[deleted]
Snapchat Employee Data Leaks Out Following Phishing Attack
31–40 of 62 posts
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#32[deleted]
[deleted]
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#33Earlier quoted context omitted.
isn't this what DKIM and SPF and all those fancy email security things are for?
An attacker-controlled domain, say snaapchat.com, can pass DKIM, SPF, and DMARC if configured appropriately.
Better solution is to append a warning to any message that originates outside the domain.
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#34Sadly these spoofed emails from high ups are becoming all too common. Shameless plug - if anyone is in need of an open source phishing training solution, I recently launched gophish to great feedback so far, and have a new version being dropped early next week: https://getgophish.com . Everyone should have access to training to prevent this as much as possible.
Feedback. I can't get much from your screenshots since I can't expand them and they are too small to read anything. I don't know what a "simulated phishing campaign" is, what results I might get out of it, I just don't really understand the whole purpose / process, and you don't any info other than the phrase "simulated phishing campaign" to explain what the thing does. So, I can create simulated phishing email, I can see who opens them. I can do this easily. But we're missing something. What does a simulated phishing email accomplish? What does a user get out of it? What would one look like? When would I send one?...
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#35Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us. Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address? I bet I wouldn't, and I'm…
Do you have access to data that would cause a news story if you sent it to the wrong person? If yes, then yes, verify it before sending. Also, spoofing an email address wouldn't help. If you respond, it will go to the spoofed address, which is the correct one. They need to send it from their own email address, which means that you only need to verify that it's send from your manager's address, or just manually send i…
It's likely that their SMTP server accepts messages with an SMTP "MAIL FROM" command and/or "From" header address that belongs to the company's own domain without requiring authentication. The attacker then adds a "Reply-To" header so that replies will be sent elsewhere (likely a throwaway free email account).
This shows up in email clients as "From: legit.name@example.com". When the recipient replies, they don't notice that they're sending a reply to a different address than the one their client claimed was the sender of the original message.
Receiving SMTP servers need to be configured to require SMTP authentication for messages claiming to originate from the company's own domain.
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#36Sadly these spoofed emails from high ups are becoming all too common. Shameless plug - if anyone is in need of an open source phishing training solution, I recently launched gophish to great feedback so far, and have a new version being dropped early next week: https://getgophish.com . Everyone should have access to training to prevent this as much as possible.
Feedback. I can't get much from your screenshots since I can't expand them and they are too small to read anything. I don't know what a "simulated phishing campaign" is, what results I might get out of it, I just don't really understand the whole purpose / process, and you don't any info other than the phrase "simulated phishing campaign" to explain what the thing does. So, I can create simulated phishing email, I ca…
Great feedback, thanks! We're working on a new landing page that hopefully shows this in action a bit more, as well as provides a bit more information on why you might want to use gophish and when.
I'll keep this feedback in mind. Very helpful!
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#37Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#38Earlier quoted context omitted.
Do you have access to data that would cause a news story if you sent it to the wrong person? If yes, then yes, verify it before sending. Also, spoofing an email address wouldn't help. If you respond, it will go to the spoofed address, which is the correct one. They need to send it from their own email address, which means that you only need to verify that it's send from your manager's address, or just manually send i…
It's likely that their SMTP server accepts messages with an SMTP "MAIL FROM" command and/or "From" header address that belongs to the company's own domain without requiring authentication. The attacker then adds a "Reply-To" header so that replies will be sent elsewhere (likely a throwaway free email account). This shows up in email clients as "From: legit.name@example.com". When the recipient replies, they don't not…
> Receiving SMTP servers need to be hardened to require SMTP authentication for messages claiming to originate from the company's own domain.
Or validate SPF / DKIM and enable it for their own domain.
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#39So this looks like HR or someone from inside snapchat got a phishing email and happily obliged and sent off a bunch of sensitive information without confirming that it should all be shipped over (unsecure) email. I do work for some higher ed institutions, and almost every year without fail we have seen (and dealt with) successful phish attempts of various staff members... it's usually something small like a credit ca…
Social engineering attacks will probably be a thorn in security's side for a very long time, if not indefinitely... There's a sort of fundamental disconnect inherent in "Trust the system! It's secure! Except be careful because sometimes something that is not the system will pretend to be the system..."
We keep treating falling for phishing emails as a user error. But, perhaps, having our most "official" means of communicating online (email) be a protocol that has no identity verification, no authentication and no encryption, is actually a technical bug, not a human one.
I mean, you would expect that we should at least be able to tell that if you get a x@snapchat.com email in your y@snapchat.com inbox, it actually came from x who works at Snapchat. However, that is (in general), not how email works, for some reason (yes, I know, ancient protocol, tons of stakeholders, identity is hard, but come on...).
Re: Snapchat Employee Data Leaks Out Following Phishing Attack
#40> Snapchat isn’t being too specific — this is sensitive — but payroll information could include salary data, social security numbers, bank details, addresses, emails and other personal ID which, in the hands of the wrong people, could create headaches for those affected.
The scammers asked for W2 tax forms. They use this to collect your refund. This has happened to dozens of startups in LA, among other businesses, ironically the ones which have HR departments.