6 ms·

>I am a Red Teamer and work with companies OK, how do you test SocEng vectors? Do you obtain consent and coordinate with every employee that might be targeted

>I am a Red Teamer and work with companies OK, how do you test SocEng vectors? Do you obtain consent and coordinate with every employee that might be targeted to receive your e-mail? >You also study submitting from yandex, gmail, .cn and other email addresses No, the point was submitting from a known and respectable entity, which might affect the level of scrutiny. They weren't testing a whole patching process, but a specific human component of it.

soarfourmore 5y ago
You don’t. You work with the leadership & security team. Any employee that clicks your phishing email gets an extra dose of security training. Those that forward the email to abuse@corp.com get a nice compliment
- alanfranz 5y ago
  Just clicking the link is enough to fail? No need to enter private info or execute downloaded files? Either your phising emails are badly crafted or you expect employees to see the future.
  - llimos 5y ago
    Agreed. This is something that made me very annoyed when they did it to us. I know exactly what I'm doing, I know that you can't infect a computer from opening a link unless the attacker possesses a new browser 0-day, and expecting your average employee to worry about new browser 0-days is ridiculous. If it were an obvious phishing URL, like a variation on the company domain, then fine (maybe). But it wasn't.
    - D2187645 5y ago
      Same domain cant garunteed to be safe.
    - createdapril24 5y ago
      I've run such phishing campaigns where the link: 1. (Windows specific) Opens up a Windows file share, which causes the person to authenticate to the file share, which through PtH/Responder results in their enterprise credentials being stolen. 2. Exploited a XSS or CSRF attack on an internal/management endpoint. Which in turns allows a pivot from external to internal access. 3. Steals a web session, cached password or authentication token, resulting in compromise of employee credentials to be used elsewhere (e.g. reused to access enterprise VPN). These are just some not-a-browser-0day examples of a single click being game-over dangerous.
      - alanfranz 5y ago
        That exploit could happen ANYWHERE on the web. Any freaking link. Anything on a newspaper website, or social network. You're talking about vulnerabilities in components, or other software, here. The user, by himself, is doing nothing wrong. Why don't you just restrict employees to the intranet, then? Why do you give them free roam on the whole internet, but then you tell them "don't click the wrong link!". Phishing happens when the user does something which is actively wrong. When the user opens an Word/Excel with VBA from an untrusted source and bypasses security restrictions. If they execute/install something unsigned and untrusted from some random site. Click = fail is just wrong. Links are how the internet works. You aren't teaching anything.
      - ric2b 5y ago
        > 3. Steals a web session, cached password or authentication token, resulting in compromise of employee credentials to be used elsewhere (e.g. reused to access enterprise VPN). How do you do this without a browser vulnerability (and assuming it's not also XSS/CSRF like the previous point)?
        createdapril24 5y ago
        You can do this with chains of vulnerabilities, including but not limited to insecure redirects, CSP bypasses, insecure cookies. Another useful technique is session fixation - you give your victims sessions you've started and often their SSO experience will connect _their_ credentials to _your_ session. Also to distinguish between #3 and, XSS in #2 was intended to mean "persistent stored XSS" as opposed to "reflected XSS". In the case of reflected XSS, this can be chained with CSP bypasses and insecure cookies to grab out e.g. bearer tokens. My overall point is that heap fung shui 0day not required for 1-click ownage. In practice, I've not had to burn browser 0day to compromise organizations or their customers.
  - GordonS 5y ago
    Megacorp I work at does this. I think I've had around 1 phishing mail per month for the last year or so, and yes, just clicking the link is enough to fail. It's particularly annoying where I work, as the company itself sends out a completely unreasonable amount of internal spam every.single.day - often with bad spelling/grammar, and very often with the contents being a single image with rendered text (why?!?!).
    - jcims 5y ago
      A popular phishing test vendor populates message headers with a very specific word that you can build a mail rule from. In three years it has flawlessly identified every test sent my way with zero false positives.
  - freebreakfast 5y ago
    > Just clicking the link is enough to fail? Yes, clicking on links is dangerous[0]. 0. https://www.bleepingcomputer.com/news/security/google-fixes-exploited-chrome-zero-day-dropped-on-twitter-last-week/ https://www.bleepingcomputer.com/news/security/google-fixes-...
    - alanfranz 5y ago
      So, we don't click on links anymore? Anywhere on the internet? Just about any site can deliver a malicious link. How can I tell whether I can click on a link? Sometimes there's even something like linkprotector.outlook.com/[very_long_url] in corporate emails. My usual approach if I'm unsure whether a link is malicious would be to open it in a private window (and probably in a different browser from the one I usually employ), or if I really think it's phishy, I would open it from within throwaway VM. So, the blanket "click and fail" policy seems pointless to me. If I enter some login/PII, then I can agree I've failed the test. But a click on a link cannot be considered failure.
celticninja 5y ago
I think it would be obvious that you work with the organisation security team and not individuals.
rincebrain 5y ago
> No, the point was submitting from a known and respectable entity They weren't, though - their own paper explicitly says they used newly created Gmail addresses for the patches... "We submit the three patches using a random Gmail account to the Linux community and seek their feedback—whether the patches look good to them."

soarfourmore 5y ago

You don’t. You work with the leadership & security team. Any employee that clicks your phishing email gets an extra dose of security training. Those that forward the email to abuse@corp.com get a nice compliment

alanfranz 5y ago
Just clicking the link is enough to fail? No need to enter private info or execute downloaded files? Either your phising emails are badly crafted or you expect employees to see the future.
- llimos 5y ago
  Agreed. This is something that made me very annoyed when they did it to us. I know exactly what I'm doing, I know that you can't infect a computer from opening a link unless the attacker possesses a new browser 0-day, and expecting your average employee to worry about new browser 0-days is ridiculous. If it were an obvious phishing URL, like a variation on the company domain, then fine (maybe). But it wasn't.
  - D2187645 5y ago
    Same domain cant garunteed to be safe.
  - createdapril24 5y ago
    I've run such phishing campaigns where the link: 1. (Windows specific) Opens up a Windows file share, which causes the person to authenticate to the file share, which through PtH/Responder results in their enterprise credentials being stolen. 2. Exploited a XSS or CSRF attack on an internal/management endpoint. Which in turns allows a pivot from external to internal access. 3. Steals a web session, cached password or authentication token, resulting in compromise of employee credentials to be used elsewhere (e.g. reused to access enterprise VPN). These are just some not-a-browser-0day examples of a single click being game-over dangerous.
    - alanfranz 5y ago
      That exploit could happen ANYWHERE on the web. Any freaking link. Anything on a newspaper website, or social network. You're talking about vulnerabilities in components, or other software, here. The user, by himself, is doing nothing wrong. Why don't you just restrict employees to the intranet, then? Why do you give them free roam on the whole internet, but then you tell them "don't click the wrong link!". Phishing happens when the user does something which is actively wrong. When the user opens an Word/Excel with VBA from an untrusted source and bypasses security restrictions. If they execute/install something unsigned and untrusted from some random site. Click = fail is just wrong. Links are how the internet works. You aren't teaching anything.
    - ric2b 5y ago
      > 3. Steals a web session, cached password or authentication token, resulting in compromise of employee credentials to be used elsewhere (e.g. reused to access enterprise VPN). How do you do this without a browser vulnerability (and assuming it's not also XSS/CSRF like the previous point)?
      - createdapril24 5y ago
        You can do this with chains of vulnerabilities, including but not limited to insecure redirects, CSP bypasses, insecure cookies. Another useful technique is session fixation - you give your victims sessions you've started and often their SSO experience will connect _their_ credentials to _your_ session. Also to distinguish between #3 and, XSS in #2 was intended to mean "persistent stored XSS" as opposed to "reflected XSS". In the case of reflected XSS, this can be chained with CSP bypasses and insecure cookies to grab out e.g. bearer tokens. My overall point is that heap fung shui 0day not required for 1-click ownage. In practice, I've not had to burn browser 0day to compromise organizations or their customers.
- GordonS 5y ago
  Megacorp I work at does this. I think I've had around 1 phishing mail per month for the last year or so, and yes, just clicking the link is enough to fail. It's particularly annoying where I work, as the company itself sends out a completely unreasonable amount of internal spam every.single.day - often with bad spelling/grammar, and very often with the contents being a single image with rendered text (why?!?!).
  - jcims 5y ago
    A popular phishing test vendor populates message headers with a very specific word that you can build a mail rule from. In three years it has flawlessly identified every test sent my way with zero false positives.
- freebreakfast 5y ago
  > Just clicking the link is enough to fail? Yes, clicking on links is dangerous[0]. 0. https://www.bleepingcomputer.com/news/security/google-fixes-exploited-chrome-zero-day-dropped-on-twitter-last-week/ https://www.bleepingcomputer.com/news/security/google-fixes-...
  - alanfranz 5y ago
    So, we don't click on links anymore? Anywhere on the internet? Just about any site can deliver a malicious link. How can I tell whether I can click on a link? Sometimes there's even something like linkprotector.outlook.com/[very_long_url] in corporate emails. My usual approach if I'm unsure whether a link is malicious would be to open it in a private window (and probably in a different browser from the one I usually employ), or if I really think it's phishy, I would open it from within throwaway VM. So, the blanket "click and fail" policy seems pointless to me. If I enter some login/PII, then I can agree I've failed the test. But a click on a link cannot be considered failure.

celticninja 5y ago

I think it would be obvious that you work with the organisation security team and not individuals.

rincebrain 5y ago

> No, the point was submitting from a known and respectable entity They weren't, though - their own paper explicitly says they used newly created Gmail addresses for the patches... "We submit the three patches using a random Gmail account to the Linux community and seek their feedback—whether the patches look good to them."