News: 1620719892

https://medium.datadriveninvestor.com/the-lesson-of-godaddys-fake-christmas-bonus-email-phishing-test-ede2d171f266

What's the betting that the link is actually another phishing test? They do say, “never click on a link that looks suspicious.”, what could be more suspicious than a link on a social media site?

Next security test will be an email saying "New staff competition - 10 lucky winners will get the chance to punch one of the management team in the gob. Click here to enter."

So are the unions seriously expecting IT Security to send an email out with a disclaimer at the end (in small print of course) so that the potential victims have a clue? That's not what phishing is about, surely, or am I missing the point?

Conversely, I would have thought that any email alleging to have come from train company management praising employees and offering money was suspicious in itself?

I've never had to register for a bonus - I would hope that they haven't been asked to register before.

Exploiting current world events is a common tool, so this seems like a reasonable phish test to me.

Yes, they would. I'm torn on this one... shitty trick to play, but well played in the theater of security. I'm sure the Lads from Lagos are taking notes...

Here is some money.. haha just kidding.

For phishing to be any use it has to look dodgy; contain spelling mistakes, a really obviously bad url. Should staff have known a bonus was beyond reality and that was the clue?

...and a dodgy but plausible looking domain name.

E.g. the one my old man received recently...

vodafone.billing-center.com

This "phishing test" done by these cretins proved nothing other than their employees are underpaid enough to click a link to a fake bonus.

A good phishing email won't contain mistakes, and the link URL will be convincingly plausible.

Then there is nothing for staff to recognise and identify it as phishing. All you will get are lots of people failing the test.

Remember during phishing training they show a 'bad' email with an obviously bad URL and it came from an obviously fake domain? Well if staff don't see that then why would they suspect it?

An email that came from the director, from a valid looking domain, with a valid looking url and spelt correctly with legit content - why wouldn't staff click it?

Are you suggesting staff should report every email from senior management as suspicious?

Are you suggesting staff should report every email from senior management as suspicious?

Sounds reasonable to me!

A good phishing email balances on a knife edge. It needs to be sufficiently crap that someone trained to pick them out will automatically discard it without a second thought (perhaps not even open it) but plausible enough that an untrained individual will think it is legit.

This is why phishing emails always have typos or grammatical errors. It's a way of filtering down the targets without having to specifically target anyone.

Someone that can't easily spot the typos or grammatical mistakes is unlikely to spot that an email is a phishing attempt.

If you're a phisher, offer anything that's related to Covid.

If you're a phisher, offer anything that's related to money.

FTFY

Our IT Security guys recently decided it would be a good idea to implement a new external domain to put all the security training on. They anounced this by sending an email from said unknown external domain, inviting us to click on a link to register using our internal domain credentials before taking part in the training. Many people reported it as a phishing attack, cue stroppy mail from IT Security berating us for being so stupid as to not believe their email that ticked all the boxes of being a phishing attack....

Email arrives in inboxes : "Dear team, please prepare full progress report of your work on big important railway project for meeting next week, The Boss"

Meeting starts.

"OK, let's start with progress reports - how is the track maintenance going?"

"Oh, I haven't done the report because I assumed it was a phishing email".

"Safety audit team?"

"Nope, we ignored the email too...."

Management have de-trained their employees. In pre-email times, you would not have expected to get any direct messages from the management, now they are spamming you every day, asking you to welcome new managers etc (don't think new managers appreciate getting their brand spanking new mailbox stuffed with 10,000 'welcome' messages from the grunts, so I've never seen the point of these).

Like the banks - "Oh, do be careful of spammers, you silly people" when most of them spent most of the last two decades (and some of them haven't stopped) phoning you up and asking you to "go through security" exactly normalising the behaviour they want you to avoid when anyone but them phones you up. All the time with the vast majority never coming up with any mechanism for proving that its actually them ...

If I get an email from management, and it exhorts me to click a link, and the email's not auto-flagged by our mail system, and the link is internal, I'm not going to click it. Not because I suspect it's a phish, and not because I suspect it's a trick, but because I'm already bored out of my mind doing my own job and don't want to be even more bored doing something that doesn't even help me get my job done.

What do they expect, phishers to send a nice header that says "THIS IS A PHISH!!!"

If they were using this as a screen to take disciplinary action against staff then it might be a bit rich but to identify areas for education tough, suck it up buttercup.

I've done the same exercises internally and had the same kickback, Unions insisting that we were "entrapping staff" despite there being nothing at the end of failed test except awareness training. Interestingly those who pushed back hardest against training were usually the worst at spotting them.

I'm aware of one organisation that was forced to alert staff that a test was being carried out.

So, if the email and/or the link was obviously external I have less sympathy for the recipients. Well, I have sympathy on a personal level, obviously, but I don't think they have been treated unfairly. That is even more the case if the email was flagged by the mail system as a possible phish and they still persisted ... then even my personal sympathy starts to wane.

However, if the link is on the intranet that is, IMHO, a completely different story. You don't know the thought process the user goes through. "Hah, hah, this can't be true! *hovers link* Wow, what do you know? Maybe my company is following the example of Aldi, etc! *clicks*"

In the latter case, I think the recipient is completely justified in considering themself to have been mistreated by management. I think management would have to prove they had never, ever sent an email with a link to even have a chance of getting away with this, and I'll eat my riding hat if they can do that.

Also, any sensible management would have paid a small bonus anyway. "You're all getting an extra 20 quid, but you should have realised you wouldn't have to register for it - we know who's on the payroll ;-) Be careful not to click links! Love, management xx" - PR success instead of disaster and a phishing test that might actually get remembered.

I leave it to other commentards as to what it proved.