Slashdot Mirror
RSA: Phish Me If You Can (Video)
Spearphishing. The deluxe (but easy) way to get unwary employees to put malware on your network. It's basically the same as phishing, except more targeted. That is, a plain phishing scam might offer an unwary web-browsing employee a chance to see a famous starlet naked, while a spearphishing attack might purport to be an urgent request from your Bizzaro County office for 200 Kg of Unobtainium Oxide. Open that email, and... ZAP! So this is social hacking (cracking for the old-timers), and cannot necessarily be fought entirely by technical means. So how about setting up fake spearphishing attempts and immediately sending employees who fall for them to an IT security class with an emphasis on how to avoid phishing scams? You can do this yourself, possibly with help from a bright person or two from a nearby University. Or you can contact PhishMe or another anti-phish training company and have them help you teach spearphishing awareness to your people. Either way, every computer-using person in your company should know about phishing -- and should know how to avoid getting hooked by phishers.
Your daily Slashvertisement brought to you by Dice Holdings, Inc.
Open an email? You mean text? Not really a problem. if you're not blocking images and JavaScript, you're headed for trouble, targeted or not.
The problem is 100% technical. How could viewing an email ever result in malware being installed? Somebody failed -- they're called the IT department.
It's the fact that they treat us like eager morons, who won't recognize it. I mean the signs are dead simple.
1. Mentions a particular company by name.
2. Includes at least one buzz-word.
3. Entirely positive language.
Regular Slashdot stories pretty clearly have signs of concern or raise questions about their subject matter. These bare-naked slashvertisements are insulting. If you're going to be blatant, please fucking acknowledge that it's sponsored in the summary.
Lol, that one always works, and even though it is clear it doesn't need to be clicked, they click it anyways... I got to use that one when the Melissa virus was blocked based on the subject line "I have an attachment for your review", rather than on matching the payload of the email attachment. I made $5 on a bet with the Exchange admin, and got to watch hilarity ensue at the Exchange admin's desk when 40 hungry developers showed up, wondering why there was no free lunch and their Outlook clients were taking up all of their system resources.
Three videos posted over the last couple of days - all of which purport to provide insight, at least in summary. I've not made it through more than a few seconds of each since there is excessive background noise.
Use a more targeted mic? Do some post-processing? Find a quieter room to interview your subject in? Provide a transcript?
Otherwise, it's just a waste of effort.
When setting up a test like this, first look at the legitimate e-mails sent around your company. If your business routinely circulates e-mails containing attachments employees are expected to open or links they're expected to click on, then ask yourself why you've got an overlap between what you expect employees to do and what you want them to not do. If you expect employees to check addresses but your e-mail client hides addresses, ask yourself why you're hiding what you want recipients to check. If you're having to ask those kinds of questions then the first problem you need to address isn't employees being vulnerable to spearphishing attacks, it's your internal e-mail culture and standards that make those vulnerabilities normal and expected.
Expect a lot of resistance to fixing these things. Not from your regular workers, from the upper layers of management who like these things because they make life easy and look "Oooh, shiny!".
It's a lot like physical security. You can emphasize it all you want, but when managers get angry at employees who closed the door in the manager's face forcing them to use their own key you will not get employees to stop letting people tailgate through doors.
I THINK THE EDITORS ARE MODERATING CRITICAL COMMENTS DOWN!!!
I got 5 troll mods in a matter of one minute, making a pretty reasonable post(I thought).
I thought it was bizarre the GP got modded down once, but I really think Dice. is modding the fucking comments.
I got duped into clicking the story thinking it was a legitimate article. Instead I got a slashvertisement... ./suckered
Many corporate users use Outlook. When viewing (or previewing) HTML-formatted messages, it uses the same rendering as Internet Explorer, and is thus susceptible to the same vulnerabilities.
I can remember a happy time when I could tell people with confidence "you'll never infect your computer by merely viewing an e-mail". Or a JPG. Or a PDF. Or ...
Can someone tell me why all of Roblimo's posts 1) are his own content, versus edited reader submissions, and 2) read exactly like advertisements?
LegendMUD
Everyone who clicked on this link needs to now attend a phishing training class, you have all been suckered into clicking on this blatant advertisement!
It's not about being dumb, it's about not being aware. If the first phishing email you come across is one that's technically advanced and well written enough to slip through the technological filter: then you as a corporate employee are probably going to fall for it. Especially if it's a true spear-phishing email that's targeting *you*. It'll look like an email from your boss with yet another emailed PDF or DOCX report to review. Bam.
The solution that PhishMe proposes is to safely expose employees to phishing emails on a regular basis and teach everyone to recognize actual phishing emails from those demonstrations. The human reading the email and about to click the link or open the attachment is your last line of defense and shouldn't be neglected as such.
Does every one remember a few weeks ago when a company sent out a real email asking for users to change passwords and some people thought incorrectly it was a phishing email..... Basically that single event proved that people don't understand how to read / detect phishing scams. if you can't even recognize or take steps to recognize whats real from whats fake then I don't know what to tell you, the issue isn't always the scammer or lack there of, sometimes just blame the users.
Yeah, and while we knew there were a bunch before, I think we're def. seeing Dice's hand in all this.
The other posters are right about the shift to video, and Roblimo, who really was off the radar until last month. Here is a Reuters article describing specifically how this company is a spinoff of some other one a couple years ago. So yes, it's absolutely a Slash-vertisement. http://www.reuters.com/article/2012/03/20/idUS120683+20-Mar-2012+BW20120320
Besides your heuristics, let's go even farther. It's these companies that seem to specialize in "protecting/training", with unclear extra motives buried in there. To paraphrase xkcd: "My hobby: watching Anonymous bust open these companies purporting to specialize in providing privacy/security services." Because they're in a position where they can't have ANY incident on their record with the services they sell. Yeah, I sorta don't care if Walmart hoses their data records in some random location branch because that store manager was an idiot. It's Walmart. These security companies are in a different league. Remember HBGary?
And these Slashverts are coming *fast*. No subtle sneak-in. Fast. The question is whether the rest of what used to be slashdot is worth reading anymore if these aggressive slashverts keep barreling at us. It's like a game of Ad-DonkeyKong. Jump over the barrels!
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine