Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Want to piss off your IT department? Are the links not malicious looking enough?

phishyurl.com

Post reply on HN
Print view View original

241–250 of 335 posts

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#241

Post by cameron_b »

Workaccount2 wrote: post #237
cedilla wrote: post #152

Earlier quoted context omitted.

All that anti-phishing training that taught us to look closely at the URL and now it's all just safelinks.protection.outlook.com

My It department does mandatory phishing training every year, and then for the "test" e-mails, they spoof a domain and whitelist the DMARC on their side so it goes through. So we get e-mails from @microsoft.com and it's only if you dig in the metadata that you see it failed authentication. The only tell in the e-mail is checking the URL, which doesn't tell you much because tons of regular e-mails use tracker redirect…

Hey, simulating the hack is a lot better than using some canned tool with blatant knowbe4 urls.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#242

Post by WOTERMEON »

cpburns2009 wrote: post #211
chrisweekly wrote: post #203

Earlier quoted context omitted.

I thought Plaid used OAuth2. Hmm.

Plaid asks for your raw bank credentials so that it can scrape up data. That's why I've always refused to use it.

I really hope to never be in the position where I have to use it

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#243

Post by dogleash »

btbuildem wrote: post #234
arghwhat wrote: post #149

Ah no need, corporate IT already make all URLs malicious looking through some microsoft "secure link" service, and constantly shows everyone shady looking prompts that constantly change and have cmd.exe windows flash in at random. A phone call from Microsoft about my Norton anti-virus subscription putting me into debt that can only be settled with Nintendo gift cards bought in cash across 16 specific gas stations see…

My little hobby is reporting any and all emails about compliance, training, etc (basically anything with actions in them) as phishing and then escalating their responses as "social engineering". It's fun!

Im in the security alias and that happens unironically every time the company rolls out a new external service.

Now sketchy emails are preceded by an equally sketchy “it’s ok” email from IT.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#244

Post by cameronh90 »

arghwhat wrote: post #149

Ah no need, corporate IT already make all URLs malicious looking through some microsoft "secure link" service, and constantly shows everyone shady looking prompts that constantly change and have cmd.exe windows flash in at random. A phone call from Microsoft about my Norton anti-virus subscription putting me into debt that can only be settled with Nintendo gift cards bought in cash across 16 specific gas stations see…

It’s a trade-off.

Most people are never going to check the links no matter how much you ask them to, and even if they did they wouldn’t know what to check for. But the tool Microsoft give you to check a link before opening it is that awful URL rewriter, which prevents the small minority who would check from being able to.

Similarly those flashing cmd windows are usually automatic update processes that Windows has no way to hide. Even some drivers that MS distribute through Windows Update do it. We could turn automatic updates off, but then nobody would update their software.

IT is rough because you’re often stuck between a rock and a hard place. On the one side you have users who don’t want to change their behaviour, on the other side you have industry leading vendors, that the SLT insist on using, that make it impossible to do the right thing or put the right thing on an Enterprise plan that the budget won’t permit. Then to top it off, there are usually compliance and insurance breathing down your neck forcing you to implement questionable best practices from the 90s, so you just have to do your best to limit the damage.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#245

Post by jsmith99 »

jcims wrote: post #184
cedilla wrote: post #152

Earlier quoted context omitted.

All that anti-phishing training that taught us to look closely at the URL and now it's all just safelinks.protection.outlook.com

Outlook has a rule filter for header content. Just saying I haven't failed a phishing test in ~10 years.

My IT department use the official Microsoft phishing test. The emails arrive in inbox with 0 headers. (There's also a helpful Microsoft page of all the dodgy sounding domains they've registered for this.)

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#246

Post by mobiuscog »

cameronh90 wrote: post #244
arghwhat wrote: post #149

Ah no need, corporate IT already make all URLs malicious looking through some microsoft "secure link" service, and constantly shows everyone shady looking prompts that constantly change and have cmd.exe windows flash in at random. A phone call from Microsoft about my Norton anti-virus subscription putting me into debt that can only be settled with Nintendo gift cards bought in cash across 16 specific gas stations see…

It’s a trade-off. Most people are never going to check the links no matter how much you ask them to, and even if they did they wouldn’t know what to check for. But the tool Microsoft give you to check a link before opening it is that awful URL rewriter, which prevents the small minority who would check from being able to. Similarly those flashing cmd windows are usually automatic update processes that Windows has no…

There is an easy answer. Give employees two computers.

One is the 'business' one. Mostly locked down, with checks in place.

The other is on a different network, isolated from all business functions, and they can do what they want but must never use it for work data, just like their phones (that everyone knows they use for social media etc. in the day).

Sure, you still have to deal with copying from one to the other (but there are solutions for that if critical, and much easier to secure).

It sounds crazy, but air-gaps are largely proven and it also means that employees feel less oppressed.

Now I realise, even ignoring the cost, businesses won't want this, as perish the thought their employees may do anything other than work. But I suspect it would actually stop more attacks and issues than otherwise and maybe... just maybe.. employees feel as if they're actually human.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#247

Post by dcminter »

_boffin_ wrote: post #221
dcminter wrote: post #197

Earlier quoted context omitted.

Where a bank doesn't offer compliant APIs, screen-scraping integrations are explicitly allowed. Not sure how common that is at this point.

Thousands and thousands of institutions, they scrape.

Not sure what you mean specifically, but generally the organisations doing screen-scraping¹ would prefer to use compliant APIs as they don't require anything like as much maintenance (bank adds a button to the login flow? Kaboom! Integration is broken...) or resources (e.g. running headless browsers).

Some markets are pretty much exclusively compliant - I don't think there are any Nordic banks that don't have fully PSD2 compliant APIs for example whereas, if I remember rightly, the Spanish banks were all over the place. I'm fairly out of date though, so things may have improved or exceptions for scraping expired.

¹ Note that I'm talking exclusively about banking integrations here, not AI nonsense.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#248

Post by sigwinch »

mobiuscog wrote: post #246
cameronh90 wrote: post #244

Earlier quoted context omitted.

It’s a trade-off. Most people are never going to check the links no matter how much you ask them to, and even if they did they wouldn’t know what to check for. But the tool Microsoft give you to check a link before opening it is that awful URL rewriter, which prevents the small minority who would check from being able to. Similarly those flashing cmd windows are usually automatic update processes that Windows has no…

There is an easy answer. Give employees two computers. One is the 'business' one. Mostly locked down, with checks in place. The other is on a different network, isolated from all business functions, and they can do what they want but must never use it for work data, just like their phones (that everyone knows they use for social media etc. in the day). Sure, you still have to deal with copying from one to the other (…

Just call one business internal and the other one LLM inference. You don’t want AI crafting packets on business internal.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#249

Post by Workaccount2 »

cameron_b wrote: post #241
Workaccount2 wrote: post #237

Earlier quoted context omitted.

My It department does mandatory phishing training every year, and then for the "test" e-mails, they spoof a domain and whitelist the DMARC on their side so it goes through. So we get e-mails from @microsoft.com and it's only if you dig in the metadata that you see it failed authentication. The only tell in the e-mail is checking the URL, which doesn't tell you much because tons of regular e-mails use tracker redirect…

Hey, simulating the hack is a lot better than using some canned tool with blatant knowbe4 urls.

The problem is that if you click one of the links, you need to do (well sort of) the hour long phishing class and testing again. But of course, nowhere in the class do they say anything about not trusting e-mails from a known safe domain.

Whats funny though is that if you click the link in a phishing test, they will e-mail you to complete the training. But there is no enforcement (general management doesn't care), so you just get a daily e-mail telling you that you are overdue. It also however stops them from sending the fake phishing emails. So a bunch of us clicked the phishing link, marked the "do your training" e-mail as spam, and now never get bothered.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#250

Post by dweekly »

mobiuscog wrote: post #246
cameronh90 wrote: post #244

Earlier quoted context omitted.

It’s a trade-off. Most people are never going to check the links no matter how much you ask them to, and even if they did they wouldn’t know what to check for. But the tool Microsoft give you to check a link before opening it is that awful URL rewriter, which prevents the small minority who would check from being able to. Similarly those flashing cmd windows are usually automatic update processes that Windows has no…

There is an easy answer. Give employees two computers. One is the 'business' one. Mostly locked down, with checks in place. The other is on a different network, isolated from all business functions, and they can do what they want but must never use it for work data, just like their phones (that everyone knows they use for social media etc. in the day). Sure, you still have to deal with copying from one to the other (…

Your "crazy" proposition is exactly the reality at many companies: the work computer is increasingly isolated from the Internet. At my last employer their game plan for employees was to move the whole web to a whitelist approach - if you want to browse the web freely, use your personal computer or personal phone.

So most of us carted around a work laptop (connected to corp WiFi) a personal laptop (on guest WiFi or tethered) a work phone and a personal phone.

In other news, you should never ever MDM enroll your personal phone with a work BYOD policy.

Post reply on HN