Hacker News Reader

Comment by bearjaws | Hacker News Reader

The sophistication of attacks is rising exponentially. "Spear phishing" has pretty much become the norm, all our new hires get an email from our "CEO" pretending they have to sign paper work for their equity... Its part of our onboarding now to warn them that if they join our LinkedIn they will get multiple phishing attempts from the "founders".

View on HN

We have a web page which lists every single tool/service we use, and we actively encourage people to check whether unfamiliar links are listed on that page.

I've considered creating a browser plugin which marks the address bar red/green when you're on URLs the company (dis)trusts. Seems like this would be something that should exist already.

All that is going on is that hackers are learning about how telephony works and weaponizing it. No different than social networks and email. It is time to move off of email and SMS as 2fa.

> Its part of our onboarding now to warn them that if they join our LinkedIn they will get multiple phishing attempts from the "founders".

Hm, i wonder what the point is to warn them beforehand?

I think OP means that new hires are receiving actual spearphishing emails from attackers outside of the company, not that they're testing them by sending fake spearphising emails. (I misread it as the latter at first too)

Ha - thanks for clarifying - now that i read it over again... you're probably right and it even makes sense to do so...

I'm not sure if they ever did this during onboarding, but my former employer would regularly run fake spearphishing campaigns to raise awareness about spearphishing.

The number of people who regularly fell for it was worrisome. Falling for it meant auto-enrollment in a mandatory security awareness training. Failing to take the training would result in deactivation of the individual's network credentials.

I don't know if these campaigns are actually effective at changing people's behavior, but they certainly revealed how effective spearphishing is.

The main problem is they are real attacks that 100% happen as soon as they update their LinkedIn. They aren't tests like a Knowb4.

Reply on news.ycombinator.com