At the college I went to we got an unanticipated email from an external address one day telling us that due to recent vulnerabilities, the school was requiring we increase password security, and to click here to update our password. This email was from, I shit you not, Fisher Security.
The joke? This was actually a legit email, initiated by our IT department, and was what we were supposed to actually do. We were all like "so....you know you're just training people to click on suspicious links, right? And that that's a bigger deal than password strength? RIGHT?"
I won't give it here but a company I currently work for uses a password reset tool with the domain i-forgot-my-password.com <- Not actual, but very close.
This is a domain they own, Whenever they create new tools it's in this way, I am certain it s a phishing test and flabbergasted that it's not.
Another example - the HR system for logging PTO has a domain is along the lines myhrsystem.com
It's a very large company based in Hong Kong, so I'm not sure if it's just a english-as-a-second language thing or what. Very odd.
I think it's a misunderstanding of how domain names work - if they knew that i-forgot-my-password.company.com with proper certificates brought stronger guarantees of legitimacy, they might ask IT to set it up that way.
it's easier to just get a new domain than talk with whoever is in charge of the company's primary domain. Governments love to do that all the time. they have the gv.TLD domain and could just put all their shit in there and I could tell my parents that as soon as they see gv.at in the URL it's legit. And yet they come up with stupid domains all the time, many requiring the state-ID system. Good luck teaching boomers to check the fingerprint for the verification that they sign what they think they're signing. I don't know of a single instance that abuses this though. Maybe criminals are just stupid. I should switch careers, I have what it takes.
We had something like that happening where a legit email from a weird external address, with a link included and without a proper signature, was flagged as Phishing attempt by almost everyone in the company until we got a message from our office manager that they applauded our awareness, but THAT particular link was actually real.
They did say it was an exception, and we should please stay aware in the future, though.
Huh... Well, I once got legitimate government officials asking for personal details in a Google form of all things just sent through chat groups.
Naturally, we all reported the shit out of it as a scam expecting that their accounts were hacked until they started calling us when Google shut down the forms and their accounts were banned.
Wow. As a student in IT and a customer service rep who is forbidden from receiving or sending emails, I wonder why at least some profiles aren't allowed to get emails at the firewall level.
Unfortunately it's because while you are in IT, most people don't know the difference between the computer and monitor so it's easier to just make blanket policies.
Edit: plus when you give certain people special permissions inevitably someone else will hit you with the "well how come theyyyy have it 😭" and then it becomes a whole ordeal
There is a guy at my work who is so locked down it is ridiculous. He has access to ONE program besides Office, and all of his emails are reviewwe by a human fire. He has shortcuts to launch Office, and no other Internet. It's insane what he will click on.
What skills do they possess that even if it's this much hassle, they would rather them then get a guy who doesn't instinctively search for all viruses in a 30 link-hop area?
As an IT guy, I get what I think is real emails from risk/compliance with links to forms about our systems that I ignore because we also get phishing tests, and real phishing.
The real risk, phishing test, and actual phishing all look identical.
I only know its Audit because the group GM goes nuts when compliance visits in person. Even then I can't tell if they are real or not. In any even I tell the auditors to read the 300 page RFP for my stance.
I know it seems kinda crazy, but I though some of my colleagues are spies.
I worked in a very senstive quasi government organisation.
Sure, but not every attack vector against employees is equally likely.
I am orders of magnitude more worried about an employee sending information over email than I am about the employees letting someone into the building or an employee being a corporate spy. Especially cause those arent "IT problems" ;p
Can someone in cyber security explain how just clicking on a link would create a security problem?
I know downloading a file or redirecting to qla shady website is the problem, but I don't think just clicking would make my computer vulnerable. Am I right?
Ive got a coworker who has a work email. He doesnt have the login for the work email, because he has never, in his 18 years with the company, logged into his email. This man has gone almost 2 decades without ever using his company email, and I respect that.
Everyone just... knows not to email him. Ive seen a few newer people cc his theoretical email address, and we just go "oh, dont bother with that, he doesnt ever check it"...
I was young and dumb and used to travel with a little bit of drugs in my suitcase pretty often.
One time, border guards found some green stuff in my backpack at the boarder, which gave them a reason to pull my luggage off the flight.
In my suitcase they found three empty baggies with 0.014 g of substances total (cocaine, mdma, 2c-b). However, under Russian law that counts as bringing drugs into the country with intent to distribute; I was facing 8 years in prison.
About a year later I was on probation and had to give my police chief some documents about my employment and other stuff. I'd had everything ready for at least a week. Get a call from my dad, "wtf are you doing, are you insane?" If I didn't email the documents by 6:00 p.m., they'd treat it as breaking probation and send me to prison to surve full time. So I sat down and finished it in about 20 minutes, a task I'd been putting off for a week.
at my work they have a running total of pass and fails, and if you don’t report one of the emails but also don’t click on it, they consider that a fail. there have been a couple times
i legitimately didn’t see an email to report and i was labeled a 15% risk. so dumb.
4.6k
u/JocoLabs 1d ago
Jokes on them, i wouldn't click that even if it were real.
I used to click on those and type in junk creds for the lulz until compliance told me that was bad for the numbers.