Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Should Failing Phish Tests Be a Fireable Offense?

krebsonsecurity.com

Post reply on HN
Print view View original

171–180 of 357 posts

Re: Should Failing Phish Tests Be a Fireable Offense?

#171

Post by Scoundreller »

onion2k wrote: post #79
jsty wrote: post #68

Earlier quoted context omitted.

Considering that from what I recall Lynx doesn't execute javascript, it would have to be one esoteric zero-day

Downloading and executing code is only one way a browser session can be abused. At the very least you're giving away everything your browser (even Lynx) puts in the headers of a request. That's often a heck of a lot of useful information for an attacker. Lynx supports cookies too so it would be possible to track a user between sessions. I don't know how that might benefit an attacker but I'm not an attacker[1]. I thi…

By default, Lynx prompts to deny/accept cookies for every domain.

Re: Should Failing Phish Tests Be a Fireable Offense?

#172

Post by goguy »

maxk42 wrote: post #25

I'm a tech professional and security is a regular part of my jobs. At one point -- while contracting for a Fortune 500 client that shall remain unnamed -- I received an email that was quite clearly phishing. Curious as to what the payload was and whether it was worth reporting, I fired up lynx and followed the link in the email from the command line. I was promptly informed that I had failed the test and I would be r…

The fact you visited the link would let them know that company x has an current employee named y.

Whilst that information might not be sensitive it could be used at a later date to extract sensitive company information.

Re: Should Failing Phish Tests Be a Fireable Offense?

#173

Post by wil421 »

ygjb wrote: post #134
wil421 wrote: post #104

Earlier quoted context omitted.

That’s not true. My workplace has employee only entrances where even visitor/temporary badges don’t work. No one is standing guard and they tell everyone to not allow tailgating.

That's the point. I was in the infantry, am 6'2, and a guy. I don't have a problem with challenging folks who are tailgating. That is not the case for everyone. Do you expect disabled folks to challenge tailgaters? What about physically small people? Setting aside the office dynamics around discrimination issues, how many people actually have the confidence to challenge an unknown person who is tailgating, knowing th…

You politely say swipe your badge. If they refuse you walk over and get physical security. No need to physically challenge anyone.

Re: Should Failing Phish Tests Be a Fireable Offense?

#174

Post by Scoundreller »

MisterTea wrote: post #97
ryanjshaw wrote: post #47

Earlier quoted context omitted.

Can't speak to whether a reprimand is warranted or not and I think many here will disagree, but unless your job is investigating phishing, you shouldn't do this because you ARE ultimately putting the corporate network at risk unnecessarily - what if it was a real link and happened to exploit a zero day on your box? Management wouldn't accept your reasoning for following the link I suspect.

I doubt most if not all exploits would work in lynx/links. But your point is spot on, don't take it upon yourself to do things that aren't in your job description. Otherwise you become that person who takes it upon themselves to "fix" things and makes the problem worse for the people responsible for fixing things.

When I got outed for doing that, I got a thank you card.

I made my own signs for wayfinding (Main Building ——>, and “Floor 7” when the stairwell was missing it).

Some are still up a few years later.

Re: Should Failing Phish Tests Be a Fireable Offense?

#175

Post by briandear »

wang_li wrote: post #94
mason55 wrote: post #58

Earlier quoted context omitted.

I actually like the idea of having consequences for allowing tailgating, assuming the company cares about it. Maybe not firing, at least right away, or if you get tricked/someone sneaks in behind you, but put some teeth in the policy and actually enforce it. If the company just says "don't do it" there is still social pressure to be polite and not slam the door in someone's face. But if there are consequences that ev…

Are you prepared to pay your employees a significant premium for the requirement that they engage in fisticuffs with random strangers who may try to tailgate into the building? Tailgating is a problem for your physical security staff, not your run of the mill white collar employee.

If someone follows you in, simply call security and report it. No confrontation needed.

Re: Should Failing Phish Tests Be a Fireable Offense?

#176

Post by pbhjpbhj »

4ntonius8lock wrote: post #85
Consultant32452 wrote: post #45

Earlier quoted context omitted.

When a new phishing test goes out everyone in my department announces to everyone else to watch out for it. So it's a bonding experience of the non-security people against the security people.

It's silly to do it inhouse. It creates distrust. That is why you pay consultants. They send out the phishing test, and hopefully regular people bond with the security people in an effort to pass it. I mean, after all, security and regular people in the company should want the same thing (company success... which implies not giving away things to phishing probes)

Yes, you don't want to create an environment in which people don't want to ask IT/opsec people for help for fear they will be getting themselves in trouble.

Re: Should Failing Phish Tests Be a Fireable Offense?

#177

Post by britch »

heavenlyblue wrote: post #137
yourapostasy wrote: post #62

Earlier quoted context omitted.

Worry about CSS-based exfil. https://www.mike-gualtieri.com/posts/stealing-data-with-css-... The security teams are correct in the training they run about these: report the suspicious email and leave the investigation to them, don't try to DIY the investigation. Note you aren't penalized for false positives (reporting a legitimate email as a phishing attempt).

I don’t understand this attack: if attacker can control CSS on the page - then they probably can also control javascript. Which means they can extract any data from it.

I think the point was even if you disable JS in your browser to be "safe," there's the possibility of some nasty CSS on the page as well.

Turning off JS does not make you safe.

Re: Should Failing Phish Tests Be a Fireable Offense?

#178

Post by Scoundreller »

dearrifling wrote: post #91
maxk42 wrote: post #25

I'm a tech professional and security is a regular part of my jobs. At one point -- while contracting for a Fortune 500 client that shall remain unnamed -- I received an email that was quite clearly phishing. Curious as to what the payload was and whether it was worth reporting, I fired up lynx and followed the link in the email from the command line. I was promptly informed that I had failed the test and I would be r…

Counting opening a mail as failing is ridiculous. A a phising test should only count captured logins.

When I see one of these, I actually do go onto my Corp iPhone to delete the email instead of Outlook/Windows.

It may not be a perfect approach since we do use it for MFA...

Re: Should Failing Phish Tests Be a Fireable Offense?

#179

Post by noir_lord »

Scoundreller wrote: post #168
noir_lord wrote: post #112

Earlier quoted context omitted.

One of the reasons you'll pry Evolution from my cold dead hands is Right Click -> Create Filter -> @domain.co.uk and done. I have filters for almost everything, my boss goes into one folder and gets set one color, automated notifications from my internal system another (green if everything is OK, orange if there is something I really need to look at). What I really* want is a desktop client that exposes a nice clean…

What happens when one of those blocked domains becomes a vendor for your org?

Nearly all of them are tech companies trying to sell me stuff because I once bought something from them, tried their service or briefly thought about it.

As I’m the head techie (by dint of been the only techie) , I’d be the one purchasing from them in the first place.

I find a filter that sends everything to Marketing/Hardware and marks as read fairer than flagging them as spam.

If you filter out all the people telling me they’ll be out the office, birthday announcements etc, all the vendors trying to sell me stuff and all the automated stuff (which I do automatically), I get less than 5 emails a day (I put my boss on Trello, it’s just better for what we need) which I check once at 11 and at 10 to 5.

I’m ruthless about my time since I’m the only programmer.

Re: Should Failing Phish Tests Be a Fireable Offense?

#180

Post by Scoundreller »

alkonaut wrote: post #152
chelmzy wrote: post #144

Earlier quoted context omitted.

It would still trigger the fail. Typically the link contains an identifier and the landing page is hosted on a public facing web server.

Yeah - I’d be wary of doing it without changing the parameters for that reason. But obviously you can’t check a link without checking a link. It would also be interesting to hear whether someone actually considers me to have failed anything when visiting a (faux) attacker’s link on my own device off the company network and entering no credentials.

They’re probably not that advanced with it. If anything, you’ll upset IT with extra paperwork to grant you the exemption from the hit.
Post reply on HN