Anti-Phishers Pose as Phishers to Make Point

Carl Bialik from the WSJ writes "This article notices a new trend in efforts to fight phishing: Anti-fraudsters are posing as phishers to 'to train users to be more careful about sharing sensitive information online.' Or, as the Wall Street Journal puts it, 'To fight computer crime, the good guys are masquerading as bad guys pretending to be good guys.' West Point cadets were among those who got fake phishing emails -- in their case, from Aaron Ferguson, a teacher at the academy. 'The gullible cadets received a "gotcha" email, alerting them they could easily have downloaded spyware, "Trojans" or other malicious programs and suggesting they be more careful in the future. ... Nonetheless, he says the exercise upset some cadets, who felt it exploited their inclination to follow an order from a colonel, no questions asked. He says the new edict is, "Ask questions first, then execute." '"

Comments

Until...

[suso]

Its all fun and games until the bad guys start posing as the good guys posing as the bad guys.

Human Nature

[kevin_conaway]

Its human nature to be trusting of others. People don't want to believe that there are bad people out there who want to do them harm. I think this exercise was kind of silly, "Look, these cadets in an ARMY SCHOOL will follow what a SUPERIOR tells them to do! OMG ROFL!!!!11"

I think its sad that its come to the point where we have to assume everything is untrustworthy and to have to keep a guard up 24/7.

Re:Common Sense

[bigman2003]

Unfortunately, common sense does not mean the same thing for the average user, as it does for people on Slashdot.

Average users feel that since mail was sent to them, it should be safe to open in.

Common sense means that it is the job of the technical industry to make sure that this can happen. That the average user can open mail without worrying about being 'infected.'

Common sense means that when an e-mail is sent, and it says that Grandma Jones sent it, it really was from Grandma Jones.

Common sense means that WE (technical industry) have a lot of work to do. Not the average user. Thier only job is to use the infrastructure we create.

You'd like to think that, wouldn't you!

[plover]

It's so simple. All I have to do is divine it from what I know of you. Are you the sort of man who would phish his own employees or his enemies? Now, a clever man would phish in his own company because he would know that only a great fool would reach for what he was given. I am not a great fool so I can clearly not click on the spam in front of you ... But you must have known I was not a great fool; you would have counted on it, so I can clearly not click on the spam in front of me.

You've made your decision then?

Not remotely! Because spam comes from Russia. As everyone knows, Russia is entirely peopled with criminals. And criminals are used to having people not trust them, as you are not trusted by me. So, I can clearly not click the spam in front of you.

Truly, you have a dizzying intellect.

Wait 'til I get going!! ... Where was I?

Russia.

Yes! Russia! And you must have suspected I would have known the spam's origin, so I can clearly not click on the spam in front of me.

You're just stalling now.

You'd like to think that, wouldn't you! You've beaten my trojans, which means you're exceptionally well protected against viruses ... so you could have put the spam in your own email trusting on Norton AV to save you, so I can clearly not choose the spam in front of you. But, you've also bested my spyware, which means you must have studied ... and in studying you must have learned that man is mortal so you would have put the spam as far from yourself as possible, so I can clearly not choose the spam in front of me!

You're trying to trick me into giving away something. It won't work.

It has worked! You've given everything away! I know which email the phishing attack is!

Then make your choice.

I will, and I choose ... what in the world can that be?

What? Where? I don't see anything.

Oh, well, I ... I could have sworn I saw something. No matter. [laughing]

What's so funny?

I ... I'll tell you in a minute. First, let's click, me on my email and you on yours.

You guessed wrong.

You only think I guessed wrong! That's what's so funny! I switched emails when your back was turned! Ha ha! YOU FOOL! You fell victim to one of the classic blunders. The most famous is: Never get involved in a land war in Asia!, and only slightly less well known is this: Never go in against a Sicilian when death is on the line!

Re:Common Sense

[bcattwoo]

I think that some slashdotters must be fortunate enough to have never seen a really good phishing email. We aren't talking about just some crappy, far-fetched Nigerian-type scams. The more apt analogy would be:

You get a letter in the mail on your banks letterhead in an envelope exactly like every other letter you have received from the bank (with the exception that the postmark is from a different zipcode than usual, but who checks those?). The letter states you need to sign some paperwork, could you please come to the nearest branch to take care of it. It provides some directions to your branch that isn't your usual route but their way does seem more direct. You arrive at the branch and everything looks just like you remember it, even the tellers look familiar. They ask you to fill in some account information on a form, sign it, and you are on your way.

The good phishes don't ask for your password or account information through email outright. In an official looking email they direct you to visit your financial companies website to update or confirm something. For your convenience they even provide a link to the "website" for you, which directs you to an exact duplicate of that companies login page. I have even seen ones where clicking on the "help" or "contact us" links will actually take you to the corresponding pages on the real sites. A lot of these phishers are far from amateurs!