11 ms·
A few months ago I got an email from the IT center of the company I work for that was dodgier than any phishing email I have ever received: - Coming from a dom
by sebtron 3y ago
A few months ago I got an email from the IT center of the company I work for that was dodgier than any phishing email I have ever received:
- Coming from a domain that looks nothing like the official domain of the company, rather some generic @itservice.com or something.
- Subject: "URGENT: your account is expiring soon".
- Multiple links provided in the email body, all illegible and multiple lines long, none of them from a domain that I can immediately link to the company.
- No alternative way of resolving the issue is provided other than clicking on one of those links (no "go to your account settings", "contact your line manager" or so).
And still, it turns out it was real.
~100k employees company btw
- Rygian 3y agoDid you click on the "Report Phishing attempt" button installed by your IT center in your mail client? Sorry for the probable sarcasm. In a company that size, if the IT center does not provide a means to report phishing attempts then there are more serious problems than a dodgy email campaign.
- sebtron 3y agoI wanted to, but I could not find it. It turn out I could not see the "report phishing" button because of an Outlook glitch. Thanks Microsoft.
- lrem 3y agoForward the email to your security org?
- alistairSH 3y agoThis. We have a dedicated phish/scam/it-sec channel in Slack for this (in addition to an embedded “report this email” plug-in in Outlook).
- sebtron 3y agoI did end up forwarding the email to another IT service address (one that I knew was legit). They thanked me for the feedback and said they would improve the message.
- TeMPOraL 3y agoFWIW, I did exactly that a few times where I was 90% certain the e-mail is legit, but it still looked like a phishing attempt. The IT department needs to learn to do better, this is inexcusable, especially in a corporation with otherwise restrictive policies that waste ridiculous amounts of money and effort (think: Windows Defender real-time "protection" on developer machines, with no way to exclude your repos).
- natebc 3y agoThis is even worse in companies that have security offices actively sending out phishing emails worded as internal emails from your company that shame you if you click any of the links in them. email is well and truly dead.
- dunham 3y agoThat reminds me that we had a "chief architect" who sent out his fairwell email with a link to his linked-in page in the footer, but the link actually went to a certain music video on youtube. I suppose, if you want to train people to not click on links, that's a fun way to do it.
- ano-ther 3y agoIt’s a good idea. I am usually a bit pessimistic about it though. If their SOP doesn’t account for “looks like phishing but is from internal sender” then chances are that nobody connects the dots and informs that sender. The intelligence of a small and motivated IT team seems difficult to scale.
- lobochrome 3y agoOur IT did the exact same thing with expiring m365 passwords. They weren’t using the corp domain, typos all over and the URL was obscured using a bizarre link shortener. The same guys also force us to change our passwords every 6 months and block the last twenty. Passwords we have to enter in systems that can’t pull directly from password managers and thus have to type 10-20 per day. Guess the average strength of an employee password! I think IT incompetence should lead to audit fails or even better delisting from exchanges.
- jraph 3y ago> The same guys also force us to change our passwords every 6 months and block the last twenty It's good we have 26 letters, that comfortably leaves you a margin of 6 combinations :-)
- pjc50 3y ago> I think IT incompetence should lead to audit fails or even better delisting from exchanges. Fear of policy is why you get things like "force us to change our passwords every 6 months and block the last twenty". Getting a central arbiter of IT competence is a hard problem.
- Thorrez 3y agoIs blocking the last 20 passwords a bad thing? I agree the other stuff is bad, but to me, that part doesn't seem bad.
- pama 3y agoEven if this rule technically seems benign, together with the forced change it encourages users to game the system leading to predictable patterns, eg adding a rotating letter or digit combo at the end of a same password.
- Thorrez 3y agoIs that worse than the password without the rotating letter/digit?
- bombcar 3y agoHealthcare companies in the US send the most scammy looking links for payment processing you’ve ever seen - things like my-healthcare-billing.net It’s insane.
- mnau 3y agoOur government uses equivalent of www.mydatabox.cz (real one is mojedatovaschranka.cz). Literally a domain that looks like from teaching material for phishing, no databox.gov.cz or something like that. The domain is for an official legal documentation communication with government and has same legal weight as letter that was person delivered and recipient was checked against ID.
- philsnow 3y agoI’m supposed to pay my semi-annual property taxes (on the order of ~thousands of USD) on a site that ends in .org instead of .gov, and nobody apparently sees anything weird or wrong with it.
- bombcar 3y agoNow that I think of it, I'm not sure I've ever seen a government payment site hosted on .gov; usually .com.
- 01HNNWZ0MV43FF 3y agoYou can tell it's legit if they charge you $2 extra for a credit card instead of a bank transfer lol
- bombcar 3y agoMost have gone that way, but a few were still letting you put your entire property tax on credit card with no fee whatsoever as recently as last year. Woohoo free miles! Sometimes the fee is so low that even when they do charge it, it's worth using the credit card.
- silverquiet 3y agoRegarding the external domain thing, I can say that dealing with domains in a big company gets about as bureaucratic and terrible as just about everything else; I experienced this myself - at a youngish company when I needed a new sub-domain off the big official domain, it was just talk to $dude on the DNS team and he’ll help you out. And he did. A few years later once things had “grown up” a bit, I needed to update a record and I asked the same guy. He told me I needed to fill out a 25 question form and they’d review it. I about half copy and pasted it from another team member’s project and they accepted it. Obviously it doesn’t excuse the practice, but I can see why people use alternative domains to get things done. The above anecdote was also purely within the company; I’m sure that if you add in a partner/managed service, it only amplifies the complexity.
- walrus01 3y agoIf I saw one of those in a 100k employee company I'd first just assume it's a phish-test email and that anyone who clicks on any URL in it is going to get put in the list for remedial training. There are, of course, a whole plethora of services that a CTO-type person can hire to phish test your employees. Some of them even have several hundred real domain names with live MX on them that you can add into your office365/gsuite mail flow permit-list controls, as an admin, to ensure that the phish test arrives correctly in peoples' inboxes.
- joezydeco 3y agoI love how those emails have extra metadata in the headers like "X-Phishing-Test: True"
- walrus01 3y agoIndeed, though the sort of person who knows how to read and understand mail headers is probably pretty unlikely to fall for a real phish.
- Hackbraten 3y agoEveryone has their weak moments where they’re prone to falling for a real phish.
- Marsymars 3y agoI have an Outlook rule to redirect these to junk.
- WorldMaker 3y agoI wish I could do that, but then that would impact my "scoreboard" on the anti-phishing tool and they would yell at me or send me to remedial "training" too. They really like to see that useless button pressed that just patronizingly tells me "Yes, this was a training exercise". At the moment in my current corporate email address this the number one source of spam, just all the internal phishing testing emails. It feels like the attempted cure is worse than the disease and I hate getting so much useless trash.
- sokoloff 3y agoI report those as phishing in order to get the feedback to the IT team who sent them from their colleagues in infosec. (I often have had IT and infosec reporting to me, which makes this even more effective of a feedback mechanism. :) )
- Macha 3y agoYeah, was working for a (then) 15k employee company and got an email "You have expenses due". Blank content, PDF attachment. I hadn't initiated any payments (but it later turned out the bank had just charged the annual tax on my corporate card account) Ignored it. Later got my manager asking as the expense team had been chasing down managers of people with overdue reports.
- anonymous_sorry 3y agoMy company's security training tells me to carefully verify any URLs in received emails, but then they have some security software that rewrites all the URLs in incoming emails - presumably as a way of screening them themselves. This might be a reasonable trade-off for centralising monitoring, but it significantly hampers the ability to judge the legitimacy of emails myself. At least update your training!
- lhamil64 3y agoMy company does that too, it's really annoying. They also sometimes send out mass emails for things like surveys but link to some third party service. I've even seen them put, in the email, things like "the link goes to a trusted third party and is perfectly safe". Why should I trust that if I'm already suspicious of the emails legitimately?
- ToucanLoucan 3y agoOur last round of security training was roundly mocked by our software division, especially around the subject of one of the rules emphasized over and over being to "never click URLs in emails" and the sign-in process for the website alongside the distribution of lessons was done exclusively through magic links... in emails. Our CEO is actually a developer himself on our core product (and a bit of a paranoid fella on the cybersecurity front to boot) and he was absolutely furious about this vendor being chosen...
- Corrado 3y agoM365 has an option to rewrite URLs in incoming emails. It's horrible, at least for people that can actually read URLs. Every link turns into a 300 character mess that I have no idea if its valid or not. The only way to tell is to click it. Maddening!
- dormento 3y agoOn our company (hosting & PaaS), I was contacted on our internal messenger by a person I've never seen before, asking me to "please" run some commands as root and send back the results. After the initial shock (and due infosec diligence) I found out it was just "the new guy", needing to collect info about our systems for equipment inventory purposes. Since they didn't have access to our networked management tool yet, and didn't know the finer points about how running `curl ... | sh` randomly is not a good idea, they thought it would be ok to get that information piecemeal directly from people. It happens.
- from-nibly 3y agoI flip tables when people make offhand requests like this. Infra teams are not keyboard monkeys with admin creds.
- chuckadams 3y agoWhen I worked at Sun Microsystems, they had a clever launcher shell script dealie for things like StarOffice documents that did usage tracking, portability fixes (usually setting obscure environment vars), and of course downloading and opening the actual document. Then they started sending those shell scripts as email attachments. One day they sent out an email telling people to not open executable email attachments: the full memo was a SO document wrapped in one of these scripts. To their credit, after the inevitable replies to that email they never used that wrapper again (they moved the launchers to the centralized NFS install where they always should have been)
- bnralt 3y agoBanks do this as well. I made a purchase, and within minutes got a very scammy looking e-mail from them - low quality gifs, asking me to click on links to a random non-bank website(something like purchase-verification-users.net/235532/confirm.html, and the site wasn’t coming up on any searches). At the same time I get a call from a random number asking me to go over some purchases - I looked up the number, and it’s none of the ones listed for my bank. So I hang up and call my bank directly. I spend 10 minutes going through the phone maze to talk to someone. Finally I get to them, and they confirm that is a number that they use to contact people. How come when you list numbers on your website you don’t list this one? Well, they said they often call from numbers they haven’t listed online. How about that e-mail, do you send those? Well, we sometimes contact people by e-mail, if it says it’s from us in the from: line you can click on it. Did you guys send that one? I don’t have that information; don’t click on it if the from: line isn’t us, but if it is, go ahead.
- xur17 3y ago> Well, they said they often call from numbers they haven’t listed online. Worth noting - do not trust the incoming callerid number. This is trivial to fake.
- SilasX 3y agoSimilar unforced error: I got emails from healthcare.gov for required actions on the site's marketplace. But the links used the lnks.gd shortener, hiding what domain you were actually going to end up at! They're encouraging people to blindly click on links with no idea where it takes them! What's worse, you can't even go to the lnks.gd root to check where a shortened link is going. And the "shortened" link was actually longer, with all the payload crap they rolled in. They could have just used the normal url plus small internal identifier of which email it was if they needed to track it, and it would have been shorter. There was no reason to use a shortener, let alone such a shady one!
- starky 3y agoThe company I work for has a service that sends phishing test emails to everyone that you are supposed to report. I take great joy in reporting every legitimate email that is at all sketchy just for the inevitable email back from the security team informing me that they reviewed my report and it was indeed a legitimate email.