Hacker News Reader

Comment by thrwwwy29may | Hacker News Reader

> Embarrassingly, I failed this once and then created an email rule which filters out the fake Phish.

how did it get you, if you don't mind sharing? It seems if someone who works in IT (guessing you do) and is very careful fails it, this is an impossibly high standard to meet.

curious how they got you.

View on HN

I recently failed a suspicious email / phishing test for the first time, and I am also one of those people who never thought it would happen to me...

The email was a newsletter I didn't care about, and the unsubscribe link was (fake) malicious. That one impressed me because it preyed on what is now a pure reflex to click the unsubscribe link.

From this and other comments in this thread it seems you have failed these phishing tests as soon as you click a link. Is the assumption here that you are completely pwned as soon as you visit an url controlled by an attacker? I can't imagine myself compromising company data/funds via a website where I ended up through a newsletter unsubscribe link so this seems quite unfair on the part of the phish-testers.

That's exactly how my organization does it as well. I had to go to an incredibly asinine training because I clicked on a fake phishing link after verifying that the domain was owned by a computer security company that sold phishing prevention services. The link just went to a static "you could have been phished" page and a few weeks later I got an email telling me that I had to got to a phishing awareness training. There was no attempt at all to actually collect any credentials from me.

This is exactly the case. If you click on a link in the fake phishing email you've failed the test. It does not require you to install anything, open an attachment, etc.

I was once at a place where the company homepage was owned. Fun times.

Just starting your web-browser would exécuté some Java vuln and scareware you.

If you think visiting a webpage in Chrome, or any other browser, even inside a VM, is totally safe, especially against a nation-state level actor, I have some bad news for you.

You would literally have to never click on any link that isn't 100% under your own control in that case. Yes 0-days exist, but if I'm in an environment where that level of security is necessary, why do I even have access to a web browser?

If you think that just clicking a link is so dangerous that it needs to be a firing offense, then you should probably lock down the computers so that the browsers cannot view anything besides approved domains.

With that logic just having your mail client/web mail parse a malicious mail from a nation-state level actor is enough to compromise your machine.

It happens all the time.

https://thecoinshark.net/microsoft-email-clients-was-hacked-...

From the original article which that page links to [0]:

The breach centered around a hacker getting hold of a Microsoft customer support worker’s login credentials; from there, the hacker could dive into the content of any non-corporate Outlook, Hotmail, or MSN account

This is a security concern for any mail that an administrator can read, although it isn't at the same level as being compromised just through parsing an email.

[0] https://www.vice.com/en_us/article/xwndwn/microsoft-outlook-...

If you are in a high enough position that nation states are burning zero day exploits to launch targeted attacks against you, there should probably be a security professional filtering your email. (This is also a situation where disabling Javascript would be very reasonable.)

For the remaining 99.999% of the population, I really don't think opening a web page in an up-to-date browser is cause for concern. Certainly if that browser is also in a VM. People have more pressing concerns in their lives.

A nation state level actor will always get in.

Did the link take you to a site that auto-ran malware? Or did it take you to some kind of page that said "login to unsubscribe"?

The latter is why password managers can be so valuable. I never type my passwords in so if my auto-fill doesn't activate I immediately become suspicious.

If it's the former, it seems like your company must be using an insecure browser or the site was running some kind of 0-day? I never think twice about clicking links.

When my organization does these, the link just goes to a static page that says "you could have been phished". The fact that in fact no serious attempt at phishing has yet taken place and that my work machine is far too insecure if they're worried about browser 0-days seems totally lost on them.

> I never think twice about clicking links.

I hope you don't work for any sensitive position.

It's a valid comment, but if you're in a position where you are worried about 0-days from random web browsing then you should be using the internet on a fully segregated machine.

If Firefox or Chrome has an RCE + privilege escalation in it that can be triggered just from browsing to a page then, congrats, you got me.

The recent CPU-level vulnerabilities have exploits that can run in the browser. See https://www.zdnet.com/article/intel-cpus-impacted-by-new-zom... for pointers to video evidence. They're not zero-day attacks once they're made public, just the same as Meltdown and Spectre. Go download the PoC code, switch calc.exe to something useful, and phish away.

https://news.ycombinator.com/item?id=20028108 from earlier this week shows that just loading a page can lead to network information disclosure or other compromise / attack vectors. It's not a zero-day, it's a feature.

That's not very fair. Browser exploits are a lot rarer than phishing.

I don't think background noise of broad, low-effort phishing emails can be directly compared to a more focused attack. If you work somewhere with interesting data the odds of a good phishing attack leading to an exploit could be much higher because you're being specifically targeted and they're not going to send the message until they have a current exploit ready (probably hoping to get it in before your IT department's change window, too).

If someone had a working browser exploit, wouldn't they just deliver it to their targets via an ad network?

AFAIK most enterprises don't mandate ad blocking or noscript.

> If someone had a working browser exploit, wouldn't they just deliver it to their targets via an ad network?

I've heard more people at enterprises using ad blockers for security so I wouldn't rule that out but in general this is hitting that the broad vs. targeted distinction I mentioned: each time you use an exploit you're risking discovery, which will lead to it being patched & AV signatures going out. Using an ad network increases the number of people who are not your target getting the payload, not to mention any scanning the network does, and since ad networks require payment there's another trail pointing back to you which might not otherwise be the case if you are hosting things on compromised servers.

> a pure reflex to click the unsubscribe link.

That's a learned trait. I don't click unsubscribe links; I click "report spam" and "report phishing" button.

If only Gmail would let me create filters to automatically mark entire domains as spam though. That would be nice...

I'm sure this [reporting spam rather than unsubscribing] happens all the time but it's sort of obnoxious if the email is legit and, especially, if it's a list you requested to get put on at some point.

If you got my email address from a third party, then I do not want to be marketed to.

If you got my email address because I applied for a job, then I do not want to be marketed to.

If you got my email address because I signed up for a service, then I do not want to be marketed to.

If you got my email address because I purchased something, then I do not want to be marketed to.

If you got my email address because someone else "legitimately" entered my email address into your field, then I do not want to be marketed to.

In short: your definition of "legit" likely does not meet my definition of legit. The only email that I deem to be legit is an email that:

1) is @from a domain name that I recognize (walk like a junk, talk like a junk, it's junk) 2) is @from the same domain name as the correspondent (no third party bulk email or proxies; eg mailchimp et al) 3) does not have a no-reply@ as the reply-to address (I must be able to talk to a human) 4) does not hyperlink to third party domains (from@domain must match hyperlinked domain text)

Any legitimate email outside of those parameters are specially treated with liberal amounts of filtering.

Your attitude doesn't account for the possibility that since you do business with somebody, you need or want to receive some of their emails.

This is the nature of any relationship. You can't be ruthless in eliminating aspects you don't like, if you don't want to end it entirely because it's net positive.

> Your attitude doesn't account for the possibility that since you do business with somebody, you need or want to receive some of their emails.

You are incorrect and interpreting my comments very narrowly.

Doing specific business with somebody should not give that somebody carte blanch to use my email address for whatever reason they wish. I absolutely can be ruthless in eliminating aspects I don't like and if businesses don't like that: tough shit. My world doesn't revolve around your business. If that means that the business relationship ends right there, then I'm better off for it.

And, assuming there are clear and reasonable ways to inform them that you don't wish further communications (as there should be with any professional marketing), you should take that route. Otherwise anything is fair game. But I attended an event and got a follow-up email? Calling that spam is mostly being an asshole.

Why is obtaining a follow-up email from an event impervious to being spam? Attending an event is not consent for marketing. Marking spam as spam is not being an asshole.

I know it sucks when an IP gets burned, but when you're acting in good faith it's a rarity - or has been in my experience.

One of the reasons you'll pry Evolution from my cold dead hands is Right Click -> Create Filter -> @domain.co.uk and done.
I have filters for almost everything, my boss goes into one folder and gets set one color, automated notifications from my internal system another (green if everything is OK, orange if there is something I really need to look at).

What I really* want is a desktop client that exposes a nice clean Python (or similar) API so I can automate even further - I mean Python has everything I want if I want to do that from the CLI/cron but having it built in would be really nice.

What happens when one of those blocked domains becomes a vendor for your org?

Nearly all of them are tech companies trying to sell me stuff because I once bought something from them, tried their service or briefly thought about it.

As I’m the head techie (by dint of been the only techie) , I’d be the one purchasing from them in the first place.

I find a filter that sends everything to Marketing/Hardware and marks as read fairer than flagging them as spam.

If you filter out all the people telling me they’ll be out the office, birthday announcements etc, all the vendors trying to sell me stuff and all the automated stuff (which I do automatically), I get less than 5 emails a day (I put my boss on Trello, it’s just better for what we need) which I check once at 11 and at 10 to 5.

I’m ruthless about my time since I’m the only programmer.

The unsubscribe link is more effective at stopping unwanted emails.

I automatically unsubscribe people who mark email as spam but lots of marketers dont do that so you will still receive emails.

Most legitimate companies will respect the unsubscribe links as that is required by law and they invested more infrastructure around that functionality.

I wouldn't click on links from phishing attempts or emails from sketchy services I never signed up. Anything semi-legit is better handled through the unsubscribe link first.

Heh, you could make a phishing attempt that looks like a really bad phishing attempt, and inside of it have a link that says "CLICK HERE TO REPORT SUSPECTED PHISHING ATTEMPT TO IT"

If that’s the bar, the org should just strip out all external links. Voilà.

That way they’ll also protect themselves against an external vendor that gets used to spearphish you.

I nearly fell for a real fishing link once recently, due to changes that have been made by our IT department.

Firstly all external senders have the mail reformatted with a red bar at the top and some text, and secondly all hyperlinks are forced through a proxy, which makes it effectively impossible to know what the URL is from the email.

I'd received a (rare to my work account) fishing email and I was about to click on a link in there just before I started thinking. I'd been trained to trust emails with the red bar, as most external mail I get is trustworthy, and I reflexively check links before I click them but this was just another going through the proxy.

I'm not sure how much these changes help less technical users, but it made me less secure.

I hate the mimecast URL-hiding. I think it makes me less secure (but may make the totally not paying attention more secure).

That's just it, I simply wasn't being careful. Everyone gets distracted sometimes. I don't remember it in detail, but it was a fairly standard phishing email from a fake domain and I clicked a link. Not only am I in IT, my department is somewhat security related.

I guy I worked with fell for one when he was selling his car online, he got an email from an interested buyer (car thief) the linked to a very good replication of the site he was selling it on. The car thief turns up and scouts the location but the give away was that he showed little interest in the car, at which point he went back and checked the email to discover the phishing.

Even trained intelligent people have momentary lapses of concentration. Imagine opening a link from email on your phone then looking away for a second while it loads, but then the address bar has disappeared and you've missed the ssl indicator.

My address bar only disappears when I scroll down. I prefer that.

> It seems if someone who works in IT and is very careful fails it, this is an impossibly high standard to meet.

It's the same reason you automate things. People make mistakes. It's not about messing up once. It's about always being absolutely positively sure that you aren't making a mistake.

If you've ever clicked on a link from an email, you are vulnerable.

Reply on news.ycombinator.com