He addresses this in the comments of the article[0]: >Aaron says: >April 5, 2014 at 3:52 pm >So how’d you sucker Bill into clicking your exploit link? Since

He addresses this in the comments of the article[0]: >Aaron says: >April 5, 2014 at 3:52 pm >So how’d you sucker Bill into clicking your exploit link? Since you hadn’t yet hijacked his DNS, I presume the link didn’t (couldn’t) actually point to linkedin.>com — shouldn’t his mail client have warned him? (Mine would.) >>Reply >>Phikshun says: >>April 5, 2014 at 5:35 pm >>See this video by Raphael Mudge[1]. He does a much better job of explaining it than I would. I also had another advantage — Bill and I worked for the same company at the >>time, so I could send the phish to myself to make sure it passed all the filters. This isn't so unrealistic though. An advanced adversary will scour RFPs, public records and >>job postings to learn what protection technologies a company has and attempt to duplicate their environment for testing. [0]http://disconnected.io/2014/03/18/how-i-hacked-your-router/comment-page-1/#comment-4 http://disconnected.io/2014/03/18/how-i-hacked-your-router/c... [1]http://www.youtube.com/watch?v=OO_A8NHNBj8 http://www.youtube.com/watch?v=OO_A8NHNBj8