7 ms·

Funnily enough I’m studying a cyber security course at the moment and had to find examples of social engineering for an activity, and came across this yesterday

Funnily enough I’m studying a cyber security course at the moment and had to find examples of social engineering for an activity, and came across this yesterday. I shared it with my classmates and they just couldn’t believe that MailChimp been hit 3 times in a year with what sounds like the same social engineering attack. It does make you wonder when there’s going to be a 4th, I certainly don’t think I’d want my customers contact details in their system at the moment.

AviationAtom 4y ago
The sad part is it's one of the hardest components to solve. High quality training can instill a healthy dose of paranoia, that is necessary, though.
- Enginerrrd 4y ago
  I'm convinced there's no way to solve this except for regular "red shirt drills" linked to your job performance. (This is a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response.)
  - nibbleshifter 4y ago
    Even that doesn't work - some companies do exactly that with regular phishing exercises etc. Employees get really good at spotting the tests.
    - syrrim 4y ago
      If being able to spot the tests doesn't confer ability to spot real phishers, then the tests aren't very good.
    - AviationAtom 4y ago
      The technical ones may, but they're also less likely to fall victim to the phishing schemes. It's those non-technical folks in admin roles that you tend to have to worry about most. Those folks aren't so good at picking out the tests. I actually found KnowBe4 to work fairly well on a large scale.
      - nibbleshifter 4y ago
        The non technical staff seem to learn to spot the knowbe4 shit real quick lol.
        jabroni_salad 4y ago
        Yep. All of KB4s stuff looks like it came from a single designer. You need to go through your spam filter and make custom templates from whatever you are receiving, and also make lookalikes from real business messages. Bankers doing wire transfers to wrong accounts because of a forged document has been a serious problem in my sphere lately. It used to be that if a mailbox got compromised they would just send spam about lottery wins and boner pills. Now they watch your messages and reply to a real request with a good looking response. A correct expected reply in a chain from an authentic account, just some numbers have changed. Then they will steal your contacts and register a similar domain and try to impersonate you.
        AviationAtom 4y ago
        We had almost this exact scenario (look alike domain) play out with a customer. Their accounts payable department almost paid out half a million to a scammer. Fortunately the employee at the customer accidentally replied to our actual email address and our folks knew better and picked up the phone. The customer insisted up and down that their email system had not been compromised. It took telling their IT folks what and where to look before they finally realized they were compromised. Good IT/security teams make all the difference.
        Enginerrrd 4y ago
        > A correct expected reply in a chain from an authentic account, just some numbers have changed. Ooof, that'd be a tough one not to fall for.
        AviationAtom 4y ago
        It's all in how much effort you put into it. It's quite versatile and their customer success team is phenomenal. We had multiple pretty smart employees accidentally fall for it the first few campaigns and immediately reach out when they realized what they did.
    - yjftsjthsd-h 4y ago
      > Employees get really good at spotting the tests. Then surely either the test isn't good enough, or the problem is solved?
  - AviationAtom 4y ago
    Good detection and response is a must, but creating a security culture helps greatly. Training, test campaigns, and further training for those that fail, does help. Nothing is a silver bullet, that is why we emphasize "Defense in Depth."
  - codetrotter 4y ago
    > a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response They have a similar concept in cybersecurity. The Red Team > a group that plays the role of an enemy or competitor to provide security feedback from that perspective. Red teams are used in many fields, especially in cybersecurity, airport security, law enforcement, the military and intelligence agencies. https://en.wikipedia.org/wiki/Red_team https://en.wikipedia.org/wiki/Red_team
- jacquesm 4y ago
  It is. And then you receive mails from say Google or some other large company that look exactly as though they are very bad forgeries of what you'd expect. 'Action required', some weird vaguely related domain name, a bunch of links to click that definitely have nothing to do with the matter at hand. With crap like that it isn't all that strange that some of these attempts get through and on the social engineering side it can't be all that much better. After all we're continuously conditioned to trust that which we really shouldn't be trusting. Right up to the point where the party on the other side is abusing that trust. One example: my real bank calling me and then asking me to verify that it is really me by asking me all kinds of information about my account... And from a number that isn't associated with them. And yet, it was very real and when I refused to answer their questions they took it pretty badly as though I was a scammer...
NelsonMinar 4y ago
This problem is almost certainly Mailchimp-specific. The talent was decimated after the owners sold it to Intuit.
- kneebonian 4y ago
  That's the thing you can't outsource IT security because in order to be secure you need to have institutional understanding.
  - AtlasBarfed 4y ago
    But if your devs are outsourced...?
- iamacyborg 4y ago
  > This problem is almost certainly Mailchimp-specific. It's not. Multiple marketing automation/email service provider platforms were affected by similar hacks last year.
  - NelsonMinar 4y ago
    Once is a hack. Three times in a year is a systemic business problem.
  - echelon 4y ago
    Mailchimp was gutted. You have to understand the sort of mythical place the company had in the nascent Atlanta tech scene. It was one of the first Atlanta tech unicorns and was growing and hiring at a rapid clip. The founders promised never to sell and that they would give annual bonuses in exchange for not offering employee equity. The office was brimming with art, music, and perks that were unusual for Atlanta at the time. They said they were going to build a generational Atlanta tech company. I desperately tried to recruit my friends that worked at Mailchimp away, because I saw the writing on the wall. I had joined a promising startup offering significant equity, and more importantly, building real value in the world. To my disappointment, none of my Mailchimp friends joined me. They liked the culture too much, felt comfortable, and continued to tout the bonuses they were receiving despite Mailchimp offering lower total comp. I never stopped trying to pull them away, but I didn't succeed. I received counter offers and heard the Kool Aid stories. "The founders are so cool and so generous." The job itself isn't that interesting, either. Marketing and email advertising isn't intellectually attractive. To top it off, Mailchimp has a disgusting PHP monolith that I've heard is like pulling teeth to work with. I was right in the end. I walked away with a huge eight figure exit. Mailchimp employees got pay cuts, benefit cuts, and saw their culture ravaged. Intuit took what little niceties they had and threw it all to the wind. Macy's and Home Depot have better software jobs. I really don't like Mailchimp. The company is rotten.

AviationAtom 4y ago

The sad part is it's one of the hardest components to solve. High quality training can instill a healthy dose of paranoia, that is necessary, though.

Enginerrrd 4y ago
I'm convinced there's no way to solve this except for regular "red shirt drills" linked to your job performance. (This is a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response.)
- nibbleshifter 4y ago
  Even that doesn't work - some companies do exactly that with regular phishing exercises etc. Employees get really good at spotting the tests.
  - syrrim 4y ago
    If being able to spot the tests doesn't confer ability to spot real phishers, then the tests aren't very good.
  - AviationAtom 4y ago
    The technical ones may, but they're also less likely to fall victim to the phishing schemes. It's those non-technical folks in admin roles that you tend to have to worry about most. Those folks aren't so good at picking out the tests. I actually found KnowBe4 to work fairly well on a large scale.
    - nibbleshifter 4y ago
      The non technical staff seem to learn to spot the knowbe4 shit real quick lol.
      - jabroni_salad 4y ago
        Yep. All of KB4s stuff looks like it came from a single designer. You need to go through your spam filter and make custom templates from whatever you are receiving, and also make lookalikes from real business messages. Bankers doing wire transfers to wrong accounts because of a forged document has been a serious problem in my sphere lately. It used to be that if a mailbox got compromised they would just send spam about lottery wins and boner pills. Now they watch your messages and reply to a real request with a good looking response. A correct expected reply in a chain from an authentic account, just some numbers have changed. Then they will steal your contacts and register a similar domain and try to impersonate you.
        AviationAtom 4y ago
        We had almost this exact scenario (look alike domain) play out with a customer. Their accounts payable department almost paid out half a million to a scammer. Fortunately the employee at the customer accidentally replied to our actual email address and our folks knew better and picked up the phone. The customer insisted up and down that their email system had not been compromised. It took telling their IT folks what and where to look before they finally realized they were compromised. Good IT/security teams make all the difference.
        Enginerrrd 4y ago
        > A correct expected reply in a chain from an authentic account, just some numbers have changed. Ooof, that'd be a tough one not to fall for.
      - AviationAtom 4y ago
        It's all in how much effort you put into it. It's quite versatile and their customer success team is phenomenal. We had multiple pretty smart employees accidentally fall for it the first few campaigns and immediately reach out when they realized what they did.
  - yjftsjthsd-h 4y ago
    > Employees get really good at spotting the tests. Then surely either the test isn't good enough, or the problem is solved?
- AviationAtom 4y ago
  Good detection and response is a must, but creating a security culture helps greatly. Training, test campaigns, and further training for those that fail, does help. Nothing is a silver bullet, that is why we emphasize "Defense in Depth."
- codetrotter 4y ago
  > a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response They have a similar concept in cybersecurity. The Red Team > a group that plays the role of an enemy or competitor to provide security feedback from that perspective. Red teams are used in many fields, especially in cybersecurity, airport security, law enforcement, the military and intelligence agencies. https://en.wikipedia.org/wiki/Red_team https://en.wikipedia.org/wiki/Red_team
jacquesm 4y ago
It is. And then you receive mails from say Google or some other large company that look exactly as though they are very bad forgeries of what you'd expect. 'Action required', some weird vaguely related domain name, a bunch of links to click that definitely have nothing to do with the matter at hand. With crap like that it isn't all that strange that some of these attempts get through and on the social engineering side it can't be all that much better. After all we're continuously conditioned to trust that which we really shouldn't be trusting. Right up to the point where the party on the other side is abusing that trust. One example: my real bank calling me and then asking me to verify that it is really me by asking me all kinds of information about my account... And from a number that isn't associated with them. And yet, it was very real and when I refused to answer their questions they took it pretty badly as though I was a scammer...

NelsonMinar 4y ago

This problem is almost certainly Mailchimp-specific. The talent was decimated after the owners sold it to Intuit.

kneebonian 4y ago
That's the thing you can't outsource IT security because in order to be secure you need to have institutional understanding.
- AtlasBarfed 4y ago
  But if your devs are outsourced...?
iamacyborg 4y ago
> This problem is almost certainly Mailchimp-specific. It's not. Multiple marketing automation/email service provider platforms were affected by similar hacks last year.
- NelsonMinar 4y ago
  Once is a hack. Three times in a year is a systemic business problem.
- echelon 4y ago
  Mailchimp was gutted. You have to understand the sort of mythical place the company had in the nascent Atlanta tech scene. It was one of the first Atlanta tech unicorns and was growing and hiring at a rapid clip. The founders promised never to sell and that they would give annual bonuses in exchange for not offering employee equity. The office was brimming with art, music, and perks that were unusual for Atlanta at the time. They said they were going to build a generational Atlanta tech company. I desperately tried to recruit my friends that worked at Mailchimp away, because I saw the writing on the wall. I had joined a promising startup offering significant equity, and more importantly, building real value in the world. To my disappointment, none of my Mailchimp friends joined me. They liked the culture too much, felt comfortable, and continued to tout the bonuses they were receiving despite Mailchimp offering lower total comp. I never stopped trying to pull them away, but I didn't succeed. I received counter offers and heard the Kool Aid stories. "The founders are so cool and so generous." The job itself isn't that interesting, either. Marketing and email advertising isn't intellectually attractive. To top it off, Mailchimp has a disgusting PHP monolith that I've heard is like pulling teeth to work with. I was right in the end. I walked away with a huge eight figure exit. Mailchimp employees got pay cuts, benefit cuts, and saw their culture ravaged. Intuit took what little niceties they had and threw it all to the wind. Macy's and Home Depot have better software jobs. I really don't like Mailchimp. The company is rotten.