Slashdot Mirror
The Sophisticated Business of Today's Most Nasty Phishing Attacks (infoworld.com)
snydeq writes: Forget Nigerian princes — today's spearphishing is sophisticated business, fooling even the most seasoned security pros, writes InfoWorld's Roger A. Grimes, in a look at what sets today's most sophisticated spearphishing attempts apart. 'Most of the time, phishing attempts are a minor menace we solve with a Delete key. Enter spearphishing: a targeted approach to phishing that is proving nefariously effective, even against the most seasoned security pros. Why? Because they are crafted by thoughtful professionals who seem to know your business, your current projects, your interests. They don't tip their hand by trying to sell you anything or claiming to have money to give away. In fact, today's spearphishing attempts have far more sinister goals than simple financial theft.'
Not new on the Internet; not new in general: http://www.imdb.com/title/tt0070735/
which is the plan according to Dice. Why do you come here anymore? Leave and never come back! Dice will sell /. for $1. THEN come back.
I have retorted!
it's an ego play.
What seasoned security pro would click on a link that takes them somewhere that requires account credentials...and then enter those credentials?
The editor seems to have confused "compromised network" with "phishing."
Methinks /. needs new editors.
From TFA:
"Today’s professional Internet criminals work 9-to-5 days, pay taxes, and get weekends and holidays off. The companies they work for often have dozens to hundreds of employees, pay bribes to local law enforcement and politicians, and are often seen as the employer of choice in their region. Working for companies that break into companies in other countries is often proudly worn as a patriotic badge."
Tell me again why a submarine launched Tomahawk cruise missile doesn't suddenly strike that corporate HQ one day, killing everyone in the building and reducing it to rubble and ash? It seems that these people need to be reminded of who they're messing with when they declare war against our financial system.
Such attempts can be easily be stopped dead to rights by social reverse engineering, and attention to detail. Obviously the seasoned IT professionals do not sound like real IT professionals at all. In this day in age you have to think more like a Black Hat and less like an engineer in a hat when it comes to information security.
With smartphones and social media broadcasting our every little detail through the lens of narcissistic amplification to the entire planet it wouldn't take much effort at all to figure out your soft spots. All it would take is the idea and a psychologist leading a call center where teams work on a list of targets scraping social media.
Oh hey here's one from town x in the state of y and there is a documented outage of y right now. Lets call pretending to have shut y off until they pay the over-due amount.
Then there's the 'find out your new Star Trek Name' games:
Correlating your birthday to words ? You just gave them your Birth-date etc.
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
There are plenty of regulations and such that require all employees take certain training or sign certain forms. In any company of significant size, HR sends out such emails.
In the security realm specifically, SANS is a major, major name. Possibly the best known and respected provider of security training. They offer some of that training at securingthehuman.org. The have a program in which companies can have all employees take SANS training at CompanyName.securingthehuman.org. To ensure that each employee does the training, you have to log in with your credentials.
Of course HR or the security administrator sends a mass email telling all employees to click the link to take their mandatory security training. That's security administrators working with the leading provider of security training, and we're REQUIRING all employees to click an emailed link and enter credentials.
At most security- conscious companies, employees also have to agree to the security policy. In order to have a database showing that every employee has received the policy, we have them LOG IN and click "I have read and agree to the policy". And we send that link out to all employees either upon hire or annually.
We don't just click links, the security professionals -require- all employees to click the log in. Then we get annoyed when an executive or sysadmin clicks a link in an official- looking email and logs in (forgetting that we ourselves did the same thing two weeks before).
we have such courses at google too, but the vendors are invariable required to use OAuth, so no credentials are entered on 3rd party sites.
The companies they work for often have dozens to hundreds of employees, pay bribes to local law enforcement and politicians, and are often seen as the employer of choice in their region. Working for companies that break into companies in other countries is often proudly worn as a patriotic badge.
Demarcate internally-sent emails from external in the server and email clients (by IP address, with additional logic to detect spoofing). That way it becomes immediately clear whether the email you got is really from your coworker.
Is the Oauth launched from / embedded in the 3rd party site?
In other words, does the email link to a 3rd party, which then has an iframe or popup to Google's OAuth? If so, the source of the iframe is a technical detail that's invisible to the user. As far as they can tell, it's a third-party site they're being told to enter their credentials into.
The alternative is to have them log in to the local trusted company web site, which then has an SSO link to the third party, so that users never enter credentials after the third-party site is loaded.
There are plenty of regulations and such that require all employees take certain training or sign certain forms. In any company of significant size, HR sends out such emails.
At a previous company, HR sent out just such an email, and the links all went off-site, to some domain like "12monkeys.com" That wasn't the name, but it was something similarly named, a "no actual company HR would really use would ever have a name like that" sort of domain. It was also newly registered, and I believe that it had "Privacy Protect" on its whois data to boot.
When I got it, I immediately sounded the alarm, yelling "PHISHY PHISHY PHISHY PHISH!!!", because the email went to everyone in the company. The HR types were ... quite put out ... but I did the right thing, and my boss, and everyone having anything to do with security agreed.
I'd like to think the HR types learned something from that one, but I suspect they didn't.