Snapchat Employee Data Leaks Out Following Phishing Attack
1–10 of 62 posts
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#2If the compromised data somehow becomes public, a class-action suit (a la Sony) is not out of the question. At least Snapchat is trying to get ahead of the problem which undoubtedly helps them in the court of public opinion.
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#3Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us.
Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address?
I bet I wouldn't, and I'm paranoid.
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#4So this looks like HR or someone from inside snapchat got a phishing email and happily obliged and sent off a bunch of sensitive information without confirming that it should all be shipped over (unsecure) email.
I do work for some higher ed institutions, and almost every year without fail we have seen (and dealt with) successful phish attempts of various staff members... it's usually something small like a credit card number, but it still amazes me how an email that may look "very suspicious" to me doesn't set of a flag for someone else who isn't really thinking about this type of attack.
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#5So this looks like HR or someone from inside snapchat got a phishing email and happily obliged and sent off a bunch of sensitive information without confirming that it should all be shipped over (unsecure) email. I do work for some higher ed institutions, and almost every year without fail we have seen (and dealt with) successful phish attempts of various staff members... it's usually something small like a credit ca…
Social engineering attacks will probably be a thorn in security's side for a very long time, if not indefinitely... There's a sort of fundamental disconnect inherent in "Trust the system! It's secure! Except be careful because sometimes something that is not the system will pretend to be the system..."
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#6Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us. Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address? I bet I wouldn't, and I'm…
Don't reply to mails at 11pm might help, for a start.
I look at mail headers more often than necessary.
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#7Every company should inform their employees of the email impersonation scams going around.
> In the scam, a criminal mimics a chief executive’s email account and directs an employee to wire money to an overseas bank account. By the time the company realises it has been duped, the money is gone.
> [This scam] has cost businesses around the globe more than $2bn in little over two years, according to the US Federal Bureau of Investigation," with more than 12,000 victims, some of which "have been tricked into sending as much as $90m to offshore accounts."
http://www.ft.com/intl/cms/s/0/83b4e9be-db16-11e5-a72f-1e774...
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#8Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us. Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address? I bet I wouldn't, and I'm…
Do you have access to data that would cause a news story if you sent it to the wrong person? If yes, then yes, verify it before sending.
Also, spoofing an email address wouldn't help. If you respond, it will go to the spoofed address, which is the correct one. They need to send it from their own email address, which means that you only need to verify that it's send from your manager's address, or just manually send it to your manager.
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#9If the compromised data somehow becomes public, a class-action suit (a la Sony) is not out of the question. At least Snapchat is trying to get ahead of the problem which undoubtedly helps them in the court of public opinion.
The Sony case affected customers, apparently this breach only affects employees. I find it hard to believe the employees would file a class action lawsuit against their own employer.
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#10Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us. Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address? I bet I wouldn't, and I'm…
But unless you actually break into someone's account, email spoofing should be a solved problem. Sure, you can set the from field to whatever you want, but in a typical company scenario, it will look very different in outlook - it will actually display the sender's email, and if you try to spoof that, you'll just get rejected at the server.
Now if you ignore that and respond anyway... well, there's not much anyone can do about that.