Live data from Hacker News

Thanks FedEx, this is why we keep getting phished

troyhunt.com

11–20 of 576 posts

Re: Thanks FedEx, this is why we keep getting phished

#11

Maybe FedEx sees better results and gets more payments from appearing scammy? Scammers seem to do alright. I know we tech people think this is type of messaging is ridiculous, but I’m constantly pulling less technical friends and family away from crap like this. Half a dozen have asked me about Elon Musk’s crypto trading breakthrough.

I doubt FedEx’s customer engagement increased by sending a query string with no domain or protocol. Someone’s asleep at the wheel here.

Re: Thanks FedEx, this is why we keep getting phished

#13
Your security is increasing at risk from organisations and corporations whose own grasp of security is appalling. Because instead of dealing with it they externalise risks and consequences onto the public and customers.

Even worse, is where attempts to query that security is actively punished.

This is typical now. Listen here (at 42:20) with an example regarding the UK NHS whose incompetence plays directly into the hands of cybercriminals.

[0] https://cybershow.uk/episodes.php?id=24 (time:42:20)

Re: Thanks FedEx, this is why we keep getting phished

#14
Ahh yes, the FedEx GST payment system is wonderful!

You can find that number in the sms on an official FedEx page somewhere or other - I ended up using that as enough evidence to trust and call.

I get the feeling this system as a whole doesn't see much use - from a FedEx perspective, the vast majority of people paying duty will be via some specialised importer, not b2c direct.

Re: Thanks FedEx, this is why we keep getting phished

#15

I know this comes down to institutional incompetency, but at some point there was a singular human person putting the template content the SMS message in question was generated from into some computer system somewhere and I genuinely wonder what was going on in their head that made them string the words together in this way. You'd have to give it a true, earnest shot to make it worse.

You assume it is a singular person.

Could easily be one person writing the message. Another who demanded partial edits in a Jira ticket. But then the data types didn't match up with what the writer requested and then the dev didn't want to deal with it and just shipped it.

Or it could be that the message is made with a bunch of disjointed and constructed if statements and only the final output is piped to the customer. I have seen some very terrible log messages like that as nobody is looking at the entire message, just the little bit in the conditional they are editing at that point.

As an anecdote, I once worked on code that generated these very detailed error messages about why something went wrong. I discovered most never made it to the customer as someone later down the line reassigned a variable rather than +=. Piles of support tickets could have been avoided.

Re: Thanks FedEx, this is why we keep getting phished

#16
post #11

Maybe FedEx sees better results and gets more payments from appearing scammy? Scammers seem to do alright. I know we tech people think this is type of messaging is ridiculous, but I’m constantly pulling less technical friends and family away from crap like this. Half a dozen have asked me about Elon Musk’s crypto trading breakthrough.

I doubt FedEx’s customer engagement increased by sending a query string with no domain or protocol. Someone’s asleep at the wheel here.

Well theoretically they force people to Google FedEx which IS a strong signal for google people are interested in the FedEx Brand. Doubt however that's the reason.

Re: Thanks FedEx, this is why we keep getting phished

#18
post #9

Not that I’m endorsing the use of smart phones, but FedEx does have a mobile application. Why not just use that for notifications regarding deliveries?

The FedEx one is meh and does afaik, but some (looking at you dhl) are almost useless as they provide little information (tracking info is hidden sometimes), sometimes do not allow you to add the parcel as it has a tracking code from a foreighn service which you cannot use and you have to figure out the local one, are full of "news" also known as ads and do not allow you to select the dropoff location closest to you (go ups!). Sorry, /rant.

Re: Thanks FedEx, this is why we keep getting phished

#20

I know this comes down to institutional incompetency, but at some point there was a singular human person putting the template content the SMS message in question was generated from into some computer system somewhere and I genuinely wonder what was going on in their head that made them string the words together in this way. You'd have to give it a true, earnest shot to make it worse.

"The words" are probably nested templates so that at the level of input it's hard to really understand what the completed end result looks like. Also, there's many well-intentioned people in tech doing stuff that's just a tiny bit too complex for them to execute by themselves without a buddy or a reviewer. There are also whole teams and departments at big enterprises where someone might not be doing it alone, and they might also not be completely incompetent, making them the star engineer on the team, while everyone else wisely keeps their mouths shut since they surely don't have anything to contribute to the process. All the really good people that worked there, were snatched up by some fancy, greenfield project, on another floor, or got a position on some elite "refactoring team", surely not wasting their time on updating templates.
Post reply on HN