Hacker News Reader

Comment by Endy | Hacker News Reader

How hard is it to make people understand what a business email should or shouldn't include? If you're being asked for data by someone you don't know, either ask a manager or someone connected to the account in question.

Are people really so gullible & trusting?

View on HN

> If you're being asked for data by someone you don't know

That's not how spear phishing or even phishing works. The email looks like it came from a fellow employee/boss/trusted party.

That's only true if you have a shitty enterprise email system. On a proper system such spear phishing attempts are blocked before reaching end users, or at least immediately obvious to anyone paying attention.

With no false negatives, right?

Right, no false negatives. It's trivial to determine whether a message purporting to come from one of your corporate domains was actually sent through an authorized internal server. Plus the IM integration in Outlook makes it super obvious which messages came from legitimate internal senders and which did not.

What about the sending and reply-to address? If the account is actually compromised at a system level, that is an IT issue. Again, are people so trusting that they don't check when asked for confidential data?

From and reply-to looks just like your company unless you catch the misspelling. "l" and "I" in the domain name go to different companies, but when everything else in the email looks just like any other email from IT you aren't going to notice that small difference - you probably won't even read the from/reply lines.

The address doesn't matter in some of these scams. It could be a message spoofed from your boss's real email address saying, "Hey Sam, I sent you the wrong account we need to wire money to. It's actually 123456. Can you fix that ASAP? Thanks!"

Sending addresses can be spoofed.

End users should never see emails that fail DKIM or SPF checks. Sender address spoofing is a solved problem.

If a company gets owned because they failed to implement SPF or DKIM properly, IT is at fault, not the employee.

But wouldn't you reply to the address it specified instead of the source of the spoofing? I thought that was why most phishing emails include a link rather than asking you to reply.

Have you ever worked for a big company? (Think several US offices, half a dozen European and Asian offices, 500m in revenue).

Someone forwards me an e-mail from our Dutch office that says, essentially, "The world is burning down, we are boarding a plane in a couple of hours to go to IFA (show), and we don't have the latest copy of product X to demo for customers."

I do builds by hand of this product because I can't get resources allocated to automate it

I have never heard of any of these people before. I reply asking, "I am sure I can accommodate you, but, Who are you and why I haven't been told about this before now?"

To my shock, the guy replies, "I'm the European Vice President for product X, we didn't ask before now because it has never been a problem in the past. Who are you?"

I reply, "I'm the only person in the entire world with the encryption keys to provision the product, and that has to be done on one single computer in Santa Ana. It's only a fluke that I am here today-- my car wouldn't start this morning, and I had planned to take the day off to fix it, and then by some miracle an hour later it started. That's why it's important to know about things ahead of time."

That's what working at a big organization is like, you interact with people who don't know all the time. And frankly, nobody is ever allocated time for "security" in their schedule. My dance card at that company was scheduled for 8 hours of development a day, no e-mail answering, no security, no time to do the build system. No time for meetings. Nothing.

> I'm the only person in the entire world with the encryption keys to provision the product

The chaos that surrounds you, the facts that astound you, at last your number has found you, your bus number is one.

Googling this quote reveals nothing. Is it a quote? Or are you HN's resident poet? :)

Maybe that's how it is at your big organization. I'm sure glad my big organization is different.

I suspect the world runs on more chaos than anyone would like to believe.

But when your big org is hiring, let me know :)

Hail Eris.

> Are people really so gullible & trusting?

Yes, and it is not a “bad” thing outside the niche of security I think. We should all hope to live a life where we can implicitly trust other human beings.

In small town America in the 70's and 80's of my childhood, life was pretty darn close to this.

The tests I have seen are more like a macro enabled office document attatched to an email that says it is from an address actually on the corporate email server. And it has a line like "review my schedule update, a week less for test creation is fine right?". Except I don't work with the sender and the corporate firewall as marked as having actually been sent from outside.

The trouble is that people have a ton of intuitive buttons to push, and being intuitive they're not usually aware of them. (In straight cons, the buttons are often emotional, which is why the term con comes from building "confidence." Phishing is more faking authenticity than appealing to emotion.)

Skepticism and rational thinking require effort, and thus as people are rushed or tired, those are the first defenses to fail. You can train to recognize patterns of phishing, but learning those patterns takes time, repetition and effort.

All that a good phish requires is finding the right buttons to push on the right person, and they have many potential victims to press them on, and little to no consequence to getting it wrong.

So, the answer is people are not particularly gullible, but the weak links are a constantly changing, largely unknown dynamic and the phishers can hammer at all of them simultaneously until they get through.

I suspect hiring practices and company culture may be selecting for gullability either accidentally or deliberately in many cases (cynically the gullible are easier to motivate cheaply). Like how "being a team player" is used to refer to willingness to work unpaid overtime as opposed to actual ability to cooperate.

If they value "responsiveness to their authority over procedure" then people will send the entire financial records to "the CEO" for fear of getting fired otherwise.

> If you're being asked for data by someone you don't know, either ask a manager or someone connected to the account in question.

Most cases I've seen of successful (or nearly successful) spearphishing would have been solved by someone picking up a phone and calling their co-worker.

"I know you sent me an email, but can you just explain again why you want me to buy $1000 in iTunes gift cards and email them to you?"

"I got that invoice you sent. Just wanted to confirm the amounts -- $50k wire transfer?"

What about an email from someone you know (coworker, relative) via a spoofed or compromised account?

I learned to look at reply-to back when I used Juno & Netscape Communicator. Heck, Communicator used to warn you if reply-to differed from the displayed name.

Reply on news.ycombinator.com