5 ms·

That's the very sad thing, it's harder and harder to differentiate phishing from real email campaign, not only because phishing is getting better at imitating r

by forty 5y ago

That's the very sad thing, it's harder and harder to differentiate phishing from real email campaign, not only because phishing is getting better at imitating real emails, but because real marketing emails are using the same tricks as phishing to have people open the mail and click on links.

vmception 5y ago
Yes and its pervasive because people are willing to blame[/suggest] the victim [was at fault] When much of this stuff is getting more sophisticated and identical to legitimate emails
citrin_ru 5y ago
+many Very sad that legitimate emails are often so bad that even after researching for 10-15 minutes I cannot be sure if a message is legitimate or not. And I'm working with email professionally (as sysadmin/SRE) for more than 10 years. Regular email users who are not email expects can either trust all emails or delete most of them. Security trainings which tell don't open suspicious emails are useless because most emails are suspicious. PayPal, many utility providers even some big banks send very suspicious emails. A typical example of fishy but legitimate emails is when company with the main domain example.com send emails from a different but similarly looking domain e. g. example-invoices.com and: whois is hidden using whois privacy, there is no website on this domain (even if there is - why should I trust it?), infrastructure is completely different from the main domain. In other words example-invoices.com have nothing in common with example.com the only way I can think example-invoices.com is legit - they know some personal data of a recipient but if you're paranoid you can expect this to come from a breach which nowadays are common.
- quitit 5y ago
  When businesses out source part of their operations to a 3rd party it's often challenging and slow to get a proper system in place. Instead the 3rd party and company will agree to register a similar looking domain, and thus the problems begin. This is incredibly common with short-lived projects such as a promotional website, or after downsizing with expert services such as legal/financial/support being awarded on contract. It's also very common with local subsidiaries of larger companies. Where the website is run from HQ, and the local regions have no ability whatsoever to plug into that system.
- a3n 5y ago
  > Regular email users who are not email experts can either trust all emails or delete most of them. I do the latter. Default practice these days should be do not respond to any phone call, text, email etc. if you don't recognize it, and if you have a non-personal relationship to what appears to be the sender, don't answer it unless it's a response to your initial communication. Communications these days are mostly vans with candy and missing puppies. Based on my spam folder and incoming call records anyway.
  - jimmygrapes 5y ago
    Your candy van's extended warranty is about to expire!
gxnxcxcx 5y ago
It's not just the marketing side, every customer facing thing corporations can outsource is being pipelined through the same kind of ad-like machinery. After considerable effort educating the non-technically inclined members of the family to check URLs to avoid shenanigans, cue our ISP sending very important confirmation links via SMS (bad enough) pointing to isp-name.onelink.me, amid a particularly active wave of SMS phishing scams earlier this year. One of the top 10 telecom corps worldwide in size and the mf'ers couldn't bother using their own domain.
- Nextgrid 5y ago
  Spam filters should catch up and filter out all that crap as malicious.
  - bob778 5y ago
    The problem is that, by definition, it isn’t malicious: it’s just incredibly poorly planned legitimate communications. Filtering it out will just make it harder for users to get key information.
    - smolder 5y ago
      I think that might be the point; it would create a headache for the company and its users and when they do the retrospective they'll find that use of unverifiable domains was the mistake. Or using the vendor who uses them was the mistake. Filtering that catches "false positives" which are indiscernible from phishing is 10x more likely to curb this practice than trying to educate anyone about the problem.
    - Nextgrid 5y ago
      It is - marketing platform links often track you (which is in breach of the GDPR btw), conceal the true target of the links (so you can't tell whether the final target is legitimate) and most marketing platforms are for some reason obsessed with HTTP even when the final target link is HTTPS, exposing you to risk on insecure networks.
aljarry 5y ago
My company makes everyone take phishing training twice a year, yet at the same time they pay for services that send emails looking like phishing. Outlook of course shows the warning "This email originated from outside of organization. Please be mindful of phishing attempts...". It's not only marketing. Tons of services allow spoofing senders name, and try convince you they've been sent by actual people.
- tharkun__ 5y ago
  I'm interested: Does your company in this training allow you access to what usually is a dead simple way to identify 99% or phishing/spam emails? I luckily don't work for companies that do this regularly but the ones I've seen online before and the one I did have to do, do not give you access to the headers. While I realize that most non-techies won't know how to do any of that, it's the easiest for any technically inclined person. The first defence is the real email address (which I always have displayed by default anyway), which gets rid of a large swath of them already and the rest are usually pretty clear from some of the others headers. It has never happened to me that something as intriguing as this post's message came in.
  - aljarry 5y ago
    Of course not :) They are targeted towards non-techies. Look at emails content, there's domain which looks funky and a URL you're asked to click -> that's phishing for sure! Which begs a question: why they haven't "blessed" the messages from external providers, that are actually legit? Like with a warning "This message comes from a trusted third party".
a3n 5y ago
Any sufficiently smelly marketing campaign is indistinguishable from phishing.

by forty 5y ago

vmception 5y ago

Yes and its pervasive because people are willing to blame[/suggest] the victim [was at fault] When much of this stuff is getting more sophisticated and identical to legitimate emails

citrin_ru 5y ago

+many Very sad that legitimate emails are often so bad that even after researching for 10-15 minutes I cannot be sure if a message is legitimate or not. And I'm working with email professionally (as sysadmin/SRE) for more than 10 years. Regular email users who are not email expects can either trust all emails or delete most of them. Security trainings which tell don't open suspicious emails are useless because most emails are suspicious. PayPal, many utility providers even some big banks send very suspicious emails. A typical example of fishy but legitimate emails is when company with the main domain example.com send emails from a different but similarly looking domain e. g. example-invoices.com and: whois is hidden using whois privacy, there is no website on this domain (even if there is - why should I trust it?), infrastructure is completely different from the main domain. In other words example-invoices.com have nothing in common with example.com the only way I can think example-invoices.com is legit - they know some personal data of a recipient but if you're paranoid you can expect this to come from a breach which nowadays are common.

quitit 5y ago
When businesses out source part of their operations to a 3rd party it's often challenging and slow to get a proper system in place. Instead the 3rd party and company will agree to register a similar looking domain, and thus the problems begin. This is incredibly common with short-lived projects such as a promotional website, or after downsizing with expert services such as legal/financial/support being awarded on contract. It's also very common with local subsidiaries of larger companies. Where the website is run from HQ, and the local regions have no ability whatsoever to plug into that system.
a3n 5y ago
> Regular email users who are not email experts can either trust all emails or delete most of them. I do the latter. Default practice these days should be do not respond to any phone call, text, email etc. if you don't recognize it, and if you have a non-personal relationship to what appears to be the sender, don't answer it unless it's a response to your initial communication. Communications these days are mostly vans with candy and missing puppies. Based on my spam folder and incoming call records anyway.
- jimmygrapes 5y ago
  Your candy van's extended warranty is about to expire!

gxnxcxcx 5y ago

It's not just the marketing side, every customer facing thing corporations can outsource is being pipelined through the same kind of ad-like machinery. After considerable effort educating the non-technically inclined members of the family to check URLs to avoid shenanigans, cue our ISP sending very important confirmation links via SMS (bad enough) pointing to isp-name.onelink.me, amid a particularly active wave of SMS phishing scams earlier this year. One of the top 10 telecom corps worldwide in size and the mf'ers couldn't bother using their own domain.

Nextgrid 5y ago
Spam filters should catch up and filter out all that crap as malicious.
- bob778 5y ago
  The problem is that, by definition, it isn’t malicious: it’s just incredibly poorly planned legitimate communications. Filtering it out will just make it harder for users to get key information.
  - smolder 5y ago
    I think that might be the point; it would create a headache for the company and its users and when they do the retrospective they'll find that use of unverifiable domains was the mistake. Or using the vendor who uses them was the mistake. Filtering that catches "false positives" which are indiscernible from phishing is 10x more likely to curb this practice than trying to educate anyone about the problem.
  - Nextgrid 5y ago
    It is - marketing platform links often track you (which is in breach of the GDPR btw), conceal the true target of the links (so you can't tell whether the final target is legitimate) and most marketing platforms are for some reason obsessed with HTTP even when the final target link is HTTPS, exposing you to risk on insecure networks.

aljarry 5y ago

My company makes everyone take phishing training twice a year, yet at the same time they pay for services that send emails looking like phishing. Outlook of course shows the warning "This email originated from outside of organization. Please be mindful of phishing attempts...". It's not only marketing. Tons of services allow spoofing senders name, and try convince you they've been sent by actual people.

tharkun__ 5y ago
I'm interested: Does your company in this training allow you access to what usually is a dead simple way to identify 99% or phishing/spam emails? I luckily don't work for companies that do this regularly but the ones I've seen online before and the one I did have to do, do not give you access to the headers. While I realize that most non-techies won't know how to do any of that, it's the easiest for any technically inclined person. The first defence is the real email address (which I always have displayed by default anyway), which gets rid of a large swath of them already and the rest are usually pretty clear from some of the others headers. It has never happened to me that something as intriguing as this post's message came in.
- aljarry 5y ago
  Of course not :) They are targeted towards non-techies. Look at emails content, there's domain which looks funky and a URL you're asked to click -> that's phishing for sure! Which begs a question: why they haven't "blessed" the messages from external providers, that are actually legit? Like with a warning "This message comes from a trusted third party".

a3n 5y ago

Any sufficiently smelly marketing campaign is indistinguishable from phishing.