and is therefore a good reminder." However this one makes you feel, how would you feel if this was the real phish and you were the one who leaked sensitive customer data because you fell for it?
- tsimionescu 6y ago
  You are assuming that seeing real emotional stakes in the phishing exercise actually helps with recognizing the same in a real phishing email. I very much doubt the validity of this argument. Note: I'm not against testing your employees for phishing attempts. That is extremely valuable. I'm against using something with an emotional impact as the pretext of the phish, when I believe a more neutral pretext will do just as well. A separate note is that according to the pictures shown, it seems this is also a particularly bad example, as the email has legitimate headers, showing that it's coming from godaddy.com - so it would only rely on employees distrusting the contents to recognize it as phishing, which is a bad lesson to teach.
  - xyzelement 6y ago
    Sorry tsimionescu but I read your post as follows: It's ok for company to prepare its users for phishing, except for the kind of phishing where the attackers: (a) devised an emotional hook (b) put in effort to make it look legit. You can see how that creates a vulnerability, right, because a moderately sophisticated phisher would aim to do (a) and (b) every time.

philplckthun 6y ago

We actually don't know what the usual communiqués internally at GoDaddy look like. In a vacuum we can also judge this to be an effective test. In practice there are many unknowns and factors we don't know about though. In my opinion phishing is also an issue at scale when we talk about companies; meaning, there's a likelihood that some will always be more likely to fall for it. Given how the world has been this year and what some employees maybe have gone through the employees that will fall for this particular phishing emails may actually need more support from their employer. Either way, this isn't a vacuum and we are talking about a test that is unnecessarily cruel. Edit: just to make this more constructive, there are always alternatives. Instead of relying on emails only employees could be informed to check in via a second channel in all matters relating to money or a company's IP.

staticassertion 6y ago

I have a lot of thoughts on this, having worked on security teams, and now running a company. 1. Employees and customers are who the company should be serving. It isn't "employees at the cost of customers", or vice versa. If your business can't do both it shouldn't exist. In this case the thought was "It's worth making employees upset because this addresses a real customer concern". 2. Phishing tests are silly. You should just assume someone will get phished. If you want to do trainings, do trainings. Or, better yet, make phishing pointless - at my company anything important is gated by a U2F token, among other things. We are simply 'immune' to most types of phishing - the one major source left being wire transfer fraud, which is fairly easy to avoid. We only do phishing training for compliance purposes. 3. This is the wrong kind of security. It's "blame the user" security. It's a silly, backwards, outdated, ineffective attitude. If the goal is "Make sure people report phishing", you can do that without trickery. Just send an email and request that users report it to whoever is responsible - you'll soon find who does or does not know how to do so. 4. (Editing in) Security teams should be aware of how what they're going to do is impacting the company. The impact of this phishing test has had public impact on the company - that's a disaster. A security team is about managing risk, and here they've instead subjected the company to concrete, public scrutiny. This was simply the wrong call. Having trust in your security team is really important. Security teams need to do outreach, they need to be friendly, and be people who everyone feels good about going to with a problem. Building animosity for the sake of phishing protection is far more dangerous. > If this was a real phish they'd have leaked real data. Perhaps even your data. That's the security team's problem, not the victims!

xyzelement 6y ago
The term "defense in depth" comes to mind. Of course, ideally the IT team has screened out the phishing attempt and secured systems as much as they can. If they do it perfectly, then your comment applies and nothing else matters. If, however, the security team cannot be perfect, some amount of bad stuff will land with the users. This seems realistic. So training people to be security-minded is useful. It's the next line of defense. How do you train your users? "Just send an email and request that users report it to whoever is responsible" as you mention is one thing. But you can also imagine someone complying with that but then falling for a well crafted phish (that happened to me, as I mention elsewhere in this thread.) Being confronted with falling for something makes people take the threat more seriously. It takes someone's attitude from "it can't happen to me" to "oh, it did happen to me." >> at my company anything important is gated by a U2F token, among other things. We are simply 'immune' to most types of phishing I don't know your business' threats but that seems naïve. Imagine your sales team gets a phish email asking them to list your biggest customers, including contact info and revenue "so that we can send them an appropriate thank you gift for the holidays." If someone replies to this/fills out the form, you have leaked critical information even though nobody has penetrated your system (so your tokens don't help.) Even if this type of thing isn't a problem for your business, you can imagine it is for many.

tokamak-teapot 6y ago

“Really - if you slowed down for a sec and thought about security, is this the language in which your employer emails you?” Yes. Friendly language is becoming common in corporate emails. “Also, why does your employer need you to fill out any forms about your location - they know where you are.” They very often do, because things aren’t wired together within the company - and because many schemes are administered by a third party. Filling out forms with details that ‘the company knows’ is commonplace. Companies even add ‘Warning: External email’ to subject lines of emails from outside the company, but then fail to whitelist trusted third parties, so employees get used to flagged emails actually being legitimate ... and then getting used to ignoring the warnings.

ics 6y ago

Regarding the "it's free money, claim it now" language... my employer also does regular phishing tests yet I wouldn't be surprised to get this as a legitimate email. Benefits from company partners, wellness incentives, etc. all read something like this and you never really know who the company gave permission to contact you until the message comes. A few anecdotal email subjects, all to my work address, from a 15,000 head company on the S&P 500: 1. "Claim your check now! $1.50 is waiting for you" Apparently a legitimate email refunding me for one time the vending machine failed to read my card properly (but had my work ID scanned). 2. "You could be earning an additional $1000 per week– find out before it's too late" Something about our 401k but included a link to some survey that HR required we fill out. 3. "Reminder: Claim your wellness check now" I expected this to contain a link to the health survey we're supposed to complete which gives me a $5/week discount on the health insurance I get through the company. Turns out this was actually related to some other company wellness incentive which gave us gift cards for participating in various events (bike to work month, etc.). I could probably dig out more but I passed all of those along to the corporate email check to make sure and each was verified as legitimate. I'm sure plenty of other companies have made attempts to increase "social engagement" without realizing the consequences it has for security.

deleted 6y ago

[deleted]

vmception 6y ago

> Really - if you slowed down for a sec and thought about security, is this the language in which your employer emails you? That is the weakest part of your argument. Companies are notoriously incompetent, yes, even domain registrars or whatever you categorize GoDaddy as. And what if they used better language? What then? Would you simply move the goal post to another way to victim blame? I know to avoid a lot of things because of experience, I know a lot of legitimate things act like illegitimate things. And a lot of illegitimate things can masquerade adequately as competent legitimate things. For example: I know to look at the DKIM and SPF headers in an email, specifically because email clients do not show you when someone is spoofing an email address with the exact same domain name. Not a phishing domain name, the exact same one. This is a real, ongoing UI problem. And there are other flaws out there too.

LeonB 6y ago

I wonder if you’re capable of seeing that both of these are true: 1. It’s a good test 2. It’s a bad test That’s the thing that gets me. Are people (HN readers, other people) generally able to only see one of those points — or do they see both but dismiss one? In your case, @xyzelement, do you see both? I know you see what’s good about the test, but do you also see why it’s a bad test?

xyzelement 6y ago
>> In your case, @xyzelement, do you see both? I know you see what’s good about the test, but do you also see why it’s a bad test? I totally see why some people reacted negatively to it, though I think ideally mature people can see that it is a useful test and is trying to teach them something and thus get over it. My personal value system is that I chose tough love versus coddling because the former breeds stronger and more capable people. It's not for everyone, but for example I want people who run security for my firm to err on the former. It's a tradeoff. I don't want to work at a place that's more vulnerable because it (rightly or wrongly) assumed that employees aren't mature enough to go through a real exercise. That's just my view.
- LeonB 6y ago
  Okay, thanks for the response. It sounds like “maturity” and “coddling” etc have a specific meaning in your value system. If someone else sees the benefit of this test but considers it needlessly harmful/cruel (and disproportionately so for different people) — I wouldn’t guess that “immaturity” is in the top 5 of the reasons why they would think that. So I found that surprising. Cheers.
  - xyzelement 6y ago
    LeonB, I appreciate this discourse and let me explain why I see maturity as a factor here. Let's assume that phishing is a real threat, and testing like this moves the needle on people's vigilance (as it has for me when I failed something like it last year.) Let's also assume that if this was a real phish, there would be really bad emotional and financial consequences. EG: imagine being the one who fell for a real phish and actually caused a huge data leak that ended up in the news and put your company out of business. Regardless of how we feel about it, the above threats are real. So we can either chose to be "nice" but increase people's vulnerability to real painful consequences , or we can chose to be "tough" because we realize that in the long run it creates greater actual security for everyone. To me that's "tough love" - harsher short term decisions to help everyone in the long run. It indeed feels adult and mature to take the tough and unpopular decision that aims to address the real risk, and conversely irresponsible to say "we can't deal with the problem because it'll be unpopular and someone may get upset." There's maturity on the flip side too. When I failed the phishing test, it was a wakeup call. In retrospect I should have caught it but I wasn't careful enough. So I am grateful the company did it because it taught me a valuable lesson that will keep me safer in the future. If my response was instead "those fuckers tricked me" or whatever, it would have been childish, because it ignores that the risk is real and that it's really I who has the power to do better.

runarberg 6y ago

First you should establish that this "training" is effective in raising security standards. I’m skeptical it does. When working as a life guard we never did live testing (i.e. training without knowing it is training) simply because results are mixed at best. Trainees are stressed in a live scenario and are unlikely to really "learn" anything from the experience. Worst case scenario, trainees will experience stress to a level where they will be harmed by the experience. Second security should not fail on a successful phishing attempt. If a worker opens a phishing email and it compromise your security, you’ve got bigger problems. Thirdly, don’t discount workers experience of having failed a task. It is extremely unpleasant and stressful. Workers health matters, and to subject us to unessisary stress levels is simply evil. There is no excuse. Find a better way to secure your system.

fortran77 6y ago

Exactly right. And godaddy employees have been phished and social-engineered to transfer domains. Good for them for trying to train their employees.

TechBro8615 6y ago

I don’t see any problem with the phishing test. But if you’re going to do it like this, when it’s over you should actually give your employees the bonus. Otherwise it’s just tasteless.

tlogan 6y ago

There are two things an employee will learn from this test: - I’m never going to get bonus - regardless of what they promised me - don’t trust security team: they are cruel and they will probably hurt me and my family in order to get promoted Sure security team did a great phishing job. Did they improved security? Nope.

industriousthou 6y ago

Yeah, it makes sense to test for this kind of thing, but they should have planned to give the bonuses to everyone regardless of how they responded to the phishing attempt.

twirlock 6y ago

They could have sent any email they wanted, and they chose to disappoint their employees about nonexistent bonuses during the holiday season of a pandemic. The consequence for the test should have been a mass exodus of their more talented engineers.

glouwbug 6y ago

I've never understood why phishers wouldn't just brush up a little on their english, or at least have their phishing email reviewed by a friend. I mean, proper English is so much more effective. At least learn some proper grammar before launching an attack

smsm42 6y ago

There are scammers that call people and claim their relative is in danger or badly hurt or in hospital dying and they need to urgently do this and that to help them - and people are deceived exactly because the stress makes their response less measured and more susceptible to deceit. That doesn't mean that ethical company would employ such tactics in a pentest. There's a limit of how far you can go in simulation. Surely, real criminals could do it - but the company can maintain vigilance without resorting to essentially replicating the villains and causing almost as much harm to the victims as the real villains do. I'm astonished how nobody at GD could predict what emotional harm would such a trick cause. There's a lot of ways to test it without such a cruel method. Even reviews - that you mentioned - would work as well without being cruel.

koonsolo 6y ago

Are you managing people or customer expectations? If so, how many already left because of the rational explanations of your lack of empathy? If not, keep it that way, you don't have the emotional capacity to lead others. If my employer pulls this prank on me, they can either give a formal apology to everyone, give me the actual bonus, or find another developer.

supergirl 6y ago

> Also, why does your employer need you to fill out any forms about your location - they know where you are. pff, this happens all the time (although not for bonuses, but for things like branded cloths or surveys). you can't expect HR to automate this kind of stuff every time. it's much easier to just design a google form than to make a script that calls APIs.