3 ms·
I've seen punny/phishy names being used Onboarding->Contact List->Phishing pivots. Hernan R Resources, Sam S Upport, etc are the worst ones; the best of them I
by Jerrrrrrry 2y ago
I've seen punny/phishy names being used Onboarding->Contact List->Phishing pivots.
Hernan R Resources, Sam S Upport, etc are the worst ones; the best of them I've pridefully jotted down.
WFH magnifies this attack vector; the internet didn't seem to name it yet, but I'm sure "onboardishing" is gonna be in the annual security training in a few years.
- justinclift 2y agoIt's not super clear what you're meaning. What's the thing that's happening, that you're talking about?
- Jerrrrrrry 2y agoRushed on-boarding practices due to WFH policies and labor "shortages" have lead to a new-ish attack vector of fake employees (often with adversarial-themed punny names) that basically exist only to farm internal emails, contact list, and a infranet-wide phish campaign - often using the punny name as a double entendre to establish an authoritative reply address, all inside the company email/network. First name, middle initial, last name -> Ian Thomas Support => itsupport@example.com
- justinclift 2y agoThanks. Hadn't heard of that happening before, but yeah it sounds like it could lead to some interesting email addresses.
- deleted 2y ago[deleted]
- Jerrrrrrry 2y agoIt's a novel-ish attack vector variant of social engineering HR, drag/spear phishing, and industrial espionage. I haven't found any other examples or mentions of it on the internet since I have seen it in the wild since C0VID, so if anyone has a name better (LLM's didn't) you can be immortalized in Annual Training PowerPoints forever.
- justinclift 2y agoMaybe something like "Christian Eo" (ie "ceo@example.com")? :)
- justinclift 2y agoPotentially also "Alison Cynthia Counts" -> accounts@example.com, and "Brian Illing" -> billing@example.com.
- deleted 2y ago[deleted]
- Jerrrrrrry 2y agoThis are good. Either you are clever, wrote a trivial script, or did not use Gemini. Just to test... After a half hour with Gemini prompt tweaking, I was unable to get it to even repeat those examples verbatim. Redacted emails - makes sense. Omitted all connotations and purely asking for expressions resulted in blatant incorrect output. Completely ignores, redirects, obfuscates, but claims not to be subject nor compliant of U.S.C. 9401(3). After badgering, it gives blatant false data and forgets context, even if summarized. Fresh context, purely a word game, and still, nada. Insults your intelligence for calling out its watchdog LLM. Gemini was aware of this vector and is U.S.C. 9401(3) compliant.