A phone call from Microsoft about my Norton anti-virus subscription putting me into debt that can only be settled with Nintendo gift cards bought in cash across 16 specific gas stations seem much more legitimate in comparison.
Most people are never going to check the links no matter how much you ask them to, and even if they did they wouldn’t know what to check for. But the tool Microsoft give you to check a link before opening it is that awful URL rewriter, which prevents the small minority who would check from being able to.
Similarly those flashing cmd windows are usually automatic update processes that Windows has no way to hide. Even some drivers that MS distribute through Windows Update do it. We could turn automatic updates off, but then nobody would update their software.
IT is rough because you’re often stuck between a rock and a hard place. On the one side you have users who don’t want to change their behaviour, on the other side you have industry leading vendors, that the SLT insist on using, that make it impossible to do the right thing or put the right thing on an Enterprise plan that the budget won’t permit. Then to top it off, there are usually compliance and insurance breathing down your neck forcing you to implement questionable best practices from the 90s, so you just have to do your best to limit the damage.
One is the 'business' one. Mostly locked down, with checks in place.
The other is on a different network, isolated from all business functions, and they can do what they want but must never use it for work data, just like their phones (that everyone knows they use for social media etc. in the day).
Sure, you still have to deal with copying from one to the other (but there are solutions for that if critical, and much easier to secure).
It sounds crazy, but air-gaps are largely proven and it also means that employees feel less oppressed.
Now I realise, even ignoring the cost, businesses won't want this, as perish the thought their employees may do anything other than work. But I suspect it would actually stop more attacks and issues than otherwise and maybe... just maybe.. employees feel as if they're actually human.
So most of us carted around a work laptop (connected to corp WiFi) a personal laptop (on guest WiFi or tethered) a work phone and a personal phone.
In other news, you should never ever MDM enroll your personal phone with a work BYOD policy.
Developers are the exception here, where usually they'd prefer to develop on a machine with minimal BS running, even if it means carrying around an ultraportable in addition to their development workstation laptop.
The flashing cmd.exe windows are not drivers from Windows Update - this could have been the case as drivers shipped with Windows Update is a total security nightmare running arbitrary code with administrative privileges upon hotplug - but in this context of managed devices, commonly from HP or Lenovo's corporate portfolio, it's usually additional products and changes pushed by group policy or random management software.
The often changing user prompts, looking like they were from some early 2000's hello world example, come from obscure and overlapping management software they remotely deploy which they change at will. You don't need a proprietary solution to remotely upgrade Google Chrome, just specify an enterprise policy with auto-update. You don't need a proprietary solution to prompt users and manage Windows Update, because you have... Windows Update.
The URL checker has no valid benefit, and makes it so people can never learn how to do it themselves. The browser performs the exact same checks with the exact same capabilities through its safe browsing stuff, and corporate IT often has network-level solutions too.
Corporate IT uses emails services that spoof domains and look suspicious, reversing all the phishing training they paid for.
Not to mention that Corporate IT might deploy network-wide solutions like Cisco Umbrella, which is a TLS Man-in-the-Middle attack where you install their root CA on all machines and let them control DNS to randomly redirect all traffic to their servers, effectively undermining the basis of all modern web security for the entire organization.
In general there's a fetish for buying products that has significant negative impact to security, user experience and possibility of training users, usually for the purpose of feigning progress and meeting some targets. Say, they had a ransomware incident, and now they're buying every ransomware product for a few years. Stuff with such buggy kernel code that it deadlocks and makes it impossible to create new processes until you hard reboot. I'm sure that's not a security problem!
My current employer was somewhat recently purchased by a large, publicly-traded company and I had this installed on my work machine. Suddenly DoH was forced off by administrator policy and I had to use some specific internal IP for DNS. Which isn't strictly less secure but let's just say I would, even for my large, publicly-traded business, trust Mullvad more than Cisco.
Also when you're snooping on a conversation between myself or one of my servers and one of your employees you are impersonating me and intercepting my communications too! I did not sign your AUP to agree to this. Also if I happen to be in a two-party consent state at the time, and you're intercepting a VoIP call/Teams/Zoom with me, that's a crime.
IT is basically being a system integrator with a load of systems that don't want to integrate. Corporate don't accept no for an answer. You need to bend things in ways they don't want to bend to get them to fit.
> The flashing cmd.exe windows are not drivers from Windows Update
The first thing I do with any new corpo laptop is completely wipe it down to the firmware, and clean the drive entirely to make sure the stench of Dell, Lenovo and HP is as cleansed as it's possible to be, then install Windows from a fresh ISO downloaded straight from Microsoft.
Then a few hours after reinstalling Windows again, the Lenovo shitware drivers are back. Not the software suites, at least, but the crappy drivers that throw up cmd prompts and have un-suppressible dialog boxes telling you to update the BIOS but look like malware and ask for the admin password. Check Windows Update and it will show that it has installed a bunch of stuff like "Lenovo - System" and "LG Electronics - Extension".
Recently there's a push to dropship directly to customers and use Autopilot, with some vendors now offering "Corporate-Ready" images, but most IT depts still prefer to get hands-on first because of how flaky that is, plus even the corporate ready image still comes with shitware, just less of it.
But anyway, even assuming it isn't coming via WU, and is one of those Lenovo bootkits, what else are we to do? Half the laptop won't work without drivers. Most of the other laptop manufacturers are aimed at gamers and fall apart in about a year. More recently I've been trying to move towards Microsoft Surface devices, and have found they're a much cleaner experience on the software, but have been finding the hardware reliability is quite terrible. I'm hoping that Framework's business programme turns out to be a success, but right now there are just no good options.
> You don't need a proprietary solution to remotely upgrade Google Chrome, just specify an enterprise policy with auto-update.
Sure. Chrome can be auto-updated and you have good controls over how that rolls out, so you can designate test users. But it's one of the few bits of software written "properly", including for example a Windows service that can run Chrome updates on behalf of a non-admin user, and they've actually provided GPOs to configure it. Even then it sometimes gets stuck and stops updating. So, we still need something like PMPC/Robopack/PSADT to update all the apps that either have a broken auto-update mechanism or just don't have one in the first place. We would also need to keep the original installer up to date ourselves, and for some software you're talking a day of fixing your manual packaging scripts every month, trying to work out which undocumented flags the MSI accepts, whether they've renamed the registry key they check to disable the non-functional auto-updates this version, etc.
Nowadays, we're starting to see more adoption of things like winget where the vendor themselves are packaging things in a way that is suitable for mass deployment, using a standard mechanism that Windows itself can use to auto-update the apps. This is a massive improvement for everyone, but I'd say only <10% of most corporate/LOB apps are available this way yet. Hopefully over the next few years we'll see more adoption, as this would solve a big chunk of the pain of corporate IT.
One of the worst vendors for writing stuff that doesn't use the standard mechanisms to install or update, incidentally, is Microsoft.
> The URL checker has no valid benefit, and makes it so people can never learn how to do it themselves. The browser performs the exact same checks with the exact same capabilities through its safe browsing stuff, and corporate IT often has network-level solutions too.
Nobody ever does it themselves which is the point. Also, if you're opening it on a corporate computer, current versions of Outlook do actually show you the original URL when you hover.
But anyway let's say we just rely on the browser check: what if it's a developer who's modified their browser settings? What if it's someone opening it from a personal phone? You could get rid of the URL rewriting and just ban users from using personal devices or modifying browser settings, but then you're going to war with senior executives who insist on keeping their work email on their personal phone. Almost all users don't even notice the URL rewriting, but it has prevented quite a lot of phishing attacks on personal devices that may otherwise have been successful. That's a pretty good trade-off for something that almost nobody notices is even happening.
Indeed, network TLS interception which would often have detected stuff in the past, but many corps have moved away from that now because as you point out, TLS interception is pretty crap. It breaks the increasing numbers of apps that use cert pinning, tends to be full of security flaws, and they don't work off-network unless you send all traffic to a central server or deploy it to every PoP, which is rare outside of megacorps, meaning internet experience is slow and flaky. Cisco Umbrella is a big suite with lots of other stuff too, but they do still push their TLS interception. MS advise not to use it, and the weight of opinion is shifting towards using URL protection built into the antimalware stack now, but unless we have full control over all clients accessing email, that doesn't eliminate the use case for URL rewriting.
In any case, this isn't something external we've bought in on top of the standard Microsoft 365 stack, it's part of Defender that Microsoft enable by default in their secure baseline. Going against vendor recommendations is opening yourself up to a big liability if it turns out something gets through that it would have caught.
> Corporate IT uses emails services that spoof domains and look suspicious
You'd be surprised how often vendors just directly email users without you ever having approved it or having been informed that they were going to send an email so you can pre-warn them. Again, Microsoft are one of the worst for doing this (e.g. sending emails from "User's Full Name <no-reply@sharepoint-online.com>"), but Google and Apple also do it.
> Say, they had a ransomware incident, and now they're buying every ransomware product for a few years. Stuff with such buggy kernel code that it deadlocks and makes it impossible to create new processes until you hard reboot.
Any company that is just stacking loads of conflicting antimalware products on each endpoint is clearly incompetent and not something I've seen, and I've seen some pretty shocking stuff.
There was obviously the Crowdstrike issue, but that wasn't as you describe, and as much as I'm not personally a fan of Crowdstrike, that was one major incident it caused, but you're not comparing to the counterfactual where these systems didn't exist and 0days can just spread across the network faster than an under-resourced IT dept can stop them.
I'm unusual in that I moved more into IT and cybersecurity stuff from dev, so you know, I do have sympathy for how shit this can be as a user and a developer. I have a lot of hot takes about the shitty state of technology today and how it trains the users to do dangerous things. But believe me when I say this: if there was a better way of doing it, I would be the first one adopting it. There isn't, though. At least not one open to those of us outside of Big Tech with the budget to essentially write their own security stack.
I'm an European and have never needed to use nor encountered those services.
If I need to link my accounts and these services are the only choice then I change my banking passwords immediately after.
(I worked for a Plaid competitor. The long-term goal for all similar companies is of course to use OAuth and APIs, because it breaks less often; but since the banks don't offer that, scraping it is!)
I think Bankin' used to before PSD2 and to get a bit more information from some banks but then again Bankin' is a financial agreggator whose explicit purpose is crawling your banking data so it's not too surprising to see them asking for your credentials.
Some markets are pretty much exclusively compliant - I don't think there are any Nordic banks that don't have fully PSD2 compliant APIs for example whereas, if I remember rightly, the Spanish banks were all over the place. I'm fairly out of date though, so things may have improved or exceptions for scraping expired.
¹ Note that I'm talking exclusively about banking integrations here, not AI nonsense.
"Connecting" savings accounts from EQ Bank or Wealthsimple to an account at TD Bank requires providing TD credentials to Flinks.
Can you give some examples?
Most of the times you did not see it, as it's obfuscated as a part of the transaction.
They are also the companies complaining a lot about the "failure" of the PSD standards since it limits how much and how obfuscated they can scrape everything (and there are records).
Not sure if they still do because i stay well clear of them.
I could imagine something like x-mucrosoft.email etc. being used and the users would just be like well there was email.microsoft so same thing!
The other reason I hypothesise is that corporate big brother snooping systems that have whitelists for their trusted services – with entries like mail.google.com or calendar.google.com – are simply too painful at this point for big tech to break for their customers by dropping the .com suffix, so big tech doesn’t bother.
No hard data on any of that, though.
Instead, they authenticate using a common auth service (say, auth.google), which by virtue of being a single domain can persist shared cookies for all its consumers. This would yield a valid token (possibly a JWT) that the authenticating application can then use however it would like, including as a cookie on the application's own domain.
Whenever you go to a service that temporarily sends you to a different login domain (often just immediately redirection you back), this is why.
I created a separate Chrome profile, and logged in to gmail. Then I disabled javascript, then deleted all my google.com cookies (but left my mail.google.com cookies). Then I reenabled javascript and visited mail.google.com again. I was logged out. So Google is using the google.com cookies.
OTOH, there were probably a lot of places already violating the "ends with @<company>.com" rule, e.g. by using subdomains, or even other domains. So very little of the online population was likely using the rule. And with email spoofing, even "ends with @<company>.com" can't be relied on to ensure the email is legit. So the rule of "don't click links in emails" is the only foolproof rule. Though you also need to add "don't copy and paste things from emails".
> So the rule of "don't click links in emails" is the only foolproof rule.
The only truly foolproof rule is "don't open emails". Also helps a lot on mental health and associated expenditures!
Just saying I haven't failed a phishing test in ~10 years.
The vast majority of security controls are designed for the careless and the clueless.
So we get e-mails from @microsoft.com and it's only if you dig in the metadata that you see it failed authentication. The only tell in the e-mail is checking the URL, which doesn't tell you much because tons of regular e-mails use tracker redirects too. They even send emails from our own domain or the domain of our payroll company.
I won't type out my rant, but our IT department is a few guys who couldn't figure out what to do when their competitive xbox FIFA 2006 dreams failed, heard IT pays a lot with not much work, and then sat through the certs.
I want to live in this fantasy world!
(Our IT dept is so overworked that I go out of my way to work around them purely out of empathy.)
I know teachers that make $50k and no pension, with others making $93k, halfways to their pension at 35yrs old, get almost 12 weeks off total a year, and work from 8am to 3pm (1 hour lunch, 1 hour for 'prep' aka Netflix) and home by 335, and no, they basically never do any work at home. She technically has students (10 year olds she sends links to for their chrome books) about 5x53 minutes a day.
The aspiring career schoolteachers will just have to find a job in a field that is short-staffed, like registered nurses or one of the trades. I'm sure that comes across as "let them eat cake" to some Bernie moron, but going back to school for 6 months is small potatoes, and doing a little market research before making big financial decisions like choosing your college major in the first place is basic adult responsibility.
If we apply the "lump of labor" fallacy everywhere else honestly and consistently, we would have to be opposed to immigration and trade because "those damn foreigners" went and "took er jerbs".
https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRtkJaZ...
Whats funny though is that if you click the link in a phishing test, they will e-mail you to complete the training. But there is no enforcement (general management doesn't care), so you just get a daily e-mail telling you that you are overdue. It also however stops them from sending the fake phishing emails. So a bunch of us clicked the phishing link, marked the "do your training" e-mail as spam, and now never get bothered.
Also, the last one I took they talked about phishing using a malicious Google docs link IIRC.
Anecdotes don't mean you know everything about a system.
Knowing what I know now about the IT staff and professors and knowing in hindsight only 3-4 of my CS classes were of any relevance to my work, I seriously regret not cheating my way through undergrad. I wish I could take back the time I wasted on Java and spend it with my N64.
Except their system adds extra headers related to the phishing… Wonder if they even know…
Thus, I created an Outlook rule to automatically move them to a dedicated folder… (;->
Now sketchy emails are preceded by an equally sketchy “it’s ok” email from IT.
I'm using Finicky[1] on Mac to rewrite the URL by extracting the original URL from the query params[2].
1: https://github.com/johnste/finicky
2: https://github.com/fphilipe/dotfiles/blob/31e3d18fe5f51b2fd8...
If you really want to check every time someone clicks on a link then you can do this in the client and keep the visible link the same for the end user.
But instead there are different teams working on this in Outlook, Teams, Exchange, Defender and god knows where else.
(I'm one of the people in corporate IT trying to turn this off and often struggling)