Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Out-Of-Office Messages Are a Security Risk

lonesysadmin.net

Post reply on HN
Print view View original

41–50 of 93 posts

Re: Out-Of-Office Messages Are a Security Risk

#41

Post by sct202 »

bplankers wrote: post #27
Moodles wrote: post #25

Earlier quoted context omitted.

I agree absolutely. It's similar to previous companies I've worked at that do phishing test emails for all their employees (usually at 9am on a Monday). There's little evidence it works, it is security theater and generally harms productivity. Knowing when not to bother people about security can be really helpful.

Followed immediately by HR sending an unsigned email about critical deadlines for benefits or something, telling you to click a link and/or a PDF attachment.

Our security team makes their phishing emails look way too professional.

Re: Out-Of-Office Messages Are a Security Risk

#42

Post by kovrik »

maxxxxx wrote: post #39
bplankers wrote: post #27

Earlier quoted context omitted.

Followed immediately by HR sending an unsigned email about critical deadlines for benefits or something, telling you to click a link and/or a PDF attachment.

In my company a lot of systems like HR have gone from internal servers to cloud so E-mails come from a lot of different URLs as sender. I consider myself pretty savvy but if a mail looks halfways plausible I don't really know how to tell if it's legitimate or not. The only way to fix this would be to sign E-mails so we can verify authenticity. I think it shouldn't be too hard to write an Outlook plugin to do this.

If I am not sure whether an email is legitimate or not, then I just ignore it assuming that if it is something real and important, then the other party will find a way to contact me (send another email, call me, approach me in person etc.).

Re: Out-Of-Office Messages Are a Security Risk

#44

Post by [deleted] »

bigiain wrote: post #15
sm4rk0 wrote: post #3

Earlier quoted context omitted.

What if you are working mainly with customers? BTW, the article says: > Set the autoresponse to the smallest group possible. In many cases you can narrow it down to coworkers, and/or have a different message for people inside your organization than outside your organization.

I think the context of the blog post, "the lonely sysadmin", means "working mainly with customers" isn't its target audience. Bikeshedding for a moment, I suspect the right response for people "working mostly with customers" is for the CRM to automatically re-route known-customer and cold-call emails to someone else on the "working mostly with customer" team, instead of first up telling customers or leads "Sorry, Bob…

[deleted]

Re: Out-Of-Office Messages Are a Security Risk

#45

Post by mc32 »

arkadiyt wrote: post #7

As always with security the first thing to ask is "What is your threat model?" This person's threat model seems to be people who email him for a legitimate business reason, but see that he's away & take the opportunity to attack him? I just don't buy it - I think there is nothing wrong with always setting an autoresponder.

Wouldn't an autoresponder for your email domain users and people in your addressbook be enough? The rest of the people don't need to know you're out of the office (by and large). Of course, if you're in sales that's diff but also has little sec implication. (Any internal threat would know you're out by other means anyhow)

Re: Out-Of-Office Messages Are a Security Risk

#46

Post by graybored »

Q "hey did you get my email? im following up. that thing X needs to be done and they are asking me why not"

A "well, i was out of office. jamaica is amazing... have you been"

Q "No, uhm, so the thing is that we are going to lose 5 bajillion dollars if this is not done by 2 pm"

A "jerk chicken. its just like my mind opened up to a whole new way of seeing the world.... "

Q "Right so.. .. will we be able to have that paper by noon maybe? Then I can get it signed and we can rush it back to the.."

A "no, sorry, it takes 3 days to send it through Central, then West has to backsearch the kumquats, its not something i really have control over"

Q ".... was your out of office not working? i couldnt see it.. i mean i thought you were there..."

A "no, thats a security risk. i wouldnt want us to lose money due to some scammer"

Q "what.. is that some new IT policy? i dont remember seeing that..."

A "no, no, i read about it on this site for experts in computer stuff, its called Hacker News, you should check it out"

Re: Out-Of-Office Messages Are a Security Risk

#47

Post by monochromatic »

arkadiyt wrote: post #7

As always with security the first thing to ask is "What is your threat model?" This person's threat model seems to be people who email him for a legitimate business reason, but see that he's away & take the opportunity to attack him? I just don't buy it - I think there is nothing wrong with always setting an autoresponder.

Still, I’d rather just forward my email to my assistant while I’m gone. If it’s urgent it’ll get handled. If not, it’ll wait.

Re: Out-Of-Office Messages Are a Security Risk

#48

Post by volkl48 »

zebraflask wrote: post #37
arkadiyt wrote: post #7

As always with security the first thing to ask is "What is your threat model?" This person's threat model seems to be people who email him for a legitimate business reason, but see that he's away & take the opportunity to attack him? I just don't buy it - I think there is nothing wrong with always setting an autoresponder.

This is an interesting discussion. I can see the author's point - maybe, as a thought experiment, an attacker could latch onto the fact that someone is out of the office and use that as a wedge. Along the lines of "John and I had a payment planned, but he's out of the office, can you send it to [fake destination]?" But, like other people have noted, you also have to weigh the chance of that happening in real life. It…

Even that would be hard to use in real life, as an "out of office message" does not mean that their colleagues can't easily reach them.

If you're some outsider you don't know if that person is really unreachable or if their colleagues can easily reach them on Slack/send them a text/whatever if they have some important question.

And if you are internal/close enough to know their time off plans and that they're going backpacking in the Canadian Arctic, you didn't need the message to tell you they're out of office.

Re: Out-Of-Office Messages Are a Security Risk

#49

Post by vegannet »

toomuchtodo wrote: post #20
vegannet wrote: post #19

Earlier quoted context omitted.

Any organisation where “hey I forgot my password, can you reset it?” from an unknown email address is an attack that has chance of success is an organisation where there’s dozens of major problems long before you get to auto-responders identifying who is away from the office.

You're assuming I can't hop on the phone (appearing to come from a known number using Caller ID spoofing, using LinkedIn to get a general idea of the org chart) and bluff my way through it with your underpaid, overworked help desk staff. People are the weakest link. This is only a few steps above Indian scammers taking remote control of users’ computers and convincing those users to send them hundreds of dollars of g…

We are arguing different points. I’m saying _if_ an organisation _is_ insecure enough for social engineering to work then a vacation auto-responder is not going to represent any meaningful increase in risk.

Re: Out-Of-Office Messages Are a Security Risk

#50

Post by toomuchtodo »

vegannet wrote: post #49
toomuchtodo wrote: post #20

Earlier quoted context omitted.

You're assuming I can't hop on the phone (appearing to come from a known number using Caller ID spoofing, using LinkedIn to get a general idea of the org chart) and bluff my way through it with your underpaid, overworked help desk staff. People are the weakest link. This is only a few steps above Indian scammers taking remote control of users’ computers and convincing those users to send them hundreds of dollars of g…

We are arguing different points. I’m saying _if_ an organisation _is_ insecure enough for social engineering to work then a vacation auto-responder is not going to represent any meaningful increase in risk.

I am arguing that _most_ organizations are insecure enough for social engineering to work, and that autoresponders are yet another vector. Orgs that observe proper operational security are still a minority.
Post reply on HN