7 ms·
They're attacking the wrong part of the problem. If misleading messages ("phishing") are leading their users to enter credentials onto forms which are then use
by mcherm 14y ago
They're attacking the wrong part of the problem.
If misleading messages ("phishing") are leading their users to enter credentials onto forms which are then used to send out spam, then the solution is not to block access to one of the sites that supports forms. There are an unlimited number of sites that support forms. There are LOTS of better ways to solve this problem. Here are a few:
* Train your users where it is and isn't safe to enter credentials.
* Don't give your users credentials. Have some alternate way to authenticate them like a login token.
* Put rate limiting on the ability of a single account to send out emails.
Blocking the site for just a few hours as an emergency response to a short-term attack is a much more reasonable approach. Sometimes, to react quickly, you need to take measures that are not the best possible choice. But there were better approaches, and the security team should take measures to ensure that they can react more effectively next time. For instance, in this case, a single mass-email or email "virus" had gone out and was tempting a large number of users to give out their credentials. Instead of blocking the site that was collecting the credentials, a better solution would have been to remove the email from the mailboxes of all the students. After all, the emails system is provided by the university, and this cuts off the problem at the root. They should institute the necessary technology to support doing this next time they have a phishing problem... perhaps they can even do this proactively: set up some honeypot accounts not receiving any legitimate emails and automatically destroy any emails matching the signature of emails received by these honeypot accounts (with manual review afterward to correct for false positives).
- jacques_chester 14y ago> Train your users where it is and isn't safe to enter credentials. This demonstrably doesn't work. It reduces but cannot eliminate all instances of phishing. > Don't give your users credentials. Have some alternate way to authenticate them like a login token. Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a university, no matter how famous. > Put rate limiting on the ability of a single account to send out emails. Many users have legitimate reasons to send out mass emails. > Instead of blocking the site that was collecting the credentials, a better solution would have been to remove the email from the mailboxes of all the students. Phishing emails are often varied into multiple templates to avoid being scrubbed this way. They also tend to trickle in at random, rather than turning up all at once.
- marcloney 14y agoIf you place rate limiting on email accounts by default and then for the lower percent of users that need a higher rate do it on a case-by-case basis. In my experience most users that fall victim to these types of phishing attacks do not need to send high volumes of emails.
- jacques_chester 14y agoOxford already has rate limiting. 1000 messages per hour through their servers, it seems [0]. The next step would be to filter outbound traffic to block SMTP from compromised PCs. It seems they have an outbound firewall, but it's not obvious which ports are closed because the list of blocked ports is ... blocked[1]. [0] http://blogs.oucs.ox.ac.uk/adamweblearn/2011/12/weblearn-unaffected-by-recently-announced-changes-to-email-service/ http://blogs.oucs.ox.ac.uk/adamweblearn/2011/12/weblearn-una... [1] http://www.oucs.ox.ac.uk/network/firewall/blocks/ http://www.oucs.ox.ac.uk/network/firewall/blocks/
- jebblue 14y agoThe 1000 limit seems like a high number, why would a legit user need to send that much email out? I'd think a much smaller number like 5 per hour would be better.
- TeMPOraL 14y ago1000 mails/h is definitely too much - it's 16 mails per minute(!). I think something around 60 - 100 mails per hour is more reasonable, to cater for cases like lots of one-liner exchanges.
- jacques_chester 14y agoAcademics send mass emails. Calls for Papers / Articles is the classic reason. The IEEE and the ACM might have proper mailing lists for that sort of business ... most academic fields do not. Edit: I think they could lower the rate more and push mailing lists, but on the other hand a lot of users simply wouldn't notice that they're rate limited. Which could lead to entirely different brand of lulz.
- chime 14y ago> * Train your users where it is and isn't safe to enter credentials. > * Don't give your users credentials. Have some alternate way to authenticate them like a login token. I manage barely a 100 users and I have talked to each of them personally. They're good people and can comprehend instructions. But they still fall for these every now and then. Training doesn't help. They are fantastic in their respective fields but to them, all prompt boxes and all login screens have the same exact amount of legitimacy. Just like how every spark plug looks the same to me. Training can help some users but most of them are going to fall for it eventually.
- UnoriginalGuy 14y agoI just want to re-enforce your second bullet... It is 2013, two factor authentication is here and it is open source software. You can use Google Authenticator[1] for free or you can use something like the YubiKey[2]. If the students have a smartphone then Google Authenticator is on almost all of the major platforms. [1] http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/ [2] http://www.yubico.com/about/background/ http://www.yubico.com/about/background/
- Major_Grooves 14y agounfortunately most of the University runs on Microsoft Exchange I believe, and they do not support 2-factor authentication.
- CodeMage 14y agoAnd once again we prove that Microsoft, just like parents, can be blamed for everything ;)
- tshile 14y agoMaybe you should do some more reading. There are certainly supported configurations for two factor authentication.
- Major_Grooves 14y agooh yes of course they can set-up 2-factor authentication themselves, but it's not supported ''out-of-the-box'' is it? This is what I mean: http://www.neowin.net/news/microsoft-explains-why-outlookcom-doesnt-have-two-factor-authentication http://www.neowin.net/news/microsoft-explains-why-outlookcom... With Google Apps you just turn it on... and can force users to use it.
- tshile 14y agoRight, but your article is talking about outlook.com. Office 365 and stand alone (ie: private) exchange installs certainly support it. Comparing outlook.com to 'Microsoft Exchange' (whether you're talking about Office 365 which is MS's 'cloud' solution, or private Exchange servers) is not exactly fair. One is designed as a free email hosting solution for personal use (essentially replacing Hotmail), the other is designed for business/organizational use and costs money.
- alan_cx 14y agoOooooooooooooooo rant coming on............. Im sorry, but that is the typical tech reply that blows normal people's minds. Blame the user. Well, the user says, sod that, lets just block the problem and get on with what we wanted to do in the first place. People, normal non tech people, want to use computers as a tool, not become experts in thwarting criminals, etc. If a user cant just go to a computer and simply use it, like say a library or book, then the computer and its champions are failing. Its not the users job to provide security. And no, its not like locking a door. The sheer amount of rubbish poor users have to go through to be safe on a computer is frankly a joke, and the reason so many non geeks love Apple. Yes geeks know Apple are as insecure and any one else, but users believe they are simple and safe. (At this point, by all means picture a toddler going mental in a shop) I've been in this business for 30 years, and "train the users" is for me a 30 year mantra that no one out side of geekdom wants to hear. It was my job to enable them to do their job more efficiently, not expect them to become some sort of security expert. This Uni is doing the simple easy thing to let its users function safely. If the IT world doens't like it, then 1: tough, 2: damn well fix it, and 3: stop blaming users. Then, you tell them to limit emails. "Oh right" says the user, "I thought one point of email was easy mass mailing, and now you want to bloke it?" Really think about the user. Its they who make computers and the internet worth bothering with. I feel better now. Thank you.
- subway 14y agoI'd like to use my car like a tool. Why do manufacturers make them so difficult to safely operate, I shouldn't require any additional training to operate it, I should be able to just hop in at location A and hop out at location B. Regardless of what some folks in the "User Friendly" movement would like to think, most tools require basic instruction in order to be safely used. We can't code away all individual responsibility.
- kajecounterhack 14y agoI thought the article said that's exactly what they did, block for a few hours. It's unblocked now.
- rmc 14y agoTrain your users where it is and isn't safe to enter credentials. How do you actually suggest this be done? Seriously? Classes? OK what's the estimated success rate of that class (i.e. how many people will go to the class, then ignore all the advice)? 80%? What do you do about the 20% who haven't been 'trained'? What next? Computer licences? How long will that take, and again, how many people will ignore it?
- OGinparadise 14y ago"We recently felt it necessary to take, temporarily, extreme action for the majority of University users: we blocked Google Docs."