My current company makes it real easy. All their simulated phishing addresses use the fictitious TLD of “.corn” so I just setup an email rule to filter them.
Clearly he’s trying to trick you into pressing the “Report Phishing” button, which must be some sort of a trap. I’d check the attached document for further clues, especially since he’s telling me not to. Must be something interesting there
in the Deleted Items folder. “Delete” just moves the email there. At my company anything older than a month in Deleted Items gets actually deleted. But more importantly if you just delete it, maybe nobody knows it’s’ there. If you report it the outlook team can delete it from the servers.
I know this is a leap, but for some reason reading this made me want to buy a domain like virus.porn and make it the most wholesome, lemmy community on the planet.
Or girlsof in stagam, which apparently has disappeared but used to be the story of the adventures of a person called Girlsof in the magical realm of Stagram.
It blasts the hackers off the face of the earth with orbital lasers! killer robots sever their network connection! It’s twirling a revolver on its finger while smoking three cigarettes!
And sometimes, that revolver goes off in your face, and it posts your private key on 4Chan.
In a previous life, I routinely blocked anything from a free cloud host or cert provider. There was rarely a business justification for accessing a site or service hosted on DigitalOcean or signed by LetsEncrypt. Sure, get an SSL cert and host for your personal project - so I wasn’t mad at the services - but it was a signal that the endpoint was not trustworthy beyond the TCP packets.
I suspect that AWS/GCP/Azure has made that much harder.
A company I was in a few jobs back had several layers of IT department, there was the local studio department that handled our everyday stuff and a “head office” somewhere far away that set policy and handed out budget and whatnot.
One day “head office” IT decided it was a good idea to send out some fake phishing emails to “test” us. They didn’t tell the local IT department about it, I guess they were also being “tested”. My manager received one and only recognized it as a phishing attempt after he’d clicked just one too many things for it to feel safe to ignore. So he yanked the power on his computer and contacted the local IT department, as is protocol when something potentially dangerous just happened.
The local network went into lockdown while local IT tried to figure out if something actually dangerous had happened. It cost the studio as a whole several hours of work time, which for a studio our size translated to an obscene dollar cost. Nobody on our side of things did anything wrong, even that one extra “dangerous” click my manager did wasn’t something he could be blamed for - head office had crafted the fake phishing attempt well and his reaction to it would have prevented damage had it been real.
Phishing attempts that got far enough to actually show up in our internal corporate inboxes like that aren’t common, though. They’re normally blocked by the layers of firewalls and whatnot. We almost never saw email on those accounts from outside the organization itself, period.
And once you’ve run something capable of remote execution on a machine that’s inside the local network, with the sort of privileges that his machine had (he wasn’t just a bureaucratic sort of manager, he was writing code too), you don’t want to mess around.
My company sends at least one fake phishing email a week. They track stats for them on a security page and I wear it as a badge of honor that my report says 100% viewed and 0% reported.
My company makes you take a course of you fail one or if you ignore 4 or 5 so I have the highest reporting record of the company just because of how much I hate that course
I think they do that at my company too but in addition to not reporting phishing emails I have a personal rule that I don’t do any “mandatory” training unless someone in my management chain specifically asks me to. My boss probably gets annoyed by that occasionally but you’d be surprised how much of that stuff I never get asked about.
Yeah that’s a good call. I don’t push back when asked directly I just pretend I didn’t see the emails. Most of the time it’s fine but the boring security stuff is usually the one they get me on.
They need to up their game to cover internationalized homograph vulnerabilities, using roughly similar characters from different international alphabets to create totally different domain names:
I do have a tendency to check where the link leads before clicking on it, so the difference between those two is quite obvious to me: http://example.com/ vs http://xn--exmple-4nf.com/, but a lot of people probably do not do that.
When they first started doing these tests unannounced, our IT department got a horrendous failure rate and then management had to announce that if we recognize it as a phishing simulation, we should still report it, and we also shouldn’t start poking around in the supposed phishing links. 😅
I have over 8000 unread mails in my inbox. Whoever contacts me used Slack. I don’t give a fuck about emails unless DMs me “hey can you maybe answer that customer mail I forwarded you?”
So I would have a fabulous time with such a stupid policy.
Mine includes a header so their mail filter knows to ignore it.
At this point, I’m pretty sure that every employee who has been there for more than a month has written or at least copied a filter to delete any email with that header.
I’ve never been comfortable with that kind of mass deletion and we have, AFAIK, unlimited mailbox storage, so I just set my version to mark those emails as read.
In the gmail web client, I dont see an option to filter off headers. thunderbird lets you set up filters for custom headers, but it’s a bit more complicated.
TBH, i never used it to set up a custom filter, I just knew there were indicators I could use to figure out if an email was in fact a test
My work computer is quite locked down (can’t even install Solitaire or Minesweeper), so I’ll have to set up whatever filter in Outlook. And I think it deletes the messages once flagged as phishing, so I don’t think I have one to inspect right now.
Anyway, some random blog seems to point back to
KnowBe4’s whitelisting guide, so I think the filter would need to look for something in the header or for the specified IP addresses?
At a previous job, there was a header. I can’t remember it directly, but lets say it was like this:
X-Acme-Security-Test: Authorized simulated phishing exercise conducted by KnowBe4 on behalf of Acme Corp for security awareness training and compliance validation
Apparently KnowBe4 lets customers set their own custom headers. So this was probably set by my company. And not something everyone will see.
But also, they set an X-PHISHTEST header. Maybe its a signed header, so they can cryptographically prove the test was in accordance with the customer’s request (this email was sent by us, but it uses YOUR private key, so clearly you were involved here, and we arent just scamming people, or otherwise allows you to validate it at the firewall/spam filter). This isn’t the header I remember, but apparentlly can also be used to detect them – the explicitly say not to do that, but here we are.
But if you ever get a knowbe4 phishing test, check the email headers. you’ll probably find something to key off of.
I just take it one step farther and never open any email. If it’s important you will CC my manager and he will physically come by my office and tell me about the email, giving me multi-factor phishing protection. If he demands I open an email then I am absolved of responsibility.
My place has this thing where most phishing test emails are obvious but every once in a while they’ll drop a really good one, sometimes these even pose as our managers.
The company I work for has lots of training to recognize phishing attempts, and then they proceed to send emails that tick most of the “avoid this” boxes.
My current company makes it real easy. All their simulated phishing addresses use the fictitious TLD of “.corn” so I just setup an email rule to filter them.
An actual email sent by my company. (not representative of their usual)
Yeah if anyone falls for this lock them out of their computer immediately.
Clearly he’s trying to trick you into pressing the “Report Phishing” button, which must be some sort of a trap. I’d check the attached document for further clues, especially since he’s telling me not to. Must be something interesting there
That’s pretty cool. Gets the point across - and the reason and results of why it matters to report instead of ignore. Kudos to your team.
…if you delete it, it’ll sit in your inbox? I…what?
in the Deleted Items folder. “Delete” just moves the email there. At my company anything older than a month in Deleted Items gets actually deleted. But more importantly if you just delete it, maybe nobody knows it’s’ there. If you report it the outlook team can delete it from the servers.
I suppose it means to say that it gets moved to trash and sits there.
I know this is a leap, but for some reason reading this made me want to buy a domain like virus.porn and make it the most wholesome, lemmy community on the planet.
Oh, you mean like penisland.net?
Or girlsof in stagam, which apparently has disappeared but used to be the story of the adventures of a person called Girlsof in the magical realm of Stagram.
I remember that one too, but think it was actually called Slütsof In Stagrâm
ass.golf
Just leaving their bare ass out there with no ssl, smh
It’s only one ssl. How much could it possibly cost? 4 dollars?!
I the worst part is deciding which flavor to get
Jesus… TIL
They can also be gotten for free through many providers, the biggest one in self-hosting is LetsEncrypt
I like that the most expensive one is called “wildcard”.
Sounds like it’s gonna perform AMAZING feats of security some of the time and just not work at all at other times.
Kinda like the wild mage of encryption 😁
WILDCARD SECURITY
It blasts the hackers off the face of the earth with orbital lasers! killer robots sever their network connection! It’s twirling a revolver on its finger while smoking three cigarettes!
And sometimes, that revolver goes off in your face, and it posts your private key on 4Chan.
Imma flex my EV
Isn’t TLS/SSL something at the server level and not the domain provider level?
You have to get a certificate from a provider which can verify you control the domain.
Once you’ve proved control you install the signed certificate with the secret private key on your server.
You can get certificates for free via Let’s Encrypt and a bunch more CA’s. It hasn’t been expensive for ages, unless you want fancy corporate support.
Corporate support can be a big deal.
In a previous life, I routinely blocked anything from a free cloud host or cert provider. There was rarely a business justification for accessing a site or service hosted on DigitalOcean or signed by LetsEncrypt. Sure, get an SSL cert and host for your personal project - so I wasn’t mad at the services - but it was a signal that the endpoint was not trustworthy beyond the TCP packets.
I suspect that AWS/GCP/Azure has made that much harder.
I tried securing my ass, but my browser got stuck.
Be the change you want to see! I’ll sign up straight away.
P1nkman, please report to the training room.
But there’s nothing here 😭
It can be yours for only $69/year!
Sure, but i don’t know how to set it up as a fediverse instance.
This reminded me of notpron.com
Anything but wholesome though…
Why not?
A company I was in a few jobs back had several layers of IT department, there was the local studio department that handled our everyday stuff and a “head office” somewhere far away that set policy and handed out budget and whatnot.
One day “head office” IT decided it was a good idea to send out some fake phishing emails to “test” us. They didn’t tell the local IT department about it, I guess they were also being “tested”. My manager received one and only recognized it as a phishing attempt after he’d clicked just one too many things for it to feel safe to ignore. So he yanked the power on his computer and contacted the local IT department, as is protocol when something potentially dangerous just happened.
The local network went into lockdown while local IT tried to figure out if something actually dangerous had happened. It cost the studio as a whole several hours of work time, which for a studio our size translated to an obscene dollar cost. Nobody on our side of things did anything wrong, even that one extra “dangerous” click my manager did wasn’t something he could be blamed for - head office had crafted the fake phishing attempt well and his reaction to it would have prevented damage had it been real.
Head office never tried a stunt like that again.
Given how common phishing attempts can be though, shutting down for every single one seems like overkill.
Phishing attempts that got far enough to actually show up in our internal corporate inboxes like that aren’t common, though. They’re normally blocked by the layers of firewalls and whatnot. We almost never saw email on those accounts from outside the organization itself, period.
And once you’ve run something capable of remote execution on a machine that’s inside the local network, with the sort of privileges that his machine had (he wasn’t just a bureaucratic sort of manager, he was writing code too), you don’t want to mess around.
All I could think as I read this was Dwight’s fire drill from the office
I’ve also never fallen for any of the phising emails the IT department sends to test me, my secret is almost never checking my email
My company sends at least one fake phishing email a week. They track stats for them on a security page and I wear it as a badge of honor that my report says 100% viewed and 0% reported.
My company makes you take a course of you fail one or if you ignore 4 or 5 so I have the highest reporting record of the company just because of how much I hate that course
I think they do that at my company too but in addition to not reporting phishing emails I have a personal rule that I don’t do any “mandatory” training unless someone in my management chain specifically asks me to. My boss probably gets annoyed by that occasionally but you’d be surprised how much of that stuff I never get asked about.
Last year our CISO personally reached out to me and asked me to do the course that’s overdue. I was a little nervous for a second and decided to obey.
Yeah that’s a good call. I don’t push back when asked directly I just pretend I didn’t see the emails. Most of the time it’s fine but the boring security stuff is usually the one they get me on.
My guess? Their bonus was tied to 100% compliance and you were one of the last people to do the training.
Nice. My company ties the bonus payment to completing all the mandatory training. You get many reminders from HR when the bonus payment is approaching
My company is using phishing simulations from a company that puts their company name in the x headers or every email, so that’s also easy filter.
As a bonus, that filter also throws all the full security training courses to junk
Kemming is 100 level preparedness.
They need to up their game to cover internationalized homograph vulnerabilities, using roughly similar characters from different international alphabets to create totally different domain names:
example.com
exаmple.com
They look identical but are entirely different.
https://en.wikipedia.org/wiki/IDN_homograph_attack
I do have a tendency to check where the link leads before clicking on it, so the difference between those two is quite obvious to me:
http://example.com/vshttp://xn--exmple-4nf.com/, but a lot of people probably do not do that.I would definitely not click on the second one.
Well that’s just rude
If we don’t report the emails as phishing it is considered a fail.
I report so many things from executive level because all of the training examples use exec comms as an example.
When they first started doing these tests unannounced, our IT department got a horrendous failure rate and then management had to announce that if we recognize it as a phishing simulation, we should still report it, and we also shouldn’t start poking around in the supposed phishing links. 😅
I’ll delete the failure report without reading that either.
…and then you don’t get into company Harvard, or what?
lucky you. they fail us if we don’t right click report phishing.
Can still set up a header-matching rule - just need to mark the email with a label, so you can report it without even having to read it.
I have over 8000 unread mails in my inbox. Whoever contacts me used Slack. I don’t give a fuck about emails unless DMs me “hey can you maybe answer that customer mail I forwarded you?”
So I would have a fabulous time with such a stupid policy.
Mine includes a header so their mail filter knows to ignore it.
At this point, I’m pretty sure that every employee who has been there for more than a month has written or at least copied a filter to delete any email with that header.
I’ve never been comfortable with that kind of mass deletion and we have, AFAIK, unlimited mailbox storage, so I just set my version to mark those emails as read.
edit: Mail, not mark.
If your company contracts with phish.me then that URL is actually in the email header metadata.
Just set up a rule for the word phish to a special folder, and then you can use the “report” button on everything in that folder to get the credit.
KnowBe4 includes a bunch of headers in the email, including a disclosure saying they have permission to run the simulated phishing test.
Where might I find more details to set up filters?
In the gmail web client, I dont see an option to filter off headers. thunderbird lets you set up filters for custom headers, but it’s a bit more complicated.
TBH, i never used it to set up a custom filter, I just knew there were indicators I could use to figure out if an email was in fact a test
My work computer is quite locked down (can’t even install Solitaire or Minesweeper), so I’ll have to set up whatever filter in Outlook. And I think it deletes the messages once flagged as phishing, so I don’t think I have one to inspect right now.
Anyway, some random blog seems to point back to KnowBe4’s whitelisting guide, so I think the filter would need to look for something in the header or for the specified IP addresses?
I heard a rumour that KnowBe4 have ties to Scientology.
From what some Googling told me, Kevin Mitnick is a scientologist, as is most of the upper management .
Not really relevant here, just interesting…
Tell me more…
Apparently I’m both right and wrong.
At a previous job, there was a header. I can’t remember it directly, but lets say it was like this:
X-Acme-Security-Test: Authorized simulated phishing exercise conducted by KnowBe4 on behalf of Acme Corp for security awareness training and compliance validationApparently KnowBe4 lets customers set their own custom headers. So this was probably set by my company. And not something everyone will see.
But also, they set an
X-PHISHTESTheader. Maybe its a signed header, so they can cryptographically prove the test was in accordance with the customer’s request (this email was sent by us, but it uses YOUR private key, so clearly you were involved here, and we arent just scamming people, or otherwise allows you to validate it at the firewall/spam filter). This isn’t the header I remember, but apparentlly can also be used to detect them – the explicitly say not to do that, but here we are.But if you ever get a knowbe4 phishing test, check the email headers. you’ll probably find something to key off of.
I just take it one step farther and never open any email. If it’s important you will CC my manager and he will physically come by my office and tell me about the email, giving me multi-factor phishing protection. If he demands I open an email then I am absolved of responsibility.
My place has this thing where most phishing test emails are obvious but every once in a while they’ll drop a really good one, sometimes these even pose as our managers.
The company I work for has lots of training to recognize phishing attempts, and then they proceed to send emails that tick most of the “avoid this” boxes.
Lmfao, .corn sounds like an instance someone would spin up to compete with lemmy.beans