Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Want to piss off your IT department? Are the links not malicious looking enough?

phishyurl.com

Post reply on HN
Print view View original

51–60 of 335 posts

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#51

Post by estimator7292 »

supriyo-biswas wrote: post #47
thinkingtoilet wrote: post #36

Earlier quoted context omitted.

I had the opposite funny experience. When I worked for Global MegaCorp, they would occasionally send out phishing emails and if you clicked on a link it would be recorded and you would have to do trainings if you got fooled a couple times. Eventually everyone learned to stop clicking on links on emails. That's good. However, they sent out a yearly survey to get feedback from all the employees and no one clicked the l…

The way they used to handle that at a FAANG I worked for was they had this app installed on each machine issued by IT, that would ask you a question daily about some aspect of your workplace. Handles all the phishing concerns, except that participation was either low or the feedback was negative, which would lead to the leaders issuing subtle threats to the team about how they'd find out the involved folks and fire t…

That sounds absolutely horrifying

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#52

Post by red369 »

thinkingtoilet wrote: post #36
supriyo-biswas wrote: post #35

All of this reminds me of a hilarious situation at a previous employer. As is standard corporate practice, they used to tell people to inspect links by hovering over them to confirm that they lead to the official website of the sender. People kept falling for phishing links though, so they got a Trend Micro device to scan emails, which also rewrote every link in it to point to their URL scanning service, which means…

I had the opposite funny experience. When I worked for Global MegaCorp, they would occasionally send out phishing emails and if you clicked on a link it would be recorded and you would have to do trainings if you got fooled a couple times. Eventually everyone learned to stop clicking on links on emails. That's good. However, they sent out a yearly survey to get feedback from all the employees and no one clicked the l…

In New Zealand, there is a long list of companies who need to reach out to a large number of current and former employees, and try to convince them to go to a website and enter sensitive information to receive some money (1). Where I'm working, we found it hard, even for current employees, to convince them that it's not either phishing, or a phishing test.

This is getting off-topic, but I found it interesting so I'll include more details anyway.

In a lot of cases, all the fuss is to return amounts that are tiny, and yet the companies need to keep reaching out and trying to convince people. I got $0.06 (2) from my current employer. Because I've moved countries with them, I ended up falling in the category of needing to provide some bank/tax details. Of course, I wanted to log in with the silliest OS I could think of to test/mess with the tracking dashboard, and so somehow I managed to enter my DOB wrong, which even further increased the back-and-forward and emails involved (I was in the project, so the Payroll peeps involved probably didn't hold it against me).

The re-calculation which led to the payment actually worked out that I had been underpaid in come calculations, but overpaid by far more (although still very, very little) in others. The company believed they couldn't offset, so all the fuss was for a tiny amount, which I felt I really wasn't owed anyway. Also unfortunate, was that if any former employee didn't bother to claim the amount because it's so small it's not worth the fuss, it just leads to more work in follow-ups.

New Zealand Holidays Act is quite an interesting area in general, in a how-can-it-possibly-be-this-hard kind of way. I think it contributes to the reputation of NZ payroll being one of the trickiest in the world.

1) https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-wha...

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#53

Post by red369 »

non_aligned wrote: post #12

I know it's a joke and I had a sensible chuckle, but if you want to routinely use it at work, just keep in mind that it's probably gonna make things worse. Since you can't exhaustively enumerate every good thing or every bad thing on the internet, a lot of security detection mechanisms are based on heuristics. These heuristics produce a fair number of false positives as it is. If you bring the rate up, it just increa…

I think you raise a good point, and I want to agree, but my knee-jerk feeling is that it's such a mess right now that it's just like a kid peeing in the ocean. Your point has convinced me to work on that.

In the meantime, does anyone else get a kick out of receiving emails from quarantine@messaging.microsoft.com where they quarantine their own emails?

Edit: I see other people said things that are similar to a more mature version of my feeling. We need to address this in a way that addresses the threat of email links properly, not throw machine learning at guessing which are OK to click. BTW, I'm not implying that you're saying that is what should be done to solve the issue, but I'm sure it's behind the silly MS quarantine I mentioned, and when an email from the one person I email the most, who is also in my contacts, going to spam in iCloud.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#54

Post by JaggedNZ »

red369 wrote: post #52
thinkingtoilet wrote: post #36

Earlier quoted context omitted.

I had the opposite funny experience. When I worked for Global MegaCorp, they would occasionally send out phishing emails and if you clicked on a link it would be recorded and you would have to do trainings if you got fooled a couple times. Eventually everyone learned to stop clicking on links on emails. That's good. However, they sent out a yearly survey to get feedback from all the employees and no one clicked the l…

In New Zealand, there is a long list of companies who need to reach out to a large number of current and former employees, and try to convince them to go to a website and enter sensitive information to receive some money (1). Where I'm working, we found it hard, even for current employees, to convince them that it's not either phishing, or a phishing test. This is getting off-topic, but I found it interesting so I'll…

Or IRD (NZ tax dept.) a few years back sending out a survey on a .co.nz domain. Gave their security team a hard time for that one!

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#55

Post by unlikelytomato »

grimgrin wrote: post #30
abtinf wrote: post #27

Or just report their mandatory compliance emails as phishing attempts. I’ve worked for multiple large companies where the annual IT security signoffs look exactly like malicious emails: weird formatting; originates from weird external url that includes suspicious words; urgent call to action; and threats of discipline for non-compliance. All this money being spent on training, only to immediately lull users into acce…

you may or may not add a condition for emails with X-PHISH in its headers

They block this and force it to show up in my inbox

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#56

Post by JdeBP »

alanh wrote: post #40
JdeBP wrote: post #34

Earlier quoted context omitted.

I haven't heard that myth recited in years. I thought that it had died. * https://jdebp.uk/FGA/html-message-myths-dispelled.html#MythA...

"The message format is not dangerous. It is the message viewers that are dangerous in this particular regard." Ah, I see. We should allow HTML but display it as plain text.

Or do what actually happened in the 20 years since that myth was actively doing the rounds: display HTML with sandboxed text/html viewers, as pine was doing back then, and as other systems eventually cottoned on to doing. By the time that the 2010s came along, the idea of sandboxing had taken root. Even in the middle 2000s, mail readers such as NEO and Eudora came with feature-reduced internal HTML viewers as an option instead of using the full HTML engine from a (contemporary) WWW browser that would do things like auto-fetch external images.

* https://www.emailorganizer.com/kb/T1014.php

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#57

Post by jader201 »

virtualcharles wrote: post #25

A whole new generation of rickrolling is about to begin. https://cam-xxx.live/trojan-hunter/evil-snatcher/malware_cry...

This feels like the opposite of rickrolling, though.

Instead of naively trusting the link, only to click it and get rickrolled, you’re naively distrusting the link, so you’ll never know the link was fine all along.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#59

Post by fiddlerwoaroof »

shawn_w wrote: post #43
thinkingtoilet wrote: post #36

Earlier quoted context omitted.

I had the opposite funny experience. When I worked for Global MegaCorp, they would occasionally send out phishing emails and if you clicked on a link it would be recorded and you would have to do trainings if you got fooled a couple times. Eventually everyone learned to stop clicking on links on emails. That's good. However, they sent out a yearly survey to get feedback from all the employees and no one clicked the l…

>... they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them. Sounds like something a phisher would do. Better not click.

I worked somewhere that would send the notice to do mandatory security training from a suspicious email and the message was very short (something like you have been enrolled in training at https://phishing.site.example.com/abdlejrj). In always just reported them as phishing and no one ever followed up.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#60

Post by Terr_ »

OptionOfT wrote: post #33

Reminds me of working at a company blocking access to eBay because their URL had .dll in there. Also, we were thought to inspect the URL before clicking on it. Except that the spam system they use completely mangles the URL...

> Except that the spam system they use completely mangles the URL...

I hate this trend. Like an overused pool of the same "Secret Questions" every company asks, it needs to be on some "X considered harmful" list.

Post reply on HN