US Army "Scams" Service Members to Test Their Spam Gullibility

9gezegen writes "An offer for free tickets to theme parks for service members turned out to be an email scam, a ploy that was in actuality a security exercise run by the Army. Involved servicemen and DoD civilians received an email, allegedly coming from the 'Army Family and Morale, Welfare and Recreation Command Office,' and directed them to a phishing site which asked for personal information. After rebuttal and warning by Army MWR, the website revealed that it was a security exercise after all. Army MWR later verified the exercise and announced they were not informed beforehand."

Comments

Let me guess...

[Chris Burke]

In order for the Army MWR to verify that this was in fact a legitimate security operation, they had to visit a website and enter their personal information...

Why no stats on who fell for it?

[QuesarVII]

I want to know a percentage of people that fell for it!

Typical

[SatanicPuppy]

The MWR people are all crying because no one told them that it was a test...Apparently, in their minds, there is no need to test an army organizations response to someone falsifying announcements in their name.

Sounds like the test went off swimmingly. I can't count the number of times I've thought about doing the same sort of thing to people I work with. A few good solid scares will tighten up their security policy.

Re:Typical

[KevMar]

I am tempted to do this all the time, but I know the administration would not understand what I am talking about. In the end I would prabably get fired on a technicality.

The weakest link in any security system is the end user. I work with users that have the hardest time with computers. I have this guy call every week because he forgot his password and I have to take 10 min training him how to change his password. (why every week? he only works on Thursdays).

Now you will have to make a new password is has to have ... blah ... blah ... ... You have to retype it to confirm it before you press enter this time.

now you have to put in your old password again. not that one, the one I just gave you is the old password. You have to click in the line. click the mouse. left click. you can't hover the mouse over it, you have to click in it. ... now type you new password. On the next line retype it. You have to click, no left click, click the mouse in the box.

You have to type it the same. no, I can see they don't match. the first one is longer, it has more dots.

You just cant explain to some people what fishing even is.

I had one guy call up freaking out that his computer told him he had porn on it. (its a fire on the spot if you have porn). It was a little pop up window trying to get him to instal a program to "remove" it. The good news is he was too scared to click the button and called me instead. Other users had to be rebuilt.

I know an attack like this would catch so many people and you have to train them. But you spend so much time just logging them in or working on the basic stuff. This is one detail that some people will have a hard time grasping.

I am in an interesting enviroment. I have college students looking to enter the workforce working with people that are about to or have retired. So I deal will the full range of users all the time.

Re:Typical

[raehl]

how long will they remain scared and secure?

As long as you leave up the signs that say "Threat Level: Orange", of course.

Re:Typical

[daeg]

Clear it with management and do it on a limited, rolling basis.

We do it on a random sample of users with our web platform. All login requests get routed to a central domain ("shield.domain.com") which is non-SSL. That domain does a little basic load balancing to distribute requests to "https://foo.domain.com" or "https://bar.domain.com". We have a few extra domains set up, including "https://foo.domane.com" with a valid SSL certificate; "https://aa.domain.com" with an invalid certificate; and a non-SSL domain, "http://foodomain.com". All are nearly identical to our login page - one has a button out of alignment, throws some JavaScript errors, etc.

The pages alert the user to the deception on the first try. Second tries net a phone call. Third tries get a more detailed phone call with the office owner & account lockout.

It's been very effective, in fact, I've received several thank you notes so far from our users for teaching them about it. Not just dictating to them, but teaching them through first hand experience. They thank us because they can easily apply those same "does the address bar really match what it should?" technique to every other site out there.

And to get the same effect as phising, we send out periodic/random e-mails that read pretty official, but come from the wrong domain, or have a forged From: address, asking a user to visit a set up fraud website to enter personal information (not detailed, mostly just fishing for their user credentials).

The only thing I don't know yet is if users are learning because they are actually learning, or if it's a forced behavior just so they don't get a phone call from me. I'm not sure it matters why, just as long as it's happening.

Re:Typical

[vidarh]

A company I did consulting for at one point did this by posting a top ten list in a very visible spot in the office regularly. No identifiable information, even though all outgoing requests were forced through Squid and so they had the internal static IP addresses of everyone. Within a week visits to "undesirable" sites had dropped to near zero, and there was no reason to deal with anyone - just a gentle reminder that their requests _had_ been logged seemed to be more than enough.

Re:Typical

[bhiestand]

The weakest link in any security system is the end user. I work with users that have the hardest time with computers. I have this guy call every week because he forgot his password and I have to take 10 min training him how to change his password. (why every week? he only works on Thursdays).

Now you will have to make a new password is has to have ... blah ... blah ... Have you ever considered that your passwords might be too complex for the average user? I worked for an organization that had very stringent password rules: 2 lower case, 2 upper case, 2 special character, 2 numbers, numbers cannot repeat, letters can't be next to each other on the keyboard, and password must be changed every 60 days, and that was just for my network login. There were more for internal company websites, databases, and custom programs that all had to have similar (but different) passwords.

I consider myself fairly intelligent, but I had a heck of a time remembering the passwords and was embarrassed by needing regular password resets after long weekends.

To make matters worse, password management programs like KeePass were not allowed on the network and any unauthorized software could get you in trouble. Because of this I ended up having to do things like writing half my password on a post-it and the other half on a card in my wallet. I devised all sorts of incredibly insecure systems to store the myriad complex passwords I was required to maintain.

This is good.

[Anonymous Crowhead]

More companies should do this. Hell, banks should do this to their customers.

Re:This is good.

[steveo777]

Hell, banks should do this to their customers.

They already do. Haven't you ever received a "Pre-Approved" credit card application?

Not the answer you are looking for....

[raehl]

Because it's Wednesday, and the test was on Monday. Give 'em a chance to process the data!

Now, on to the answer you were looking for:

Unfortunately, in the process of transferring a few million dollars left by a distant relative in the State Bank of Nigeria, the soldier responsible for compiling the data allowed his system to be compromised, and all data was lost.

Addendum

[oahazmatt]

1. Don't ask.
2. Don't tell.
3. Don't opt-in.

Re:Addendum

[TubeSteak]

1. Don't ask.
2. Don't tell.
3. Don't opt-in. Hello [Armed Forces Member],
    This is an e-mail from the Army Family and Morale, Welfare and Recreation Command Office informing you that you've been signed up for the "STDs and You" mailing list. To Opt-Out, please visit the following link: hxxp://maliciouslink.com where you will be asked for some basic information to verify your identity.

.mil???

[QuantumRiff]

One would think the military would have an easier time than most. You and I cannot register .mil addresses. Shouldn't the people have been looking out for http://mwr.army-support.mil/ instead of http://mwr.army-support.com/ (the link in the email?) Or does the army use .com addresses for some things, cause that seems silly. One would think they could tweak the source in firefox to change the address bar a different color for .mil addresses or something..

Re:And what was the point?

[qbzzt]

Either way that's not cool at all. Just think if your company set this up on you, what would your reactions be?

If my company trusted my co-workers with information that could get me killed, I'd want them to test susceptibility to social engineering. If I do a bad job, my company loses money. When people in the military do a bad job, people can die (OK, when they do a good job people still die - but they're other people, those trying to kill them). They need to worry more about security.

Re:In before....

[Moonpie Madness]

who are these people making that suggestion?

I'm not pretending the army is full of Einsteins, but they all graduated high school or earned a GED (vast vast majority graduated high school), and all of them are required to learn math skills involving chemical attack detection, navigation, operating a frequency hopping radio, etc.

Compare that to kids in the average US city, where 50% do not graduate high school.

The Army is certainly a lot smarter than the general population. They may be more willing to rely on titles (like MWR)... I don't know about that, but I'd like to know who is buying the Carter era propaganda that the army is a bunch of idiots.

I like it

[Daniel Wood]

I didn't get the e-mail myself(or maybe I did, I'm on leave so I have not checked it in weeks), but this is an example of the kind of tests that the Army should do. Not telling MWR, good idea. It not only gives them an opportunity to see the response of troops, but an opportunity to see the response of MWR to this kind of threat.

What I think the Army will find most surprising(or not!) is the apparent lack of use of the AKO Webmail system, it sucks, hard. //SPC Wood, Active Duty

Dear Seargent or Lewtenant

[jameskojiro]

Hello, I am the former general Fred Mercasey of Ft. Oscdurity and recently I was relived of command. Not before I had transferred a large amount of C-4 and M-16's in an un-marked supply shed on the outskits of the base. The decision to relive me of command was unjust and illegal. I need your help in helping me reocver these supplies. With your assiatnce I will reward you with 10lbs of C-4 and 3 M-16s. In order for this transaction to happe3n you will need to send a good faith deposit of 3 M1A1 Abrams tanks to and undisclosed location in the Sierra Nacho desert. God Bless and Ten-hut!

Re:In before....

[evilviper]

you will see what is printed on the launch tube.

"AIM AWAY FROM FACE." ???