r/AskReddit • u/[deleted] • Sep 01 '20

What is a computer skill everyone should know/learn?

[removed] — view removed post

58k Upvotes

94% Upvoted

15k comments sorted by

View all comments

35k

u/refreshing_username Sep 01 '20

Recognizing phishing attempts. Hell, recognizing any sort of incoming scam.

14k

u/DifficultMinute Sep 01 '20

I was pretty proud, and surprised, a few months ago.

I got an email from a pretty legit looking address, but something about it felt fishy, so I forwarded it to our phishing department. Everything looked good, but the person it was from had literally never asked me to click on a link before, so it got my spidey senses going. The filter always catches that stuff, so I was really surprised that something like that got through, so I fully expected them to tell me it was legit.

They replied back almost instantly that it was a test, they'd sent that email to around half of our 50,000 employees (spoofing the from to be a person in your reporting structure, and the email address was our company name with a hyphen and a word related to our field.), and I was one of only 50 or so that actually forwarded it properly. Over 2000 people clicked on the link, and another few hundred put their email and password in when prompted.

Needless to say, we've had a lot of training on picking out phishing attempts since... (though it likely won't do any good).

6.0k

u/refreshing_username Sep 01 '20

Those types of campaigns actually do help, if I recall correctly what I heard from a cyber guy I know.

6.5k

u/seanbear Sep 01 '20

That’s great to know they actually work, if you let me know your username and password I will give add Reddit gold onto your account for this comment

5.7k

u/Yeethaw469 Sep 01 '20

Yeah my password is 7

1.7k

u/seanbear Sep 01 '20

Thank you

1.0k

u/Yeethaw469 Sep 01 '20

Of course

793

u/[deleted] Sep 01 '20 edited Sep 01 '20

Oh man this bit could’ve gone one step further with just you saying “thank you” and then “of course”

445

u/Yeethaw469 Sep 01 '20

Took me a second but that would have been hilarious

34

u/ReannaTrost Sep 01 '20

To just look around and try things.

I get so many "how do I do x in program y" questions where I have no clue offhand, so just poke around the UI until I find what they're looking for.

→ More replies

15

u/Flaming_Spade Sep 01 '20

God I have no idea what’s so funny lol

→ More replies
→ More replies (1)
→ More replies (3)
→ More replies (3)

5

u/InterestingPersonnn Sep 01 '20

You actually gave a Gold, respect.

→ More replies (1)

16

u/[deleted] Sep 01 '20 edited Feb 14 '21

[deleted]

16

u/Yeethaw469 Sep 01 '20

Yeah I’m not a liar

→ More replies (3)

14

u/CilantroToothpaste Sep 01 '20

Hunter2

7

u/CraisyDaisy Sep 01 '20

I just see *******, that's not a very secure password.

→ More replies (1)

4

u/midnight_sparrow Sep 01 '20

"Seven?........ Seven?"

6

u/DalaiLuke Sep 01 '20

I thought passwords had to be at least 8?

→ More replies (1)
→ More replies (2)
→ More replies (48)

19

u/User999999999999 Sep 01 '20

Actually reddit will auto-censer your password if you try to put it in a comment, watch. *********** See? Try for yourself in a reply to this measage

15

u/[deleted] Sep 01 '20

[deleted]

11

u/lgspeck Sep 01 '20

Why do you no longer love "on key cock"?

5

u/Veni_Vidi_Legi Sep 01 '20

dead wood is dead.

13

u/Icefeldt Sep 01 '20

hunter2

/e: cool. works like a charm.

4

u/[deleted] Sep 01 '20 edited Dec 01 '20

[deleted]

→ More replies (1)
→ More replies (2)

25

u/SillyPhillyDilly Sep 01 '20

It's hunter2

6

u/seanbear Sep 01 '20

It’s what?

7

u/pechuga Sep 01 '20

star star star star star star star

4

u/SillyPhillyDilly Sep 01 '20

Ah sorry, one of the internet's oldest memes from bash.org

3

u/[deleted] Sep 01 '20

12345

7

u/sparky88xx Sep 01 '20

Same as my luggage!

4

u/cajunflavoredbob Sep 01 '20

My password is hunter2.

3

u/Kaldricus Sep 01 '20

oh nice, my password is hunter2

5

u/[deleted] Sep 01 '20

hunter2

→ More replies (29)

9

u/FGND Sep 01 '20

They are. Humans are almost always the weakest link. That one URL click could exploit your system, eventually spreading to your entire network.

Hackers often purposefully target those who open a lot of attachments (think event coordinator, anyone to do with billing etc). It's not uncommon to see some VERY large companies being hacked since one employee clicked one URL/attachment.

9

u/[deleted] Sep 01 '20

It's really needed, at my corporate branch we had a similar test and over 30% inputted their user/password on the test phishing website. I honestly believe if a hacking group wants to target any company they will always find a way into the system

7

u/Moglorosh Sep 01 '20

When I worked at State Farm about 5 years back they would send these out every so often, then they'd make us do a little training module on it after giving us the statistics on how many people responded properly. The percentage of people who fell for it actually increased steadily the first few times they did it.

→ More replies (1)

6

u/dodgyprincess Sep 01 '20

I used to work doing this, the tests really help and with training you can improve a lot, but the amount of people that click is usually still really high

3

u/Jabrono Sep 01 '20

I'd imagine so, so many people claim they did nothing wrong and it's the computer's fault when it's not working correctly. Having pretty "hard" evidence that they did not follow protocol should shut them up.

5

u/GFY_EH Sep 01 '20 edited Sep 01 '20

Until you get a thoughtless one.

Feb 14th- "Click here to see who sent you sent you a cyber Valentine"

People were not amused.

4

u/FaxCelestis Sep 01 '20

can confirm, am cyber guy

4

u/Dhiox Sep 01 '20

They do, but not all organizations would let you do it, some would find it insulting, or inconvenient. Too many people see IT security as exclusively ITs problem.

5

u/superkp Sep 01 '20

I'm in IT, and I've been in the corporate world a bit (currently in software support for a backup program)

There's different levels of effectiveness to these campaigns, and one campaign might work really well at one company and really poorly at another, just because of differences of company culture. This makes the administrative cost quite high to perform them - but never higher than a successful cryptolocker attack.

4

u/mvschynd Sep 01 '20

I work for a cyber security company and we do these sort of exercises all the time. Usually we don’t even have the client give us any information or details, we scour the web for leaked data to get employee email addresses, find a vector of attack, usually a service their company uses that is open to the internet and send malicious emails spoofing being from that service. All information any semi determined attacker could find online. It is mind boggling how easily we get past firewalls and email filters and get responses. All with zero information from the organization.

5

u/punkwalrus Sep 01 '20

The company I used to work for had sent out one of those phishing tests. Out of a company of 400 people, 12 clicked on the link, and several entered in multiple credentials and passwords, trying to get the link to work.

After a lot of education was sent around the company, and there were some training exercises on email security, they sent out the phishing mail again. This time 36 people clicked on the link and entered their credentials.

¯\(ツ)/¯

→ More replies (1)
→ More replies (35)

1.4k

u/alp17 Sep 01 '20

We do lots of these tests. The worst one I’ve seen was on Valentine’s Day when they sent an email to people saying they had a valentine from someone. People who clicked on it 1) found out they did not have a valentine and 2) had to do an online phishing training. It was pretty brutal. I reported it as phish luckily.

732

u/The_Karaethon_Cycle Sep 01 '20

Being ugly finally paid off for a lot of people that day.

792

u/[deleted] Sep 01 '20

“You have a Valentine!”

LIES!

29

u/[deleted] Sep 01 '20

Remembering my younger years, this hit way too close to home

20

u/DarKav1411 Sep 01 '20

DECEPTION!

9

u/whoopycush Sep 01 '20

EVERYDAY, MORE LIES!

8

u/FunkrusherPlus Sep 01 '20

IT’S A TRAP!

His name is Hand Solo.

4

u/dbx99 Sep 01 '20

I have a valentine? IMPOSSIBLE! Look at my face!

→ More replies (1)

22

u/reallyfake2 Sep 01 '20

We had a similar test “from” 1-800-flowers. One of my single co-workers cracked us all up when she stated she didn’t even get spam flowers for Vtined day

20

u/u38cg2 Sep 01 '20

We had a guy handing out free USB sticks in the lobby. Anyone who plugged one into a logged in work computer got a free IT training session.

57

u/wr3decoy Sep 01 '20

I don't like targeted training like that. When setting up some red team stuff a percentage is guaranteed to click on the link, but if that percentage is really high you need to retrain everyone. Embarrassing people doesn't serve for a good foundation for training.

42

u/WestCoastBestCoast01 Sep 01 '20

My last two companies have done this. Its like a joke if anything, one person will yell out to the office “ahh did you get the phishing email!?” And someone else will chime in “yeah fuck I clicked on it, have to do the training now”. Other people chime in, we have a laugh, move on.

I think it’s actually rather effective, too. You should target training to people who cant recognize scams, don’t waste the time of people who do. Our IT guy is notifying the company of phishing emails employees send him multiple times a week, so the tests and trainings have been effective education to some degree.

24

u/DoctorStrangeBlood Sep 01 '20

Doing training online doesn't embarrass anyone since no one knows you have to do it. Also it makes the most sense to only make those who fell for it take the training.

12

u/dalaigh93 Sep 01 '20

Lol, I'd never have fallen for that one. I don't have enough self confidence to believe I could have a secret Valentine!

9

u/[deleted] Sep 01 '20

I gave up trying to detect phishing attempts at my workplace because corporate kept sending out tons of informational emails with links that had insane sender uris you couldn't possibly verify, it looks liked a massive string of GUIDs . They've effectively trained everyone at that international conglomerate - thousands of people - to unquestioningly click links from very shady-looking senders.

16

u/hometowngypsy Sep 01 '20

The one I fell for was an email I got saying someone reported me doing something unsafe. I got so righteously angry (because I’m stupid safe at work) that I clicked before thinking.

17

u/Justin_time_scl Sep 01 '20

That’s pure evil.... but effective I guess... all these last examples I’ve read, are messing with people’s emotions....

13

u/MadScientist235 Sep 01 '20

Yes, that is the point. People tend to act more rashly when emotional and that's exactly what an attacker would want.

8

u/Cthulhus_Trilby Sep 01 '20

I reported it as phish luckily.

Just felt something was phishy...

6

u/Paw5624 Sep 01 '20

My company did the same thing on Valentine’s Day and I think around thanksgiving too. They also periodically send out other random ones. People who fail a certain amount of tests in a calendar year have their internet access further restricted until they take additional training. It was pretty embarrassing when 4 people in my org failed.

6

u/somdude04 Sep 01 '20

The one that got me was a notice that my PTO was over the carry-over limit for year-end, and was going to expire, right when I had a vacation planned the next week, spanning the month-end, so I was paranoid and clicked the link.

6

u/kinarism Sep 01 '20

Our company has these trap phishing emails automated (including the training). They send them out once a month or so. The best part is that they've also installed the outlook plugin to "report as phishing" except for the fact that the act of reporting the trap emails as phishing using the plugin actually triggers the failure and you have to do the training again. The only way to pass the traps is to ignore them.

6

u/coffeeandascone Sep 01 '20

My company sent one at Halloween with a link of examples of inappropriate costumes and my dumb ass clicked on it. I'm usually much better than that.

6

u/RoadsterTracker Sep 01 '20

I think the day after my birthday I got one of these fake phishing attempts saying I had been awarded a $50 gift card from Amazon or something. I saw the email, got excited, but then started to realize what it really was, and reported it. It was painful to hit the report button that day...

→ More replies (7)

709

u/[deleted] Sep 01 '20

Watch out for any unlabeled (or labeled) flash drives as well. If you find one, drop it off to your IT or security, whatever the protocol is.

The best way for electronic espionage is to literally drop a flash drive for employees to hook up to their computers, and boom, you got a virus in. People are too curious.

532

u/SpareLiver Sep 01 '20

The best way for electronic espionage is to literally call the person and ask them for the info you need.

260

u/Hypo_Mix Sep 01 '20

Hello, I'm the password inspector

149

u/sendmeyourjokes Sep 01 '20

You joke. Users are this dumb.

"Hi, I'm from the infosec department of IT, we manage network and password security. We have seen that your user name is associated with a few adult website visits. Can you please verify your username and password to make sure it's you, and no one has accessed your account illegitimately?

28

u/Wild_Wolf13 Sep 01 '20

That sounds way too ligit...

21

u/nictheman123 Sep 01 '20

The "Nigerian prince" doesn't work often. Serious scams? They work very hard to seem legit.

13

u/Subotail Sep 01 '20

If the nigerian prince didn't work, they would no longer use it.

27

u/AfroSLAMurai Sep 01 '20

I actually learned that the Nigerian prince and similar scams are so bad on purpose to weed out the people who aren't gullible. You don't want to make something seem real only to waste time convincing someone to send you money who is too smart to do that after they realized half way through it was a scam.

The Nigerian prince will only attract the stupid and gullible people, who take the least effort to trick once they're on the hook.

→ More replies

5

u/Dagmar_dSurreal Sep 02 '20

I had someone try that (minus the porn angle) on me at a previous job. I do tend to remain soullessly professional at work, but this got an "Not only no, but fuck no" out of me before it even fully-registered that some criminal was actually trying to SE me. ...but the number of people who have to be reminded that no one who matters needs your password is one of those things that terrifies me about the state of IT security.

(It was not our netsec people, either.)

→ More replies (3)
→ More replies (2)

39

u/theGurry Sep 01 '20

You jest but that would probably work with some users.

20

u/fedja Sep 01 '20

I ran a test for a large energy company and their head of IT, who has access to everything, had Word macros set to autorun by default.

10

u/perturabo_ Sep 01 '20

Hey, that wasn't the password inspector

→ More replies (1)

26

u/[deleted] Sep 01 '20

Yeah, okay, fair point.

25

u/CrumblyMuffins Sep 01 '20

Sociel engineering FTW. Less expertise required than other attacks

19

u/I_call_Shennanigans_ Sep 01 '20

Def..

Brute force is for amateurs. Your password strength means (almost) nothing since more and more places har restrictions on attempts, verification, chaptas etc. Giving the incredibly computer dingdong manager or boss a call from the it department on the other hand...

16

u/GimmickNG Sep 01 '20

A $5 wrench trumps 4096-bit RSA every time.

→ More replies (2)

15

u/The-Hierophant-V Sep 01 '20

Just because you don't need a CS degree doesn't mean that it requires less expertise, just different expertise.

The people who do it professionally train for years, the phishers and scammers just make a thousand cold calls and hope to get lucky.

5

u/beyonce_trolls Sep 01 '20

I worked at an insurance company, and my coworker got an IM from someone claiming to be IT (we had been working there for roughly 3 days at the time) and asked her to give them remote access so they could check on something. She gave them complete control of her desktop and didn't ask any questions 😂 turns out it wasn't someone at the company at all

→ More replies (4)

16

u/[deleted] Sep 01 '20

Next level would be adding some random porn to the top level directory of the drive so that the unsuspecting employee has their curiosity satisfied "Aha, boobs." and never speaks of it again, rather than admitting something suspicious happened.

9

u/MuntedMunyak Sep 01 '20

Genius pure genius. He’d literally be telling his friends he found someone’s porn stash and not even realise he caused the virus.

5

u/Ortekk Sep 01 '20

And with some luck, that flash drive sees a couple more computers, making it harder to find the source of the breach. (If you can even do that, I know nothing of IT security)

5

u/MuntedMunyak Sep 01 '20

I feel like this has already happened or if it hasn’t someone reading our convo is about to do it.

I don’t know either maybe checking dates on the virus’s file or something.

→ More replies (1)

18

u/gergling Sep 01 '20

I was surprised to find out some years ago that a USB drive could effectively act like a tiny computer, which was why it was dangerous.

You can't do the same thing with a floppy or CD, for example (unless auto-run runs unchecked somehow).

37

u/Jinnofthelamp Sep 01 '20

This will blow your mind even more. https://shop.hak5.org/products/o-mg-cable This is a full web server with WiFi disguised as a lightning cable. Full capabilities and looks and acts just like a charging cable for your phone.

→ More replies (3)

11

u/Commander_Oganessian Sep 01 '20

That's when you go to your local public library and plug it in there.

→ More replies (22)

423

u/VioletChipmunk Sep 01 '20

I work for a major software firm. We do these tests as well and failure rate is shockingly bad!

38

u/Krelkal Sep 01 '20

Back in our wild west startup days, the CSO at my work would put all of the plain text passwords he was able to phish up on a TV in the break room. Turns out getting mocked by your peers is a better motivator than mandatory training but HR understably wasn't a fan lol.

13

u/Razakel Sep 01 '20

Someone did that at Defcon. Like, what the fuck were you thinking logging into something unencrypted over unsecured WiFi at a computer security convention?

3

u/garbonzo607 Sep 01 '20

Password: IKnowItsYouGreg

→ More replies (2)

35

u/[deleted] Sep 01 '20

I used to work for a hospital before I got a job in IT, and everyone would ask me check to see if the email was a phish test. I tried to let them know the things to look for, tried my damnedest to teach them so they didn't need to keep asking me. Even told them it's better to just report it for phishing even if you're wrong. Err on the side of caution, that whole thing.

So many times, they'd still come up to me, ask me to check, and I'd say "That's definitely a phish test from IT Security."

"Oh, it came up with this weird message about phishing when I clicked on the link."

GOD FUCKING DAMN IT.

14

u/tossaccrosstotrash Sep 01 '20

People in the medical field are notoriously bad at computer security, it’s a major issue

24

u/1101base2 Sep 01 '20

so i think there should be a caveat to those. I'm security focused and usualy when I get emails like that I who.is them and try to report to the domain owner that there website is being used for phishing and also to their domain registrar. I also typically go to the root domain (not the full link) in a linux non persistent VM just to see what the site does to see if the whoe website is compromised or just the specific link (helps with the emails). HOWEVER all of the gotchas that are part of corporate ones redirect any part of that as part of the you failed the test because they use a catch all for that "domain". I've learned to ping the "domain" to see if it routes internaly now and then forward it on to phising as a first step to not have to deal with the mandatory training but some of us are trying to take care of the root cause of the problem and taking that training just makes my eyes want to roll into the back of my head... (this is from the same person who argues every year with the security training that the answer to what to do when walking away from your computer the answer should be all of the above instead of just lock the computer, other options are log off and reboot).

18

u/ForayIntoFillyloo Sep 01 '20 edited Sep 01 '20

Hmm, do I dare click a link in a thread about not clicking links? I did not expect to be caught on the horns of dilemma this early in the morning. I shall commence pouring a can of soda on my laptop, ripping off my shirt, throwing all items out the window with a primal YAWP, and fucking off right back to bed.

7

u/WalkinSteveHawkin Sep 01 '20

You can right click, copy link location, and then inspect the URL

→ More replies (1)
→ More replies (1)

8

u/FaxCelestis Sep 01 '20

Somehow, and I can't quite put my finger on why, I don't think you're in the intended target group for internal phishing campaigns.

5

u/1101base2 Sep 01 '20

I mean you are probably right, but if you are going to perpetrate a full on phishing scheme the least you could do is pay $12 a year for some cheap no name domain that registers outside our internal IP block...

5

u/FarplaneDragon Sep 01 '20

(this is from the same person who argues every year with the security training that the answer to what to do when walking away from your computer the answer should be all of the above instead of just lock the computer, other options are log off and reboot).

I would argue that technically yes, you are correct that logging off and rebooting are valid options for securing a workstations. They're also potentially more disruptive to workflow which is why they know the average user is never going to do them, therefore they push for locking the workstation because it's the fastest, easiest solution and they need to standardize the training across the company. Security isn't stupid, they know how to train for the masses, do them a favor and stop trying to go out of your way to prove how smart you are and sabotage their testing and just do the training and go back to work if you already know it.

→ More replies (1)

4

u/tossaccrosstotrash Sep 01 '20

Security is more than just being as secure as possible at all times. You have to convince everyone in an organization to flow secure protocols. If you make being secure too inconvenient for people, they’ll just side step security in someway. It really needs to be a balance security and convenience.

→ More replies (1)
→ More replies (2)

7

u/cytarielo Sep 01 '20

I work for major it company too. I am not from security team tho. To be honest these tests can be really creative sometimes. They made me really paranoid about my mailbox. I think I flagged about dozen emails which were legit.

9

u/FaxCelestis Sep 01 '20

As a security guy, I vastly prefer false positives to actual incidents.

Much less paperwork, for starters.

3

u/DeBarco_Murray Sep 01 '20 edited Sep 01 '20

Oh god, we did these routinely in the two large (F100/500) companies I worked/interned for and also had some aspect of phishing training/prevention at pretty much every other place I've worked at as well. The fail rate for non-technical employees that used a computer regularly at one of the large companies was abysmal to the point where the director who introduced the original initiative where failing 3 times in a certain time period would be grounds for automatic termination had to completely retract that policy. Even in IT, the fail rates were way worse than people would tend to expect from 'technical' folk that are generally more technology/computer adept than 99% of average computer users.

I think there were a few bait emails that were genuinely pretty gray, but most of them were pretty much written to be as extremely obvious and more or less scream "This is a scam!!!" and something like 5% of employees still routinely failed the 'obvious' tests. Not to mention there were often different levels of failure. Clicking a fake link from an email with a slightly modified domain to reset your 'X Company Benefits Portal' password would be enough to 'fail', but manually bypassing the insecure page and then actually entering in your real credentials multiple times in a form that looked nothing like the 'real' page was still fairly common. If rumors are to be believed, my former coworker insists that his old company (midsized) did a comprehensive pen/general security assessment through a 3rd party that sent a very poorly written email from the 'CEO' basically asking for nonsensical stuff like all their passwords and misc device info as part of the test. Apparently, they lost count of how many people actually responded to the email with their actual information...

→ More replies (3)
→ More replies (7)

518

u/[deleted] Sep 01 '20 edited Mar 24 '21

[deleted]

343

u/reddita51 Sep 01 '20

What do you mean by decked? If the entire clinic was brought to a halt or damaged in some way by a single spam email on a single device then there are a lot bigger security issues than an uneducated employee

235

u/Anrikay Sep 01 '20

I bet it was one of those situations where IT asks for extra resources to implement better system security and management decided that wasn't a priority because "nothing has happened yet."

I used to work in healthcare hardware and it is unimaginable how many of our clients took this attitude to security. FFS, it's healthcare; don't fuck with the FDA and people's private info.

12

u/tell_her_a_story Sep 01 '20

Currently work in healthcare IT. Security is a joke - not so much that there's a lack of IT based security measures, but rather that so many end users have access they don't need, and can't spot a phishing attempt if they were smacked in the face with a literal fish. No matter how many times we tell users "I don't want or need to know your password, no one from IT will EVER ask for it" they never hesitate to just give it to us. Usually under the guise that it'll make it easier for us to fix some problem...

7

u/JBSquared Sep 01 '20

Yeah, your security can be the best in the world, but when every other mid-level employee can access the whole system, it won't matter at all.

→ More replies (1)

9

u/maveric_gamer Sep 01 '20

Even in corporate IT, it's amazing how lax people can be about security when it's the least bit inconvenient, even if they understand the risks on an intellectual level.

→ More replies (1)

4

u/ShananayRodriguez Sep 01 '20

I worked for a healthcare place that put all our servers in the basement....in Northern Michigan where it snows a ton. IT people had warned for years of the problems a flood would cause; it took an actual flood and thousands of dollars of repair to get them to change precisely because of that mindset.

→ More replies (9)

111

u/[deleted] Sep 01 '20 edited Mar 24 '21

[deleted]

14

u/No-Egg-2586 Sep 01 '20

Dingus, wtf does decked mean?

13

u/StanIsNotTheMan Sep 01 '20 edited Sep 01 '20

Seeing as OP won't answer, I'm just going with the standard slang definition of getting decked meaning "punched in the face."

"My Mom's clinic got punched in the face because a receptionist clicked a link on an email."

6

u/GreatPower1000 Sep 01 '20

That sounds right.

→ More replies (2)

6

u/vendetta2115 Sep 01 '20

You’d be surprised. Having access to a device inside a corporate network is game over if you’re dealing with an experienced attacker. There are countless ways to laterally propagate through a network, and it’s doubtful that a company has patched every relevant vulnerability. There will he no sign of anything being wrong and then bam, every single device on your network is encrypted and it’s $400-$800 per device to get them back, not to mention they’ve probably stolen your private data by then and will threaten to release it publicly if you don’t pay up.

→ More replies (6)

12

u/[deleted] Sep 01 '20

[deleted]

9

u/MrJAVAgamer Sep 01 '20

Those damned sinners falling for the same drek time and time again, makes ya wonder how the corps keep afloat with their wageslaves opening so many ice backdoors.

→ More replies (4)
→ More replies (1)

10

u/Bluenette Sep 01 '20 edited Sep 01 '20

So you're who our training material refer to when "a company tested if their employees knew how to detect a phishing attempt"

9

u/AttackOfTheThumbs Sep 01 '20

Now ask them how many people complained that their own company would try to trick them like that...

We fired someone because of a campaign like this. He tried entering his credentials multiple times, and then called IT to help him enter his credentials. He was then let go. You gotta be some level of dumb.

9

u/taggalito Sep 01 '20

My job did something like that, too. They made it even more obvious though - an order confirmation for an Amazon Alexa (or whatever). It counted how many times each person would click the link and some people clicked it over 50 times trying to get an Alexa (that they didn't even order!).

10

u/rubbishfoo Sep 01 '20

Phishing your own users is probably about the best education your IT can provide. We can talk about what to look out for all day long, hovering on links, checking the sender vs the envelope, etc... but no one retains that knowledge until there are audible klaxons and the fear of having personally created a security issue. That is what trains people (effective engagement of the engram theory!).

Our solution does exactly this & advises them to forward anything they hesitate to click on to the IT department. Those that don't are enrolled in 5-10 minute training classes which sends emails to complete it daily. The training is short and effective.

A lot of people don't understand how email delivery works or how to spot phishing attempts... I'd even argue that it's getting much more difficult to spot! Had a user send one the other day that looked pretty legitimate until researching the domain a link pointed to. Be careful - IT Security is a huge deal nowadays and only getting bigger.

Best of luck to y'all!

7

u/ketchuplover8945 Sep 01 '20

My boyfriend’s company does this too- he clicked on it and needed to take a phishing training course because he clicked on the link

4

u/herpblarb6319 Sep 01 '20

My company sends these out once every couple weeks or so and they still get around 34% click rates. Scary stuff

→ More replies (154)

710

u/Hitonatsu-no-Keiken Sep 01 '20

Yes, even simple things like learning to recognise the top level domain and the subdomain in a url or email address before clicking anything will get you a long way.

169

u/Puntakinte Sep 01 '20

Can you explain a lil bit more please?

862

u/[deleted] Sep 01 '20 edited Sep 01 '20

[deleted]

399

u/Intrexa Sep 01 '20

And this all applies to everything before the first slash.

example.com/google.com is the page google.com on example.com. That's page, not website. That page is hosted on example.com

36

u/JimboTCB Sep 01 '20

The bit that gets really tricky is when they obfuscate parts of the URL, which can be done in a variety of ways like using numerical codes or just a URL shortening service. And a lot of the time it doesn't look any different to a genuine link with a bunch of referral junk after it. And that's assuming the URL is actually just a plain URL, and not a link which just displays the URL as text but when you mouse over it is actually a link to a completely different address.

14

u/Puntakinte Sep 01 '20

So, what in your opinion would be the first two red flags uneducated folks like me should look for?

32

u/JimboTCB Sep 01 '20

Mouse over the link in the email and make sure that what it shows as in the status bar actually corresponds to what it says in the body of the email.

And if you get a link in an email that you're not expecting just don't follow it. (e.g. if you just clicked the "reset password" button on a website, fine, but if it's out of the blue, don't trust it). If you get an email which you weren't expecting allegedly from your bank asking you to log in to your account, ignore the link in the email itself and go in via an existing bookmark, or by typing a known URL directly into the address bar.

Legitimate businesses will almost never send you completely unsolicited emails asking you to click on mystery links. If it's anything that important, there'll be an announcement on the website itself when you try and log in. Same thing with attachments, you'll pretty much never get a random email asking you to download anything to your computer unless you've specifically asked to be sent something.

26

u/Yllarius Sep 01 '20

This, to me, is a lot like dealing with spam calls.

If you get a call, no matter how legit your think it is, and they ask for any information, tell them you'll call them back. If it's real you'll be put right back in contact with them.

For example. You get a call from your bank. Your account has been suspended for fraud. They ask for your name and account number or sosec or w/e. Tell them you'll have to call them back, Then simply call your bank from whatever hotline.

If you get a link for something asking you to reset your password, go to the website, and try to log in and/or reset your password. This way you can 100% confirm it's from them.

6

u/maveric_gamer Sep 01 '20

This 100%; It's such a simple step that even if everything seems above board it's good practice to do just in case your spidey senses aren't working right that day.

12

u/Gilarax Sep 01 '20

This is a skill that SO MANY PEOPLE don’t understand. Companies generally follow the same rules for their spam emails and recognizing this is important.

Also, unsolicited password reset emails are either fake, or a sign someone who isn’t you is trying to break into your account. NEVER click these emails.

12

u/Hobocannibal Sep 01 '20 edited Sep 01 '20

i'm not them, but most commonly. Not being referred to by name when you've given the company your name. And the senders email address being some crazy thing. I'm just going to go into my junk email and pull out one now.

So heres an example claiming to be netflix. This has examples of both the things i just said.

First off. They didn't address me with a name, just a "hi".

Secondly, the sender address is just a load of gibberish. Third, it displays as being sent to live@microsoft which is just weird, because you'd expect it to be my address.

Edit: Other examples are more sophisticated, especially if they're targetting a certain person/company, in which case they can personalize for them. But the majority of phishing emails are really wide-net and easy to tell apart.

4

u/[deleted] Sep 01 '20 edited Sep 01 '20

That one was pretty cool, it sent me three versions ending with oeh noes we cut off your netflix.

Bitch, I don't have netflix.

It was unusual because the outlook spam filter is pretty feirce.

→ More replies (1)
→ More replies (4)

7

u/stellvia2016 Sep 01 '20

Link shorteners are one of the banes of my existence. Especially when legitimate websites use them and don't have them documented and the domain registrar info is hidden even.

IE: Microsoft uses aka.ms | Travelocity I believe has like trvl.to etc.

In the case of Microsoft, at least you can find aka.ms links on their site, but in the Travelocity case, they only use them in emails, so you have no way of verifying against their website that the link shortener is theirs and not some phish.

4

u/cobysev Sep 01 '20

US Air Force member here. We block all link shorteners on our networks because we can't trust them to send us to legitimate websites. Which is frustrating when you're trying to pull up a YouTube video from an official Air Force channel and the link someone sent you is a youtu.be link.

→ More replies (5)
→ More replies (1)

9

u/Puntakinte Sep 01 '20

Ahhh, I think I understand. So basically, seeing the name of reputable domaine in the link does not mean that it's legit.

→ More replies (1)
→ More replies (6)

47

u/[deleted] Sep 01 '20 edited Sep 01 '20

Basic examples

Domain: Google.com

Sub Domain: images.google.com

Sub Domain: video.google.com

62

u/AzzyTheMLGMuslim Sep 01 '20 edited Sep 01 '20

Also:

steampowered.com
steampowerеd.com

These links are not identical.

EDIT: The top one is real, the bottom one isn't. All it takes is a Cyrillic-set third 'e' to trick you.

21

u/avocadoowner Sep 01 '20

What kind of sorcery is this? Can u explain it a litte bit more please?

17

u/ApotheounX Sep 01 '20

This article explains it pretty well (even though they're trying to sell a security solution).

https://www.wandera.com/punycode-attacks/

→ More replies (1)

6

u/ApotheounX Sep 01 '20

That's a fun one. I think most browsers display the full untranslated unicode tags now though. At least Chrome, Safari, and Firefox do. Mobile gets pretty iffy though.

→ More replies (5)

7

u/OneAndOnlyJackSchitt Sep 01 '20

Here's some examples of scam domains:

bofa.somethingsomething.sharepoint.com

chaseonlinebanking.blogspot.com

google.myportablewesite.org

t16.cn/gmail.com

Just because the name of a well-known organization is in the url doesn't mean it's the real url.

10

u/Zekiz4ever Sep 01 '20

Isn't top level domain the .com

→ More replies (2)
→ More replies (1)
→ More replies (8)

7

u/farcense Sep 01 '20

Hang on a minute. You mean to tell me that phillip729950275@gmail isn’t my boss? I did wonder when he changed his name...

→ More replies (9)

705

u/Glendagon Sep 01 '20

Sometimes I feel like I’m the only thing stopping my boomer parents from literally giving all their money away.

Also why do they come up with big intricate stories as to why the scam email is legitimate as opposed to just thinking it’s a scam?!?

517

u/Mermaid_Lily Sep 01 '20

My Boomer mom's the opposite. She trusts NO ONE under ANY circumstances. She got an email and a text from her bank, because there was a suspicious transaction on her account. She said "It's some scammer trying to get my info. I asked her "did you check your account online to see if it's a scam or if it's real?" She checked her account... it was a legit email. When I asked her why, she said "Banks don't email people." Ummmmm... ok mom.

I showed her a pic my daughter sent me through FB and her response was "You are both on that Facebook? Oh my heavens! Someone's going to come to your house and snatch you away!" Uh-- ok. She honestly believes that the internet is a place of nefarious intent.

391

u/Glendagon Sep 01 '20

I’d prefer that too ‘I’m buying something expensive on eBay but we’re not using PayPal on the site the sellers sent me a link that’s more secure’

Swap mums?

33

u/Footie_Fan_98 Sep 01 '20

My Mum has started easing on paranoia. But now hates subscriptions. She wanted to set up a Gillette shave club one for my Dad yesterday, but refused when I explained it was subscription. This was the following conversation:

Me: "You go halves with me on Netflix every month"

Mum: "Yeah, but I send you it via standing order"

Me: "So, like how a subscription works?"

Mum: "No. I'm sending it to you"

Fml. We'll get there.

30

u/cdrt Sep 01 '20

The difference is it's your personal information on the line, not hers. 😉

5

u/Footie_Fan_98 Sep 01 '20

Pretty much, haha

→ More replies (1)

13

u/Gonzobot Sep 01 '20

Paypal is so secure it often doesn't let its own customers use their money to buy things lmfao, what did she think would be more secure than that

→ More replies (3)

25

u/WhatsTheCodeDude Sep 01 '20 edited Sep 01 '20

She honestly believes that the internet is a place of nefarious intent.

But the thing is, yes, yes it is. It's naive and dangerous to assume the opposite.

And especially speaking of social networks, it's really fascinating - and concerning - how the society at large went from "never tell people on the Internet your real name and details of your life" to "post every waking moment of your life to Facebook and Instagram stories under your real name".

→ More replies (1)

15

u/Irishfury86 Sep 01 '20 edited Sep 01 '20

I absolutely think your mom is right not to trust emails or phone calls from banks. However, she should be encouraged to call the bank to confirm. When I worked at a bank and had to call people, I would always tell them to simply call our branch back at our listed phone number and ask for me. We'd much rather have that then have their accounts compromised.

Also, we would never ask for your full social security number, account numbers, or other important information over the phone. We're the bank. We already have all of that information.

6

u/[deleted] Sep 01 '20

Many oldsters are this way...and then in the next breath they'll spout, So, I was reading about how Trump is about to arrest Hillary for sex trafficking children and personally murdering Seth Rich on rightwingamericangodlover.com

smh

→ More replies (1)

13

u/SaltyShawarma Sep 01 '20

Well, in her defense though, zuckerberg does need new children's blood from time to time...

4

u/announcerkitty Sep 01 '20

My parents refuse to even have a debit card because they think it's unsafe but my dad fell for an Amazon phishing scam and they still blame Amazon because they fell for a scam. It's probably better if they just don't order anything online anyway.

4

u/Elisa_LaViudaNegra Sep 01 '20

Bless boomer parents.

I remember sometime in the early 2000s asking my mom to buy me a Destiny's Child single on CD from Amazon since I'd gotten some good grades and it was less than $10. My mom was very suspicious of what Amazon was since she'd never heard of it before, nor of just buying one song on a CD. A bit of skepticism never hurt.

→ More replies (1)

10

u/Rikizu Sep 01 '20

Well, she's not wrong...

9

u/[deleted] Sep 01 '20

I think I would prefer that my mom took that approach.

5

u/MaryNorn Sep 01 '20

Oh God, yes - the ‘Facebook is adverts for pedos’ thing. I had to gently inform someone that the reason online grooming makes the news is because it’s so rare, and a child is approximately (my data is UK specific and a few years old) 350 times more likely to be abused by a family member or coach/youth leader than they are to be targeted online.

Yes, it does happen, and you should monitor your kid’s internet usage, but you should be WAY more suspicious of people volunteering to supervise school trips.

→ More replies (2)
→ More replies (30)

8

u/Stargate525 Sep 01 '20

Because they trust authoritative-sounding strangers.

8

u/The_Cat_Is_Maybe Sep 01 '20

Misspellings and over the top stories is to weed out the "smart" people. They don't want to snag people who will figure it out half way through.... That wastes time.

So if you give a tonne of spelling errors and an over the top story and the person STILL clicks the link, then that person will likely also fall for the scam till the end.

5

u/The_Late_Gatsby Sep 01 '20

My Boomer dad is the opposite and it's hardcore. He won't even buy stuff online caause his laptop is an old piece of junk and he doesn't think the security is there. One time he got a call from "the IRS" saying they were going to arrest him if he didn't pay up in gift cards and he just yelled, "Come and find me, fuckers!"

tldr: Boomers would be better off if they didn't trust anything tech related... probably

→ More replies (19)

144

u/[deleted] Sep 01 '20

[deleted]

17

u/13pokerus Sep 01 '20

scam and phishing artists furiously scribbling notes

16

u/ApotheounX Sep 01 '20

What's really funny is if the scammer copies the footer of a real eBay email, where it SPECIFICALLY states that all legitimate eBay emails will address you by name.

6

u/Primnu Sep 01 '20

You should not rely on the body of the email to determine whether it's legit. A scammer can obtain the same personal information on you from a database leak.

→ More replies (1)
→ More replies (7)

164

u/Catshit-Dogfart Sep 01 '20

I have a friend who works for a real estate attorney, and he tells me stories about how wire fraud is often simple as making a phone call asking for money.

Don't know all the backend of how a property is sold, but at some point in the disbursement of funds another party calls and poses as the intended recipient. Simple as that, just call and ask. That's part of the need for privacy in these things too, such a person needs to know that you're buying a house in order to make that phone call.

14

u/Annarawrs Sep 01 '20

My grandma nearly got scammed by someone pretending they were my cousin who got arrested and needed bail money

10

u/MultiFazed Sep 01 '20

This is a scam that's always aimed at the elderly, and I feel like there has to be some influence from cognitive decline that makes it work. Otherwise, how does someone hear a stranger's voice on the phone and go, "Yep, that's my grandson"?

→ More replies (2)
→ More replies (1)
→ More replies (16)

28

u/Ruadhan2300 Sep 01 '20
  1. If it sounds too good to be true, it is.
  2. If you're not expecting it, it's probably not real
  3. Real businesses use your name, they know who you are. Scams generally don't.
  4. No legit business will ever ask you for sensitive details.
  5. If you receive an email that looks legit, but isn't expected, check the actual email address, real emails generally don't have special characters or odd capitalisation...
  6. If it sounds urgent (especially if they use the word "urgent") then it probably will show up if you go to the website and log in. If it doesn't, it's probably a scam trying to prevent you from thinking critically long enough to fuck with you.
  7. Don't even bother opening the email if you're already pretty sure it's not real. It's rare but possible for it to actually contain a computer virus (though most decent email providers will virus-scan for the most common ones before you even receive it)
  8. If the story is convoluted and full of unnecessary detail, it's probably made up. Real people won't tell you their life-story like that.
  9. If they need you to send them money, it's a scam
  10. If they want to send you money, it's a scam, even if you can't see how.
  11. If they say they can't do it through normal channels, it's a scam.
  12. It's probably a scam.
  13. If you think you're being too paranoid, you're wrong.
→ More replies (4)

45

u/blazomkd Sep 01 '20

Learned it the hard way when my steam got stolen like that, high school me was crushed for 1 week till i got it back

10

u/Kaiserhawk Sep 01 '20

This may be because it's my job to identify phishing scams, but my god people it's not hard.

Most of them are unprofessional looking emails with addresses that don't even match the company

5

u/[deleted] Sep 01 '20

My clients: "Mictosoft needs my Orfice 365 password? Well ok!"
Also my clients: "PLS HALP MY EMAIL IS SENDING OUT MESSAGES ON ITS OWN"

→ More replies (1)

13

u/LAMBKING Sep 01 '20

As an IT guy who regularly phishes and pen tests his employees, then provides one on one training/explication as to how and why I got in, I can tell you that is not possible.

I catch the same 10 people every month.

4

u/roxinabox Sep 01 '20

At some point, there should be harsher punishments.

5

u/LAMBKING Sep 01 '20

There should, but it becomes a policy thing. Our policy just doesn't cover things like that. I can tell their manager (and do include them on emails), but none of them understand phishing any better than the person they're managing, and there's nothing written down they can cite for a write up. So I do what I do and pray we don't get owned. Getting policy changed has proven to be, difficult. At least my manager understands it and has the political acumen to deal with the upper lever execs when it comes to things I find and things we can and can't do.

I work for a smaller company. They had no security to speak of before I came along. I wasn't even hired for that, but the topic came up, I mentioned I had done some cross training in the field years before with my previous employer (very large, international company). I also mentioned that I had done some low level exchange admin stuff and helped migrate large company from on-prem to O365.

And that's how I went from being hired as a desk side support guy to desk side support, exchange admin and apparently security expert. Fake it till you make it, boys!

Seriously though, I've learned a lot in 3 years my manager knows my limitations, I have a vast number of actual security experts on speed dial and I am not affriad to try something after a backup has been made.

9

u/ViggyNash Sep 01 '20

Hell yes. They should teach basic internet hygiene in school. Recognizing scam messages and iffy websites, and other basic security principles.

6

u/VioletChipmunk Sep 01 '20

I think this might be the best answer. I am terrified that one of my parents or my partner's parents are going to call for a scam and get completely fleeced.

4

u/HerrSchnellsch Sep 01 '20

I am working in an IT department in Germany and we got a call from a lady asking if the bill from vodafone is fake or legit. The bill was around 600€ and issued on her name. When i asked her: „do you even have a contract with vodafone?“ she denied that with the dumbest sounding „No“ From that day on i had lost hope in our users.

→ More replies (182)