Want to piss off your IT department? Are the links not malicious looking enough? (opens in new tab)

I do not believe this is a trade-off, I believe this behavior from corporate IT is a primary cause of the problem. I do agree that dealing with users is awful, but that doesn't justify solutions that only make things worse.

The flashing cmd.exe windows are not drivers from Windows Update - this could have been the case as drivers shipped with Windows Update is a total security nightmare running arbitrary code with administrative privileges upon hotplug - but in this context of managed devices, commonly from HP or Lenovo's corporate portfolio, it's usually additional products and changes pushed by group policy or random management software.

The often changing user prompts, looking like they were from some early 2000's hello world example, come from obscure and overlapping management software they remotely deploy which they change at will. You don't need a proprietary solution to remotely upgrade Google Chrome, just specify an enterprise policy with auto-update. You don't need a proprietary solution to prompt users and manage Windows Update, because you have... Windows Update.

The URL checker has no valid benefit, and makes it so people can never learn how to do it themselves. The browser performs the exact same checks with the exact same capabilities through its safe browsing stuff, and corporate IT often has network-level solutions too.

Corporate IT uses emails services that spoof domains and look suspicious, reversing all the phishing training they paid for.

Not to mention that Corporate IT might deploy network-wide solutions like Cisco Umbrella, which is a TLS Man-in-the-Middle attack where you install their root CA on all machines and let them control DNS to randomly redirect all traffic to their servers, effectively undermining the basis of all modern web security for the entire organization.

In general there's a fetish for buying products that has significant negative impact to security, user experience and possibility of training users, usually for the purpose of feigning progress and meeting some targets. Say, they had a ransomware incident, and now they're buying every ransomware product for a few years. Stuff with such buggy kernel code that it deadlocks and makes it impossible to create new processes until you hard reboot. I'm sure that's not a security problem!

I sure do miss the days before browser makers conspired to make it near impossible to check the certs when there’s a certificate related error. “Most people are never going to check properly” is a poor excuse.

There is an easy answer. Give employees two computers.

One is the 'business' one. Mostly locked down, with checks in place.

The other is on a different network, isolated from all business functions, and they can do what they want but must never use it for work data, just like their phones (that everyone knows they use for social media etc. in the day).

Sure, you still have to deal with copying from one to the other (but there are solutions for that if critical, and much easier to secure).

It sounds crazy, but air-gaps are largely proven and it also means that employees feel less oppressed.

Now I realise, even ignoring the cost, businesses won't want this, as perish the thought their employees may do anything other than work. But I suspect it would actually stop more attacks and issues than otherwise and maybe... just maybe.. employees feel as if they're actually human.

My It department does mandatory phishing training every year, and then for the "test" e-mails, they spoof a domain and whitelist the DMARC on their side so it goes through.

So we get e-mails from @microsoft.com and it's only if you dig in the metadata that you see it failed authentication. The only tell in the e-mail is checking the URL, which doesn't tell you much because tons of regular e-mails use tracker redirects too. They even send emails from our own domain or the domain of our payroll company.

I won't type out my rant, but our IT department is a few guys who couldn't figure out what to do when their competitive xbox FIFA 2006 dreams failed, heard IT pays a lot with not much work, and then sat through the certs.

In Europe there are legitimate and extremely established services that require you to input your bank login details into something other than your bank's website. It's madness.

I find it very difficult to inspect the email headers in Outlook, I think for the iOS app it's not even possible. It's almost like they want to make it less transparent and secure

I recently reported an email with “glint.email.microsoft” as a phishing attempt, but it turned out to be a corporate survey.

Outlook has a rule filter for header content.

Just saying I haven't failed a phishing test in ~10 years.

Im in the security alias and that happens unironically every time the company rolls out a new external service.

Now sketchy emails are preceded by an equally sketchy “it’s ok” email from IT.

Nice, I use finicky as well, but now and again I have to change a rule or even add a new one. pisses me right off. Anyway thank you for sharing your dotfiles.

You innocent young being. There are some gaping holes in your Internet lore knowledge, but it's been eons since that's been seen in the wild.

Oh I figured it was gonna be this one: https://cam-xxx.live/rootkit-injector/evil-controller/payloa...

I’m surprised I had to travel this far to find it.

Fantastic link, very educational.

I'm sorry, what exactly is this?

Ngl I really want to

The way they used to handle that at a FAANG I worked for was they had this app installed on each machine issued by IT, that would ask you a question daily about some aspect of your workplace.

Handles all the phishing concerns, except that participation was either low or the feedback was negative, which would lead to the leaders issuing subtle threats to the team about how they'd find out the involved folks and fire them. If you tried to uninstall it, it'd be back in a few hours through policy management software (jamf and its ilk). On the internal discussion forums, they'd nuke threads talking about how to disable that software.

So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. I never really needed those threads, all I needed was tcpdump and then blocking its domain in the hosts file :)

In New Zealand, there is a long list of companies who need to reach out to a large number of current and former employees, and try to convince them to go to a website and enter sensitive information to receive some money (1). Where I'm working, we found it hard, even for current employees, to convince them that it's not either phishing, or a phishing test.

This is getting off-topic, but I found it interesting so I'll include more details anyway.

In a lot of cases, all the fuss is to return amounts that are tiny, and yet the companies need to keep reaching out and trying to convince people. I got $0.06 (2) from my current employer. Because I've moved countries with them, I ended up falling in the category of needing to provide some bank/tax details. Of course, I wanted to log in with the silliest OS I could think of to test/mess with the tracking dashboard, and so somehow I managed to enter my DOB wrong, which even further increased the back-and-forward and emails involved (I was in the project, so the Payroll peeps involved probably didn't hold it against me).

The re-calculation which led to the payment actually worked out that I had been underpaid in come calculations, but overpaid by far more (although still very, very little) in others. The company believed they couldn't offset, so all the fuss was for a tiny amount, which I felt I really wasn't owed anyway. Also unfortunate, was that if any former employee didn't bother to claim the amount because it's so small it's not worth the fuss, it just leads to more work in follow-ups.

New Zealand Holidays Act is quite an interesting area in general, in a how-can-it-possibly-be-this-hard kind of way. I think it contributes to the reputation of NZ payroll being one of the trickiest in the world.

1) https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-wha...

>... they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them.

Sounds like something a phisher would do. Better not click.

I’m designing a new phishing campaign that sends a pre-email telling the user they’re getting a legitimate email with <subject> then sending the phishing test email with that subject.

My company does this too by the way. Usually for external things like surveys they send a pre-email.

I had a similar experience. I got pulled up for not completing my anti phishing training. It had been sent from a third party contractor with a random domain, but apparently I was supposed to know that was safe but the other external links were bad.

noted for my phishing business: track first phishing attempt, send follow up email two days later saying the first one was legit.

That's actually super funny and it is not first time I see quite the same story.

They train people not to click links and then someone in management is fucking stupid enough to pull "just send an email with a link" kind of crap instead of properly planning the communication in advance by telling people that there will be a survey, what will be the company that is sending it, when they should expect it - but that just "too much work".

I would fire that kind of clown ass on the spot for not doing their job.

Doesn't help that most surveys are on external unknown domains, and look very suspicious (tracking codes, etc.). I get such links to surveys & other commercial bullshit from my bank too, like they want to train you to click fishing links…

This is hilarious. I wish I'd thought or doing it to my 85 year old father. Maybe I could have saved him the last 10 years of following spam email links into hellish conspiracy holes and identity scams. It didn't matter how many times I told him never to click on an email.

There should be a white hat phishing service you can hire to target your elders. Then when they give up their social security number, someone shows up at their door with a big cake with all their personal details in frosting.

> Nothing raises my suspicions quite like something calling itself "safe".

Ah yes, it's like a country having "democratic republic" in it's name - if you have to say it, it's probably not true.

I learnt that all those emails were sent through some relay. I blacklisted the relay. And then, some real training email notifications were sent through the same relay. But that relay is used for phising, so I just refuse to open the training email. Win-win.

Isn't that behavior desactivable?

Funny, I got an email today from them saying that so many people had protested against this change, they were going to pause it for review. I don't think I've ever seen them respond to criticism like that before.

They block this and force it to show up in my inbox

Aside from the test emails, many emails from contractors that our corporate IT works with have the appearance of phishing. I'm not shy about reporting any of these. Most of the time they say "that's a real email". I like to educate them that their contractors are sending poorly-crafted emails to the whole company.

That's a feature, not a bug. If the user can't load the redirection, they can't get phished! Problem solved.

If anyone complains, refer them to the security department to be audited. It's really rather suspicious when someone values doing their job above security.

What do you mean next five years? Tools like this have existed nearly as long as phishing has been a thing. You don't need a model and whatnot, this is old, boring tech.

You can just use SingleFile to download the login page of any website and serve it with a webserver

Alt+F4

I have a .ninja email and get the same a lot to the extend where I explicitly say "it ends in .ninja with no .com or anything".

Usually use company-i-buy-from@mydomain.ninja whenever I make online purchases, and I had a guy from a small shop call me up and ask why I had an email with his company name on. Took some good fifteen minutes to explain him that I was legit and owned the domain. He was still reluctant in the end, but eventually ended the conversation with something along the lines of "it's your problem, not mine, if the parcel won't reach you for using a fake email" :)

I have a .co domain and noticed that some people think it’s a typo and adjust it to .com

I use [vendor name]@[mycustomdomain].com which is a catch-all email, [anything]@[mycustomdomain].com goes to my inbox, so if I use something like disney@[mycustomdomain].com and then I have to talk to someone on the phone about an order and they ask for my email address, they invariably get confused and think I work for the company or something like that. Then I have to explain that I use the company's name in the email address so I can track who is selling my email. They don't understand it but I'll keep explaining it until they just accept it and move on.

I have first@last.family. I've had that issue and my family doesn't want to use it; mostly they'd rather have first.last@Gmail.com, and my dad thinks it should be @firstlast.com or first@last.com (never mind that last.com is in use)

I have had a .xyz email for like 10 years at this point. It's 50/50 of people saying "is that really a email address" and people acting completely normal.

Never going to know what reaction I'm going to get.

Oh, you must mean firstnamelastname@gmail.com.

i have a .dev domain and i get the same thing all the time

Nice try, jader201. You're not snatching MY cookies!

I usually just ask my password generator to generate another random password for the secret question's answer.

Why not address the problem at its real source and just block emails entirely?

What is an alternative?

Come on man, don’t be so uptight. We can’t just be 100% max security all the time or no one will want to do business. A little bit of risk for clicking a link is worth the convenience.

Where/how?