41–50 of 160 posts
The guys handling security for Oxford are highly experienced and capable. Oxford's network is far more complicated than a typical University.
Earlier quoted context omitted.
Network Admins need to learn that looking at what your users do and meddling with his data is not a legitimate activity. They should have learned that long ago. Fortunately, with encryption becoming more widespread, they will have to learn the lesson.
The quote continued: "That’s easy with unencrypted traffic. If the site uses SSL, then you have to do some kind of SSL interception. Straightforward on a corporate network full of tightly-managed systems. Much harder on a network full of student machines, visitor laptops and the like, and in our opinion, something to be avoided. " Obviously, they do not see intercepting traffic as desirable. But who has time to read…
From a read through of the Wikipedia article on SSL it's now clear to me that all HTTP headers are encrypted, including the requested path.
So if the real problem stems from the Oxford mail accounts being hacked and then used to propagate the phishing attacks, why not concentrate on that?
You should use 2-step authentication for the email accounts, so that randoms in some other part of the world can't just hack in to an email account and use it.
I was at SBS, and we were on Mircosoft Exchange servers for email I think. Unfortunately, afaik Microsoft doesn't offer 2-step authentication. Instead of blocking Google Docs, you should be moving all email systems to Google Apps so you can use their better security. We just did it at my company for a few thousand users and several domains - I think you could do it too.
Summary of the blog posting: Google Docs forms are being used in phishing attacks against stupid users. We closed down Google Docs. It didn't work and we had to open it up again after 2.5 hours. Unfortunately, there's no easy solutions to so-called phishing attacks other than educating users. I would recommend that the IT dept. dedicate its considerable resources and creativity to that end, and try to minimize use of…
The only effective solution is to educate users, but that in itself is a difficult task.
Phishing attacks rely on users being gullible / distracted / ignorant. Telling users _not_ to be any of these usually results in angry answers such as "Are you implying I am stupid !?", and the important part of the dialogue where you explain things to be wary of is completely ignored.
Another way to communicate these things it to _phish your own users_. Email them a fishy message ultimately asking them their password for instance, the same way an attacker would. Of course, some phishing emails / sites look incredibly legit but in my experience most have noticeable deficiencies. If your users can spot at least those, then they can protect against a good number of attacks. Once the victim falls for the trap, redirect them to a page explaining how they were tricked, and showing what they need to pay attention to.
You even get their passwords, so that you can do some analysis and see how many will change it following the 'incident'.
[deleted]
Why don't they block Microsoft Outlook? I'm sure a lot more scams come through it.
Here's what's next: Oxford blocks roads because criminals are using roads. Oxford blocks food deliveries because criminal are using restaurants to eat.
Seriously now: what's the Microsoft rebate Oxford got for taking such a measure?
I wonder how many of the keyboard warriors in this thread have any experience of running very large and incredibly diverse networks like Oxford University's. The guys handling security for Oxford are highly experienced and capable. Oxford's network is far more complicated than a typical University.
As others have pointed out, there are a few very simple ways to deal with this sort of thing. Rate limiting alone would like take care of the problem. This is probably a simple config update on the smtp server.