Slashdot Mirror
Belgian Government Phishing Test Goes Off-Track
alphadogg writes: An IT security drill went off the tracks in Belgium, prompting a regional government office to apologize to European high-speed train operator Thalys for involving it without warning. Belgium's Flemish regional government sent a mock phishing email to about 20,000 of its employees to see how they would react. Hilarity and awkwardness ensued, with some employees contacting Thalys directly to complain, and others contacting the cops.
That is what we really want to know.
I've seen a similar type of system go off the rails, except the company forgot to put the target mailing list in the BCC field. Instead an unprotected mailing list with all 50000 employees was emailed out to everyone, so naturally someone hit reply-to-all.
After 4 hours of an endless stream of reply-to-all "TAKE ME OFF YOUR MAILING LIST" emails it all quietened down.
Then the Americans woke up and went to work...
It seems like relying solely on peoples' good judgement to figure out which emails are legitimate vs which ones are phishing spam (or worse, spear-phishing spam) is asking for trouble.
I can imagine email service providers using cryptographic signing techniques to assist the email client in reliably identifying which emails are definitely coming from their boss (or at least, from their boss's legitimate email account) vs which ones are unauthenticated and could have been written by anyone.
With that implemented, after a few weeks people would grow used to seeing the happy green "sender authenticated" sign at the top of each email from their boss, and if an email came in purporting to be from the boss, but with a big angry red "WARNING -- UNAUTHENTICATED MESSAGE -- MAY BE FRAUDULENT" (or whatever) sign at the top, they'd be less likely to hand over the company jewels without first confirming the email's validity.
Does something like this exist? If so, it seems like it's not widely used. If GMail/hotmail/yahoo could agree on a method and then start implementing it by default, I think that would go a long way towards reducing the effectiveness of email phishing attacks.
I don't care if it's 90,000 hectares. That lake was not my doing.
Streetwalkers sweet talk you out of your spare change
And your sweet madame makes it seem just like Belgium
So yet again a member of a government organization has willfully engaged in Identity Theft and/or Copyright or Trademark Infringement. Will they get arrested? Of course no. Heck, they won't even get a slap on the wrist as soon as the press quiets down. I guess it doesn't matter what country it is, they seem to think the laws apply to other people.
Care to elaborate?
Custom electronics and digital signage for your business: www.evcircuits.com
Shutup and take your Thorazine, Bubba.
He speaks perhaps of the infamous Congo Troubles?
Sounds like standard government cluelessness on behalf of the Belgians. A throwaway address I use on Mailinator has been getting some fails from Nevada's State Department of Taxation. They keep sending out mails like this,
The origin is TAXCCVAP03.taxation.state.nv.us. They've sent this crap 5 or 6 times this week and I wonder if they even know what they're doing. I keep waiting for them to accidentally attach some juicy tax records to the next "Large Test Run."
At work, I think every single "phishing" email I've ever gotten has been from one of these test campaigns. At this point, the main source of questionable-looking emails is lazy outsourcing where somebody unceremoniously hires a third party to process $HR_FUNCTION, doesn't bother to tell us that they're legit, and emails start showing up from the contractor's domain. In effect, they're training us to not trust their own supposed signals of legitimacy, then "testing" us to see how easily we're "fooled".
Are you pretending to now know that the Belgians are literally worse than Hitler? You must be a Republican if you're that ignorant.
... now they know how they would react. Mission accomplished, right?
File under 'M' for 'Manic ranting'
It's generally not known to American students, no. The lack of direct US military involvement, and the slaughter of millions by wealth seeking remote nationals doesn't garner the same sympathy 100 years later as the genocide of a nation's own citizens that occurred in Nazi Germany and in their conquered territories, a genocide that American military forces became directly involved in stopping and witnessed directly. There are few people alive who remember it personally, but the availability of popular media and of film evidence lent the later genocide more visual and historical power.
Belgium is made up of states, so the Flermish Government is like the Government of Texas or any other US state or German Bundesland.
For the rest: do not try to figure out Belgian Politics. It is kind of a clusterfuck that kind of works.
Don't fight for your country, if your country does not fight for you.
>Hilarity and awkwardness ensued, with some employees contacting Thalys directly to complain, and others contacting the cops.
That seems like the kind of reaction that would be encouraged, besides just not reacting to the mails at all.
Americans and their "geographical" knowledge. We now all seem to live in Germany suddenly... . Mendel was german that big country - how the hell can you mis it ? - next to Belgium.
He speaks perhaps of the infamous Congo Troubles?
These weren't medical from nature but had everything to do with the greed of King Leopold II and his rubber plantages. If you need to make a list of colonial crimes you will need to have a lot of time at your hands.
It is also extremely cynical to bring the Flemish government in relation with the stuff somebody from the royal family did. The flemish government is not particularly Belgium or the Royal Family minded. Flemish government is to Belgium as the Catalan government is to Spain, also wanting to get their independence.
Isn't it a point of phishing that you don't tell the impersonated entity that you're using their identity to scam other people? Even when you run a mock test, isn't it better to not tell anybody you're doing it, to avoid any false negatives (people that would have clicked, but won't now, because they know it's not their Nigerian friend, but the government impersonating him) and/or false positives (people that wouldn't click, but will now, to fuck with the government).
Thalys should know how to respond when phished people call their call centres, regardless of who phished them. They shouldn't need to be told by the phishers that they'll start receiving phone calls about unknown emails. That's what happens in real life!
But then... how did these guys get the real number for Thalys anyway? Did the testers forget to put their own number in, so they can take the credit card details in order to "cancel" the booking? Even a link with "click here to cancel" that went to "thalys.be.your.phishing.tickets.here.geocities.com" would have probably worked just as well.
"Everybody's naked underneath" -- The Doctor
He said MEDICAL atrocities.
I'm still wondering what he's talking about. If talking is the right word.
Americans and their "geographical" knowledge
Just some thoughts about that.
1) Take a map of the US and ask a bunch of Europeans to fill in the state names - the result will be worse than this. Much worse.
2) They seemed not to do too bad (for Americans) placing West European countries. I am a (West) European myself, but even I have problems placing some East European names on that map. Probably because that side of the map changed a LOT after I last learned about this stuff at school (about 40 years ago).
We conduct internal phishing tests from time-to-time. We find them to be a valuable part of our overall security framework.
I think that their biggest mistake here was not notifying their employees that random phishing tests will be conducted and to stay vigilant.
It probably would have also been better to start small on their first round.... "click here to take a survey and receive a free x" instead of, you know, instilling the fear of financial ruin...
My eyes reflect the stars and a smile lights up my face.
Wait... isn't contacting the cops what they're *supposed* to do?
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.