Slashdot Mirror
Anti-Phishers Pose as Phishers to Make Point
Carl Bialik from the WSJ writes "This article notices a new trend in efforts to fight phishing: Anti-fraudsters are posing as phishers to 'to train users to be more careful about sharing sensitive information online.' Or, as the Wall Street Journal puts it, 'To fight computer crime, the good guys are masquerading as bad guys pretending to be good guys.' West Point cadets were among those who got fake phishing emails -- in their case, from Aaron Ferguson, a teacher at the academy. 'The gullible cadets received a "gotcha" email, alerting them they could easily have downloaded spyware, "Trojans" or other malicious programs and suggesting they be more careful in the future. ... Nonetheless, he says the exercise upset some cadets, who felt it exploited their inclination to follow an order from a colonel, no questions asked. He says the new edict is, "Ask questions first, then execute." '"
My initial response is that cadets needs to wise up about who's who when orders are given, but then I realized that it's probably a federal offense to impersonate a military officer in real life. The question then becomes whether it's illegal to impersonate an officer online. If so, the good/bad/good guys have gone too far.
What do you mean they cut the power? How can they cut the power, man? They're animals!
It depends. On a nuclear sub, they had better be verifying those orders are authentic before launching. In fact they do verify that messages are authentic. They use this thing called cryptography. So, this is in fact a healthy lesson to be teaching these cadets. They cannot blindly follow orders comming from untrusted sources.
Unfortunately, common sense does not mean the same thing for the average user, as it does for people on Slashdot.
Average users feel that since mail was sent to them, it should be safe to open in.
Common sense means that it is the job of the technical industry to make sure that this can happen. That the average user can open mail without worrying about being 'infected.'
Common sense means that when an e-mail is sent, and it says that Grandma Jones sent it, it really was from Grandma Jones.
Common sense means that WE (technical industry) have a lot of work to do. Not the average user. Thier only job is to use the infrastructure we create.
No reason to lie.
``I think its sad that its come to the point where we have to assume everything is untrustworthy and to have to keep a guard up 24/7.''
That paints the picture a bit blacker than it really is. Of _course_ you can't just assume that _everything_ you encounter can be trusted without further thinking. That's not a recent development; it's always been that way. But it's not like you have to distrust everything you encounter, either.
Common sense should get you a long way. If someone is offering you great riches for no effort, or demanding you verify your account by entering your password even though your bank said they'd never do that, or you are asked to verify an account with a service you aren't registered with, or your sister sends you an email that is in a completely different writing style from what she normally uses, it's almost a sure bet it's a scam. If one of your friends or colleagues sends you a message about something you share an interest in, it's almost certainly legit. Anything that falls in between warrants closer inspection. It really isn't all that difficult.
Please correct me if I got my facts wrong.
What will happen if someone knocks at Joe 6P's door and tells him:
[BLAH BLAH...]
and ask for his bank account number and other personal info.
A lot of people would fall for it. You think con-artistry didn't exist before email? It's just more efficient now. Once you had to knock on 1000 doors to find someone so gullible, now you let them come to you. Some people are just [trusting/greedy/desperate] like that.
You get a letter in the mail on your banks letterhead in an envelope exactly like every other letter you have received from the bank (with the exception that the postmark is from a different zipcode than usual, but who checks those?). The letter states you need to sign some paperwork, could you please come to the nearest branch to take care of it. It provides some directions to your branch that isn't your usual route but their way does seem more direct. You arrive at the branch and everything looks just like you remember it, even the tellers look familiar. They ask you to fill in some account information on a form, sign it, and you are on your way.
The good phishes don't ask for your password or account information through email outright. In an official looking email they direct you to visit your financial companies website to update or confirm something. For your convenience they even provide a link to the "website" for you, which directs you to an exact duplicate of that companies login page. I have even seen ones where clicking on the "help" or "contact us" links will actually take you to the corresponding pages on the real sites. A lot of these phishers are far from amateurs!