Forgot your password?
typodupeerror
Security Education

RSA: Phish Me If You Can (Video) 171

Posted by Roblimo
from the hooks-often-lurk-inside-the-tastiest-bait dept.
Spearphishing. The deluxe (but easy) way to get unwary employees to put malware on your network. It's basically the same as phishing, except more targeted. That is, a plain phishing scam might offer an unwary web-browsing employee a chance to see a famous starlet naked, while a spearphishing attack might purport to be an urgent request from your Bizzaro County office for 200 Kg of Unobtainium Oxide. Open that email, and... ZAP! So this is social hacking (cracking for the old-timers), and cannot necessarily be fought entirely by technical means. So how about setting up fake spearphishing attempts and immediately sending employees who fall for them to an IT security class with an emphasis on how to avoid phishing scams? You can do this yourself, possibly with help from a bright person or two from a nearby University. Or you can contact PhishMe or another anti-phish training company and have them help you teach spearphishing awareness to your people. Either way, every computer-using person in your company should know about phishing -- and should know how to avoid getting hooked by phishers.

Tim: Aaron, could you introduce yourself please?

Aaron: Hi, my name is Aaron Higbee. I'm Co-Founder and CTO of PhishMe

Tim: Okay. Now explain PhishMe. It is a funny name.

Aaron: So every organization is worried about getting spear phished. So we provide a software-as-a-service that allows organizations to send real mock spear phishing emails to their employees and as soon as they may fall victim to one of our emails, they are immediately funneled to training about why you need to be worried about this, why people are targeting you at work, and why a spear phishing email at work is a little different than the phishing email you get at home.

Tim: So walk me through this a little bit. They are at their desk, they open their corporate Gmail or their corporate email account, and what happens?

Aaron: Well, there is a variety of things. An attacker might be motivated just to send them a malicious link and hope to take them to a website that is booby-trapped with malware. They might put together a lookalike website that is trying to solicit credentials to get them to log into a fake website. Or they might be including a malicious attachment where the payload is embedded in the attachment and trying to get them to do that.

Tim: How far do you let people go before you let them in on the game?

Aaron: We do it right away. The value in this is the experience, and the person realizing that, hey if they are not vigilant, if they are just mindlessly clicking through emails as fast as they can, they can be victimized by this. And that there really are people out there. So we want to funnel them into the training and awareness portion of it right away, to close out the example, to let them know that this wasn’t to make fun of them, to make them feel bad

Tim: It sounds like it could be embarrassing.

Aaron: Right. We just were trying to empathize and let them know that this was designed to help you get good practice on identifying and spotting this.

Tim: Now you have it for spear phishing specifically over email.

Aaron: That’s right.

Tim: There a lot of threats though over various social media, over Facebook, they can get their account hacked, and send messages through that. Are you addressing things like that yet?

Aaron: Yeah, we are still focused I mean this is the number one attack vector, if you read the recent APT 1 report by Mandiant, they said spear phishing is the most prevalent, aggressive way that people are trying to get in. But I do keep up on those trends. Google was compromised via an instant messaging vector and so that’s interesting to me and I try to keep on top of that.

Tim: The malicious messages that people get, they’ve evolved over the years. I know the ones I get certainly have changed, and now there is something a lot more competent sounding than they used to be.

Aaron: Sure, sure. They might have researched you, they might know your interests, but there are certain emotional triggers that are going to be in all of these emails. And it is up to us as humans to figure that out. They are either going to be baiting you with curiosity, with fear, with a reward, one of those triggers. And if you look at it, and you see the sense of urgency in the email, you should have some spidy senses that tingle that say, wait a minute, I need to spend a little bit more time, this might not be legitimate.

Tim: Now do employees know in advance that the system is even in place within their company?

Aaron: Sometimes they do, sometimes they don’t. Because we are a software-as-a-service, organizations choose to run their PhishMe program anyway they like. We encourage that. We tell people that they should be upfront with their staff to let them know that the purpose behind this isn’t to make fun, or belittle anyone. And that we are going to be doing this for the next 12 months to give people experience in spotting and identifying these.

Tim: Now how long has PhishMe been around? Where did it come from? Is this academic research or?

Aaron: So where PhishMe came from was, I used to be a pentester, and I did a lot of pentesting work, and I noticed in about 2005, the way that attackers were getting into organizations was starting to shift towards spear phishing instead of your traditional vulnerability scanning and finding some vulnerable service to compromise. So I started offering this as a pentesting service, and in about 2006 and 2007 that light bulb went off where I realized I am actually damaging a valuable teaching opportunity, that the way to correct this is through user awareness education. That the attackers are always going to come up with some new technical tactic, and so we really need to focus in on the social and the human aspect to go after this problem.

Tim: Speaking of the way the stuff has changed, what have you observed about that? What are the trends you see in how have the spear phishing things have changed?

Aaron: Well, one of the things that we’ve noticed is when an attacker is going on a spear phishing campaign, two to three years ago, they would lob in one or two emails to certain employees inside the organization, and they would wait to see if they would respond. What’s happening now is they are sending batches of 10, 20, 30, or 50, because they know those emails are getting analyzed and they know that the command and control infrastructure that the malware connects to is going to be burnt. It is not going to be _____4:59. So they are being a little more tenacious about the volume that they are sending in, which is good; that means some of our preventative technology is working, and also that means user initiative reports are valuable, because now they are going to be sending more of these emails into the organization.

Tim: It gives you a bigger corpus to write your own too.

Aaron: Sure, sure. We are building our human sensors to help fight this problem.

Tim: And who are your customers?

Aaron: Anyone that has been in the news, that has a spear phishing breach, it is likely that they are one of our customers. Our customers are people that have bought all of the technological solutions. They have good information security practices. Yet people are still getting in. And they are frustrated by this. And they want to change. And so if you look at who are the big targets of spear phishing, it is the people that you would imagine, the financial, the government contractors, the oil and gas industry, manufacturing, anyone that has got intellectual property to protect.

Tim: And you are based in Northern Virginia, so that gives you a pretty good access to the various hackable governmental offices there?

Aaron: Yeah, absolutely. I have some interesting lunches with my colleagues in Northern Virginia, and there is always some spear phishing incident that we are talking about that has come up.

Tim: Now Aaron, have you ever personally been tempted or actually clicked on a spear phishing link?

Aaron: You know I might have. Given the nature of our business, we know that we are targets. It would be good bragging rights to be able to phish someone here. And it has changed the way that we do business. Email is not really a very useful tool to us. We have to use a lot of other collaborative software and other internal tools in order to get work done and anytime something comes in to email, we have this very strict process on what we do before we interact with it. I don’t think anyone in my company would say, we are impervious to this. We know that this is a human condition. People can make mistakes. And that is one of our training messages, is even if you did something, and you have that uneasy feeling afterwards, that this might not have been legitimate, it is still something that you need to report to your IT department. Maybe it was benign, maybe it was okay, but it still should be reported as soon as you have that uneasy feeling.

Tim: Anything else you want to tell us about? You mentioned something to me earlier about your Slashdot effect.

Aaron: Oh okay. So we try to offer PhishMe as a true-to-life example. So we send spear phishing emails from the internet, our spear phishing websites are hosted on the internet, and our customers want to make it accurate, but they also want it to be contained. So they don’t want a situation where an employee receives one of our training emails and then forwards it to Slashdot, hey look what my employer is doing to me. So we actually designed our phishing pages to self-destruct. So that we don’t get on the cover of Slashdot.

This discussion has been archived. No new comments can be posted.

RSA: Phish Me If You Can (Video)

Comments Filter:
  • LOL (Score:5, Insightful)

    by Anonymous Coward on Wednesday March 06, 2013 @03:37PM (#43096219)

    Your daily Slashvertisement brought to you by Dice Holdings, Inc.

    • by i kan reed (749298) on Wednesday March 06, 2013 @03:45PM (#43096317) Homepage Journal

      It's the fact that they treat us like eager morons, who won't recognize it. I mean the signs are dead simple.
      1. Mentions a particular company by name.
      2. Includes at least one buzz-word.
      3. Entirely positive language.
      Regular Slashdot stories pretty clearly have signs of concern or raise questions about their subject matter. These bare-naked slashvertisements are insulting. If you're going to be blatant, please fucking acknowledge that it's sponsored in the summary.

      • by ShanghaiBill (739463) * on Wednesday March 06, 2013 @04:00PM (#43096497)

        I mean the signs are dead simple.
        1. Mentions a particular company by name.
        2. Includes at least one buzz-word.
        3. Entirely positive language.

        4. Pushes a stupid and unnecessary product or service.

        Instead of training your staff not to open phishy emails, just ban any email client that allows execute-on-open.

        • 4. Pushes a stupid and unnecessary product or service.

          Instead of training your staff not to open phishy emails, just ban any email client that allows execute-on-open.

          Wow. You know how you can tell that the comments are being modded by people with a vested interest in the ad? Your comment was on-point and provided an alternative and is still getting modded down. Way to go, /. You bastards.

        • by PCM2 (4486)

          Instead of training your staff not to open phishy emails, just ban any email client that allows execute-on-open.

          I'm not sure that's the main problem, actually. Where spear phishing is concerned, I mostly hear about emails that are crafted to look like legitimate messages from companies like banks, FedEx, etc. If you can convince someone to click through to a website, it's not hard to ship them malware -- particularly if they have the Java plugin enabled.

      • by Peristaltic (650487) * on Wednesday March 06, 2013 @04:07PM (#43096559)
        Same old shit. Disconnected suits, demanding more revenue, institute this kind of crap and gradually push away the users whose participation made /. a valuable site in the first place. If it gets worse, a site will eventually pop up that fills the niche left behind by /. Once the -new- one becomes valuable...... Around and around we go, ad nuaseum. In the meantime, before the new site has enough users / inertia, we're stuck with more and more "articles" like this one, which really should not have been put in front of this readership.
      • by i kan reed (749298) on Wednesday March 06, 2013 @04:08PM (#43096581) Homepage Journal

        I THINK THE EDITORS ARE MODERATING CRITICAL COMMENTS DOWN!!!
        I got 5 troll mods in a matter of one minute, making a pretty reasonable post(I thought).

        I thought it was bizarre the GP got modded down once, but I really think Dice. is modding the fucking comments.

      • by admdrew (782761)
        Great job, mods. This is definitely NOT a troll post.
        • And I don't think it was the people with mod points changing it. I had +4 about a couple minutes ago. That screams editor control. They don't even want the idea of it being a advertisement discussed.

          • by Synerg1y (2169962)

            Slashvertisement or not, I've noticed the past couple months a large decrease in the / stories i bother to read and post to, the ones that looked OK... weren't worth reading TFA for, and yet others had shitty discussions going on. It seems like i didn't post for a week and came back to a bunch of moronic posts & news stories that were biast, irrelivant, or just plain out boring. Oh well, I think this article is more or less about a technique you can implement yourselves presented as an advertisement m

      • Replying to my own post a lot, but it's nice to see it back up to +4(and the parent back up too). I checked and the 5 troll mods are still there, so in spite of someone trying to bury it, slashdot moderators aren't that stupid. Thanks you guys.

      • by hairyfeet (841228)

        Not to mention their entire company is based on a STUPID IDEA that has NEVER worked. i've been building and selling PCs to SMB and home users for 25+ fricking years and I can tell you that EDUCATION WILL NEVER WORK when it comes to stopping threats, why? Because like real life viruses they mutate and common sense is not teachable, either you have it or you don't.

        Here is a perfect example...smartphones. think Android is well on its way to a million infections because Google didn't make a good OS? Nope its th

        • by pnutjam (523990)
          I disagree, people learn it just takes time and it is a frusterating experience that leaves many burnt out hulks behind. My condolensces, but this is that same us against them mentality that we complain about with cops.
        • by Gulthek (12570)

          You're right. Education in a formal setting simply doesn't convert to practical knowledge. That's a method best left to theoretical subjects.

          But you're going to have a tough time arguing that *training* doesn't work: which is what PhishMe is selling. Teach employees to recognize phishing emails by actually sending them inoculated phishing emails. When employees fall for it you let them in on the game immediately and seize that invaluable teachable moment.

          • by hairyfeet (841228)

            But unless they are gonna "train" them for life? the first new mutations they will be right back to square one. Believe me I know, you only get 2 outcomes when you try teaching someone who just wants to use the PC and go the hell home (as opposed to us geeks that actually care for the medium) and that is either only remembers long enough to follow basic instructions, which means like i said if the prince is from Somalia you warned them against Nigeria and that's TOTALLY different, or you get so paranoid the

      • by Midnight_Falcon (2432802) on Wednesday March 06, 2013 @06:07PM (#43097891)
        Amen to this. IT professionals get enough cold calls, account managers doing "account reviews" (sales calls), and the like already. They often are people who like advertisement the least and believe they are smart enough to make their own decisions on vendors without being swayed.

        That's why ads written like a PR News story posted on Slashdot are insulting to us -- it's obviously an ad, but it's not labelled so. They no longer label the author as associated with Dice Holdings, so it can be passed off as legit news. It also can't be blocked by ad blocking software or the "disable ads" button that appears as a thank you for positive contributions.

        On top of that, they are using the moderation system to mod down complaints about this unscrupulous practice.

        This is part of the growing trend of stripping content that users want in favor of content that pays the most money to the site's publisher, the same thing folks like Facebook are doing in activity feeds. Monetizing the site at the expense of the experience of the user. How long can this trend continue before users have had enough?

      • Yeah, and while we knew there were a bunch before, I think we're def. seeing Dice's hand in all this.

        The other posters are right about the shift to video, and Roblimo, who really was off the radar until last month. Here is a Reuters article describing specifically how this company is a spinoff of some other one a couple years ago. So yes, it's absolutely a Slash-vertisement. http://www.reuters.com/article/2012/03/20/idUS120683+20-Mar-2012+BW20120320 [reuters.com]

        Besides your heuristics, let's go even farther. It's these

  • Open an email (Score:5, Informative)

    by Nerdfest (867930) on Wednesday March 06, 2013 @03:41PM (#43096251)

    Open an email? You mean text? Not really a problem. if you're not blocking images and JavaScript, you're headed for trouble, targeted or not.

    • Re:Open an email (Score:5, Insightful)

      by cusco (717999) <brian.bixby@NoSPam.gmail.com> on Wednesday March 06, 2013 @03:50PM (#43096371)
      In network security, just the same as physical security, the main problem is not the hardware or the software, it's the wetware.
    • by smoothnorman (1670542) on Wednesday March 06, 2013 @03:53PM (#43096401)
      my thoughts nearly exactly! "Open that email, and... ZAP!" what sort of lame mis-managed system is that true of?
    • by nuckfuts (690967)

      Many corporate users use Outlook. When viewing (or previewing) HTML-formatted messages, it uses the same rendering as Internet Explorer, and is thus susceptible to the same vulnerabilities.

      I can remember a happy time when I could tell people with confidence "you'll never infect your computer by merely viewing an e-mail". Or a JPG. Or a PDF. Or ...

      • by Gulthek (12570)

        Yes exactly! The sheer number of exploit hooks into even modern/patched operating systems is simply depressing.

    • by Sloppy (14984) on Wednesday March 06, 2013 @05:24PM (#43097411) Homepage Journal

      Text email is vulnerable too! I'm in the habit of: after reading every email, I save it to malware.sh, then I go to a shell, type "chmod +x malware.sh" and then either "./malware.sh" or "sudo ./malware.sh" depending on the flip of a coin. And in spite of my weird habit of doing this, I never check to see who sent me the email and whether or not it's PGP signed and if their signature checks out.

      See? Spearphishing is a really hard problem to solve! Reading email is dangerous! DAAANGEROUSSS!!!!11

  • by pclminion (145572) on Wednesday March 06, 2013 @03:45PM (#43096303)

    The problem is 100% technical. How could viewing an email ever result in malware being installed? Somebody failed -- they're called the IT department.

    • by h4rr4r (612664) on Wednesday March 06, 2013 @03:51PM (#43096387)

      Yeah, they failed when they let you have admin on your pc. They failed when they did not enforce updates. They failed when they let you run a vulnerable email client.

      Yet, if they don't let anyone have admin, ban outlook from the network and force updates and reboot that come with them you would be bitching up a storm.

      • by djsmiley (752149)

        Yup, it's never the management who insist on having outlook because "thunderbird doesn't work correctly".

        • by khasim (1285)

          If they insist on it AND your manager cannot shield you THEN it might be time to look for a different job.

          In the meantime, make sure that those are fully patched AND monitor them (and firewall as much as possible) because they WILL be cracked, eventually. Although you should be doing this for all your systems any way.

          And keep looking for a better job.

        • OK, I'll bite. Have you ever tried to embed a table pulled from Excel into an email under Thunderbird? Nothing fancy, just a 3x4 grid with some numbers on it.
          Let me know when you succeed in sending it in a viewable format.
          (probably the best way to never hear from someone again)

          • by h4rr4r (612664)

            1. See the other reply, it works
            2. DO NOT FUCKING DO THAT. Email is a text transfer mechanism. Attach documents to that, not attempt to put formatting in the email.

            • Tell "DO NOT FUCKING DO THAT" to that VP who wants that useless data in THAT format, in HIS inbox, NOW.
              I love it when people just live in la-la-Land and tries to adapt people to software instead of the other way around.

              • by Cerium (948827)

                Those same VPs are the types that demand all sorts of stupid shit if they think it gets in the way of how they feel things should work.

                They're the problem. They're the exact reason training never works, because even if you explain the problem to them, they demand that you work around their shortcomings, because fuck you, why should they change to solve your petty problems, asshole.

                People who are receptive to any type of training like what's being blatantly advertised to us here or what the GP is talking abo

                • Um, no, while those VPs certainly have their share in the general stupidity, it's the clueless Average Joe who usually does that. For each "retarded" VP (in a true IT sense) there's a thousand "retarded" Average Joes (And Janes).

              • by h4rr4r (612664)

                You show him a better way.

                All he is going to do is end up with an email that can't be sent since it is 100MB and even if you change your mail server setting to allow it no other mail server will ever accept it.

    • by DarkFencer (260473) on Wednesday March 06, 2013 @03:56PM (#43096449)

      Its rarely about just opening an email. Its about opening attachments in that email, or opening links that lead to sites with malware. There have been enough vulnerabilities (OS, Adobe, Java, etc.) that have been around which don't require any special privileges. Just a user to click through warning prompts.

      It cannot be solely IT's responsibility - especially in this day of BYOD (Bring your own device). IT isn't always able to remove admin privileges from corporate/organization owned computers - much less the Sales guy's personal laptop.

      • by pclminion (145572)

        Its rarely about just opening an email. Its about opening attachments in that email, or opening links that lead to sites with malware.

        Why are you not stripping attachments from external email? Or are you arguing that stripping attachments isn't a technical measure?

        Think about how phishing works. They are trying to get you to open at attachment, or visit a resource which is fake (could be a URL, phone number, etc.) So strip attachments and resource identifiers (URLs, phone numbers) from external email. Pro

        • I'm sure the Sales people will be very happy when they receive an e-mail saying "amended contract" with zero attachments. Oh yes.

          • by pclminion (145572)

            I'm sure the Sales people will be very happy when they receive an e-mail saying "amended contract" with zero attachments. Oh yes.

            Right. Because there's no sort of technology that could apply different policies to different people... We all know computers can't do shit like that.

            • You haven't worked with Sales people before, I presume. It's okay, you're one of the happy ones, good for you.

    • No, the failure is in the design of an email client that favors whizzo shit that looks great in a 30-second demo from the stage of a developers conference over practical security.
    • by Gulthek (12570) on Wednesday March 06, 2013 @04:17PM (#43096677) Homepage Journal

      This is what passes for +5 insightful these days?

      The issue isn't opening an email: but clicking a link in that email or, worse, clicking a link that takes you to a legitimate looking site and entering data, or opening an attachment in a legitimate looking email.

      There are all sorts of attack vectors present from an email message. To sweep it all up as "IT's Problem" is a very, very bad idea. It just takes one email fooling the right person to be a security problem.

      PhishMe's philosophy is that at some point the technical protection will fail ... so you'd better ensure that your employees know what to look for. The best way to teach them what to look for is to let them actually experience safe emails using the same techniques that would be maliciously used against them.

      Spear-phishing isn't an idle threat, it's a widely used attack method that has gotten data out of targets like the New York Times, Defense Department, Facebook, and Apple (http://www.theatlanticwire.com/technology/2013/02/spear-phishing-security-advice/62304/). I'm sure that each of those companies has a very robust and capable IT Department armed with email scanning and sanitizing software. You just can't catch everything with technology.

    • by sl4shd0rk (755837)

      How could viewing an email ever result in malware being installed?

      Tee hee.. You must not be old enough to remember Outlook or Excel Macros.

      • by pclminion (145572)

        Tee hee.. You must not be old enough to remember Outlook or Excel Macros.

        I'm old enough to remember the Stoned virus. Anyway, how are incorrectly implemented security models in crappy products the user's problem? Why don't you give the user software that isn't full of holes?

        • by admdrew (782761)

          There don't have to be software "holes" or bad security models for malware to get through; users are always the lowest common denominator, and given they're cross-platform, it can be very advantageous for bad guys to target the user over specific technical systems.

          And generally, effective user education is a great additional layer of security. Not sure why you're 100% blaming IT [slashdot.org].

    • by Roblimo (357)

      The main proof that this is a slashvertisement seems to be that Roblimo didn't mention wombatsecurity or other ways to teach fellow employees how to avoid spearphishing attacks. How dare he not!

      Except.... I did!

      What does that tell you about the conspiracy yowlers?

      They're kind of fun, aren't they? :)

      - Robin

  • I guess the years have accumulated and I'm now and old timer but I don't see how that's cracking by anyone's definition.

    • by Fjandr (66656)

      Seeing if anyone mentioned that little bit of stupidity is the only reason I bothered to open this "story."

    • by Gulthek (12570)

      Back in the day we were trying to get any exploitative hacking to be called "cracking". Note Jurassic Park's "I prefer to be called a hacker." line.

      It didn't take completely. We got "hacking" to be relatively accepted into the mainstream vernacular but "hacker" remains in a kind of grey area and "hacked" is entirely negative.

  • by undeadbill (2490070) on Wednesday March 06, 2013 @03:47PM (#43096339)

    Lol, that one always works, and even though it is clear it doesn't need to be clicked, they click it anyways... I got to use that one when the Melissa virus was blocked based on the subject line "I have an attachment for your review", rather than on matching the payload of the email attachment. I made $5 on a bet with the Exchange admin, and got to watch hilarity ensue at the Exchange admin's desk when 40 hungry developers showed up, wondering why there was no free lunch and their Outlook clients were taking up all of their system resources.

    • by PPH (736903)

      That's just the boss, trying to round up some candidates for his Amway pitch.

      I always delete all e-mail that claims to be from the boss. Now, thanks to PhishMe, I can claim to have been ahead of the curve fighting spearfishing all these years.

      I deserve a raise.

  • So how about not running software vulnerable to malware?

    • If only that were feasible. Unfortunately, we have created a septic environment and the only way to be sure of staying clean is to live in a bubble.

      Not that I'm excusing the irresponsible decisions that are routinely made over security issues. That's how we got into this mess in the first place - one small, dumb step after another.

      • I won't say that Linux (which is what I run) is completely safe, but it's far, far safer than Windows is. That's not to say that everybody should be running Linux, but that everybody who runs Windows should be asking Microsoft why Windows is so vulnerable.
        • This may off-topic, but by 'septic environment', I was also thinking of the fact that we have to live with the bad decisions of businesses and government agencies that we have to deal with.

  • by mrbene (1380531) on Wednesday March 06, 2013 @04:04PM (#43096535)

    Three videos posted over the last couple of days - all of which purport to provide insight, at least in summary. I've not made it through more than a few seconds of each since there is excessive background noise.

    Use a more targeted mic? Do some post-processing? Find a quieter room to interview your subject in? Provide a transcript?

    Otherwise, it's just a waste of effort.

  • by Todd Knarr (15451) on Wednesday March 06, 2013 @04:07PM (#43096563) Homepage

    When setting up a test like this, first look at the legitimate e-mails sent around your company. If your business routinely circulates e-mails containing attachments employees are expected to open or links they're expected to click on, then ask yourself why you've got an overlap between what you expect employees to do and what you want them to not do. If you expect employees to check addresses but your e-mail client hides addresses, ask yourself why you're hiding what you want recipients to check. If you're having to ask those kinds of questions then the first problem you need to address isn't employees being vulnerable to spearphishing attacks, it's your internal e-mail culture and standards that make those vulnerabilities normal and expected.

    Expect a lot of resistance to fixing these things. Not from your regular workers, from the upper layers of management who like these things because they make life easy and look "Oooh, shiny!".

    It's a lot like physical security. You can emphasize it all you want, but when managers get angry at employees who closed the door in the manager's face forcing them to use their own key you will not get employees to stop letting people tailgate through doors.

  • by DontBlameCanada (1325547) on Wednesday March 06, 2013 @04:09PM (#43096597)
    I got duped into clicking the story thinking it was a legitimate article. Instead I got a slashvertisement... ./suckered
    • by i kan reed (749298) on Wednesday March 06, 2013 @04:17PM (#43096681) Homepage Journal

      I'm watching this thread to see if you get modded down. I think they've gone as far as telling editors to mod down those who point out it's a slashvertisement. Regular mods never mod down this far down in a discussion, so I'd like to see if my hypothesis is substantiated.

      • by admdrew (782761)
        I wrote a fair/neutral email to Roblimo (roblimo@yahoo.com) asking why his posts are so outside the rest of the /. paradigm, then forwarded it to other mods, Soulskill, Timothy, and Unknown Lamer (I should've sent it to all of them initially, but just didn't think of it). Wonder if any of them will actually respond.
        • Since editors are payed employees, I can't imagine the others don't know what's going on. Whatever it is, they don't seem intent on telling anyone.

        • by Roblimo (357)

          Here's the email exchange between admdrew and me:

          From: Andy George
          To: roblimo@yahoo.com
          Sent: Wednesday, March 6, 2013 3:09 PM
          Subject: Your Slashdot submissions

          Hi,

          Why are you the only Slashdot editor that submits your own content, instead of submissions from readers? It's like you're treating Slashdot as your marketing blog, which only serve to degrade the quality of the site. I'm a long-time reader and commenter who has never seen this level of consistent slashvertising before.

          -----

          I'm paid by the hour to

          • by admdrew (782761)
            ...and my response below, since we're being so transparent today (although it feels in bad taste for you to have published my full From common name from my original email to you):

            Robin,

            Thanks for your response (I found your yahoo email just off of a whois of your main domain).

            Your posts aren't marked as paid ads, but they're consistently construed as such by /. commentators, which is certainly of note.

            The thing that many Slashdotters may be missing (I certainly did) is that you're not an official /. e

          • by admdrew (782761)
            Wow, I totally didn't read the whole of your comment, I assumed you actually copied our email exchange verbatim. Here's your ACTUAL response to me:

            I'm paid by the hour to edit and post videos that are mostly shot by Tim Lord.

            None of them are paid ads.

            I don't get paid nearly enough to do the evil you seem to think I do.

            BTW, my real, daily-read email address is robin@roblimo.com.

            I only read this because you mentioned it in a comment on /.

            Thanks for your input,

            - Robin

            Why did you put that alter

            • by Roblimo (357)

              Whoops!- Guess when I hit Ctrl-C I hadn't highlighted the entire email - was in a huge rush. Sorry.

              I know it's always fun to imagine a conspiracy, but I was rushing to meet a friend and carpool to a LUG meeting. Back now. :)

              • But what's with all of the down-voting on comments on the "key caps" article that dared to ask if the article itself was a slashvertisement? There's something bizarre about 13 out of 19 comments being down-modded to (-1) scores so rapidly, particularly when some of the were obviously not troll postings but merely questioning the usefulness of the article itself.
                .
                http://it.slashdot.org/story/13/03/04/1721233/rsa-from-apple-keys-to-biometric-security-devices-video [slashdot.org] Especially the comments by RocketRabbit.
                • by Roblimo (357)

                  I have no idea. I did my editing & upload task and moved on to write a Cheap Computing [techtarget.com] column or something else not related to Slashdot.

                  I rarely if ever moderate, and it's obvious that I did not moderate any comments on this story because I'm posting comments on it.

                  It's entirely possible that other readers didn't like the false "it's an ad" accusations and moderated them down. Or it could have been one of the full-time editors. Got me. If I knew, I'd tell you.

                  The thing that always puzzles me on Slashdot

                  • Thanks for the sane reply. Note that I simply had asked "what's the deal with all of the [rapid] downvoting" and that I had no paranoid ideations. I just wondered what was going on. Also, I had no idea that there were no such things as "video `slashvertisements' " because no-where on /. in the FAQ or anywhere else is it stated that there is no such a thing as a video slashvertisement. But since I'm getting it from the editors mouth, I am more than willing to concede that it was "groupthink" downvoting,
      • by fa2k (881632)

        It's not unthinkable that real people would mod this down. It's fine to point out that it's an advertisement, but when the first thread just keeps going on and on about it, I could see how some people would consider that to be off topic.

      • by Inda (580031)
        That's not strictly true. Some of us like the newest posts at the top. It's where the gems end up. These are the ones I'll mod first. No, I don't check for redundant posts.

        The obvious "first post" shit is always at the bottom. It's boring stuff posted by bored people refreshed the front page too often. The same copy 'n paste answers to the same dupe story themes.

        A few hours after the story is posted, the insightful comments start. Happy days.
  • by admdrew (782761) on Wednesday March 06, 2013 @04:13PM (#43096639) Homepage
    Can someone tell me why all of Roblimo's posts 1) are his own content, versus edited reader submissions, and 2) read exactly like advertisements?
    • Also see the prior article, where my comment/question about "is this a slashvertisement?" got rapidly modded down to a (-1) score.
      .
      What's with all of the down-voting on comments on the "key caps" article that dared to ask if the article itself was a slashvertisement? There's something bizarre about 13 out of 19 comments being down-modded to (-1) scores so rapidly, particularly when some of the were obviously not troll postings but merely questioning the usefulness of the article itself.
      .
      http://it.slashdo [slashdot.org]
  • Is hard to teach common sense. Is easy with enough internal information (usually kindly provided by you in social networks) to trick someone onto opening an email, an attachment, a java applet, or visit a "safe" website (that could be a hacked real one, even a government one, with "extra" content targetted at you).
    • by Gulthek (12570)

      It IS hard to teach common sense, but it's not hard to demonstrate it. That's what PhishMe does. Shows employees how to recognize phishing emails by exposing them to safe phishing emails. Think of it as a vaccine.

      • by gmuslera (3436)
        Our "software" have a lot of vulnerabilities that are hard to be aware of at all times. If i tell you that a coin have 50% odds of heads or tails, and tell you that the last 10 tries were heads, wouldnt you think that it will be almost sure than next try will have far more than 50% of odds in one direction or another? Even being aware of the fallacy that is behind?

        If you aren't sending generic mails, but something tailored for the recipient (and in particular, the weakest link between the possible ones) t

  • PWNED! (Score:5, Funny)

    by Kookus (653170) on Wednesday March 06, 2013 @04:22PM (#43096739) Journal

    Everyone who clicked on this link needs to now attend a phishing training class, you have all been suckered into clicking on this blatant advertisement!

  • If merely opening an email can do anything more that let you see and hear its content (and stop the instant you close it) then there is something wrong with your computer. And even that much is risky.

  • by Murdoch5 (1563847) on Wednesday March 06, 2013 @04:38PM (#43096897)
    Does every one remember a few weeks ago when a company sent out a real email asking for users to change passwords and some people thought incorrectly it was a phishing email..... Basically that single event proved that people don't understand how to read / detect phishing scams. if you can't even recognize or take steps to recognize whats real from whats fake then I don't know what to tell you, the issue isn't always the scammer or lack there of, sometimes just blame the users.
  • eh? cracking, to old timers, is the act of bypassing software locks. hacking is trick/cool repurposing/extension. spearphishing is plain old social engineering.

  • Spearphishing. The deluxe (but easy) way to get unwary employees to put malware on your network.

    Hey, if i want to put malware on my network it's even easier to just do it myself.

  • Spearphishing. The deluxe (but easy) way to get unwary employees to put malware on your [ Microsoft Windows ] network. It's basically the same as phishing, except more targeted. That is, a plain phishing scam might offer an unwary [ Microsoft Windows ] web-browsing employee a chance to see a famous starlet naked, while a spearphishing attack might purport to be an urgent request from your Bizzaro County office for 200 Kg of Unobtainium Oxide. Open that email [under Microsoft Windows ], and... ZAP! So this
  • We tried this in 2001, after a tonne of people opened some Love virus email variant. Me and one other IT guy at our University just did it off our own bat - I wrote a small and simple vb6 exe and he emailed it out from a hotmail account as "funny.doc.exe". All it did was log who clicked the file back to a txt file on the network.

    We didn't get any kind of authorisation or even discuss it with anyone first and yes, we got in trouble with management for embarrassing staff (we did not name and shame, so we d

We gave you an atomic bomb, what do you want, mermaids? -- I. I. Rabi to the Atomic Energy Commission

Working...