I read an article about ransomware affecting the public transportation service in Kansas, and I wanted to ask how this can happen. Wikipedia says these are “are typically carried out using a Trojan, entering a system through, for example, a malicious attachment, embedded link in a phishing email, or a vulnerability in a network service,” but how? Wouldn’t someone still have to deliberately click a malicious link to install it? Wouldn’t anyone working for such an agency be educated enough about these threats not to do so?
I wanted to ask in that community, but I was afraid this is such a basic question that I felt foolish posting it there. Does anyone know the exact process by which this typically can happen? I’ve seen how scammers can do this to individuals with low tech literacy by watching Kitboga, but what about these big agencies?
Edit: After reading some of the responses, it’s made me realize why IT often wants to heavily restrict what you can do on a work PC, which is frustrating from an end user perspective, but if people are just clicking links in emails and not following basic internet safety, then damn.
It doesn’t matter how strong your defenses are and how skilled your IT team is, when fucking Linda in accounting opens EVERY SINGLE GODDAMN ATTACHMENT SHE GETS!!!
She’s had poor training I guess. SEBKAC! Security exists between keyboard and chair
Linda has a standing desk. Checkmate, hackers!
SEBSAC (security exists between shoes and computer, or socks and computer, or soles and computer, or sprostherics and computer, or smagic carpet and computer)
Jokes on you she doesn’t have legs or arms for that matter.
Anybody and anyhead can ride a magic carpet, they don’t discriminate.
Some people aren’t trainable.
Security exists between keyboard and chair
In theory
Theory doesn’t match reality.
PEBKAC is reality.
Then the IT department sends everyone a Honeypot email and schedules more training and a meeting with a manager for anyone who clicks any links in the email.
It is a great step but it’s rare to have enough buy in from upper managent to enforce any real consequences for repeat offenders. I’ve seen good initial results from this kind of phishing testing, but the repeat offenders never seem to change their habits and your click rate quickly plateaus.
Attackers have to be right once. Defenders have to be right every time.
Also, user.
“i wonder whats on this flashdrive”
When I was in secondary school, I basically did exactly that with a random flash drive I found in the park. I’m blaming my school for never giving us that network security talk lol. Fortunately nothing came of it and it was a pretty boring flash drive but still. Would never ever do that now.
Wouldn’t anyone working for such an agency be educated enough about these threats not to do so?
Ahahhahhahha. Ahem. Hahahahahaha. Give me a moment to compose myself.
Thank you for that moment.
Anyway, the assumption is very reasonable. And, oh how I wish it were so.
But the answer is no, they’re human, and even high tech organizations need specialists in other subjects (law, finance, book-keeping, etc) who aren’t at all technology savy.
To be clear, education is such subjects is often mandatory. It just doesn’t always take. Largely because many staff watch the educational video, and think they understood it, but don’t really have any context for it. For example, they might learn it and still think, “Well, it clealy doesn’t apply to an email from our CEO. He wouldn’t send something nasty!”
Edit: The solution I’ve seen is a lot of education. It’s not enough to say “don’t click suspicious links”, there’s got to be ongoing training on the definition of “suspicious”.
The security team at the company I work for sends out test phishing emails and if you fall for it they make you change your password. I think this annoyance helps people learn to pay attention. It doesn’t seem like we have had to do as many resets due to these as time goes on.
This works IMO. Our company used to do this. Hell, I even fell for one once, which is some shameful shit considering I work in the tech industry. That shame enough though has kept me more on toes ever since.
I almost fell for the last one they did. It was disguised as a link to a shared item on teams that that asked for your creds and I assumed it was another shitty half baked Microsoft thing that single sign in wasn’t working on. The only reason I didn’t log into it was because I was like “fuck it I’ll just open it from teams instead” only to find that it wasn’t in Teams.
I’ve flagged several suspicious looking but actually legit emails that were originated by internal groups but used very scammy sounding language (warning of dire consequences, extreme urgency, links to external websites as reference to something claimed to be internal process…)
Hopefully those departments sending emails like that get some education too…
Stay suspicious. As a security guy, i’d way rather respond to 1,000 false positive reports than have an employee that doesn’t think about it and just clicks.
Yes, this makes sense. I can also say from observing co-workers at different jobs, any training that’s provided virtually (e.g., you just watch a video and answer some questions), is mostly a waste of time. I can say that I and some others took these trainings seriously, but most people did not and would jump through the hoop as mindlessly as possible.
I saw this a lot when I worked as a CNA. People would just answer the questions right, “pass” the training, and then continue doing things in the same wrong way they’d always done things.
People are by far the biggest security risk. I have seen personally tailored phising scams that were even able to fool experienced secops staff.
Company I used to work for got hit fairly bad. Am email came in from the contract agency to the accounts payable clerk, personally addressed to her and signed off all informal like, to the effect of “hey Marion, our local bank branch is closing so we’ve had to move our accounts, can you update the IBAN to the following for me?”
€150,000 down a black hole, that wasn’t even noticed until a phone call came in a week later.
My favorite personal anecdote was when one of our security educators send an email explaining how he managed to click a phishing link, log in and then realize it was a fake website login.
Apparently he got an email telling him that the local scanner in the office had send him some material and he needed to authorize the transfer into his inbox by logging in.
Wouldn’t someone still have to deliberately click a malicious link to install it? Wouldn’t anyone working for such an agency be educated enough about these threats not to do so?
lol, lmao even. I worked IT for a hospital network for about 4 years. Doctors aren’t any smarter than anyone else when it comes to using a computer, because it’s not what they spent all their years studying. People click on dumb shit they shouldn’t all the time, doesn’t matter how “smart” they’re supposed to be.
Sometimes they can be worse. “I’m an expert in this field, so I don’t need to think about any others”
Maybe you can frame it in a more relatable way like, “When you are performing surgery, you wouldn’t incise the first organ you see”
The first organ I should be seeing is the one I cut open the body to look at! Otherwise, I cut the wrong spot…
Yeah you do, unless this surgery inserts up the ass you have to cut into the skin to get to the rest of the organs. But it’s a nice thought.
You know what’s funny is I realized the skin is an organ right before I hit send, but I was hoping it wouldn’t occur to anyone else haha
I work in a public school. The older teachers are the ones that don’t even look at the sender address. “Oh, this email that sort of looks like its from an employee says to blindly open this file that I would realize is clearly fake if I took more than two seconds to look at it? I’m on it!”
Our union negotiator didn’t understand different sheets in Excel files. Had a document he wanted to share out on sheet one. For some reason on sheet two he had every union employee’s name, birth date, social security number, address, etc. in plain text. Emailed to the entire school district. I caught it immediately and made them aware. The frantic emails to my friend the IT guy were hilarious. “I NEED YOU TO GO INTO EVERYONE’S EMAIL AND DELETE THE MESSAGE I JUST SENT.” Then when it was explained that you can’t just take it back, another frantic district email “DO NOT OPEN MY PREVIOUS EMAIL. JUST DELETE.” Again, not understanding that unless they empty their trash, its still recoverable for 30 days.
There’s so much here, holy crap!
But I’ve totally noticed the spontaneous mindless clicking among people with low tech literacy. Like, every single time I try to help someone navigate an application or web site, they’re fundamentally incapable of following step-by-step instructions and will randomly click on anything they see on screen. It’s so weird and frustrating.
Dad: Hey son, next time you’re over, can you have a look at our laptop. it’s running slow for some reason.
Me: Yeh no problem. Have you installed any new programs recently?
Dad: No.
Me: Opens program files, sort by date modified… Shocked Pikachu face
A classic is to just drop of 2 or 3 infected USB sticks, maybe with bait labels, on the parking lot before the first employees arrive. repeat a few times and just wait until someone plugs it in to investigate.
another good trick is to infiltrate the cleaners.
the cleaners
What do you mean by “the cleaners”?
Probably the literal cleaners who come in to clean the building before/after hours.
Oh, okay. I forget that large businesses and agencies like schools can have their own cleaning staff with access to technology.
I once heard this story about a company, that had a server room. The room was locked so no-one could get in without permission, which is a good practice. At some point, they started to wonder why one of their servers becomes unreachable every Friday at X o’clock. Eventually, they figured out that their new cleaner entered the server room every Friday and unplugged one of the power cables to plug the vacuum cleaner in to the outlet.
How the fuck
Janitors and custodians get way more unrestricted access than most people realize.
I used to deliver pizzas on a military base, and the amount of restricted areas I got in with no more than a pizza and a uniform shirt is ridiculous.
Social hacking is the way to do it
I did a hardware upgrade for a hospital a few years ago. People let me in all kinds of sensitive areas just because I had a PC in my hands and knew someone in their department’s name. The only time anyone bothered to verify I was supposed to be there was when I was doing an install in the maintenance guys’ office.
This is always a fun experiment when you are doing contracted IT work. In my experience in large organizations with multiple facilities where everyone does not know everyone, looking the part and having confidence when you ask someone to let you in the server room is all it takes to get in. They aren’t surprised you don’t know where it is. Helps to have a Catalyst switch in one hand.
For physical security though, badged entry to the building especially with a foyer where guests wait on a routine basis, and a strong anti-tailgating culture where everyone must badge in, will go a long way to getting normal people to pay attention. Not as easy in publicly accessible places like a hospital or some of the places I was working.
That’s how we were at my last job.
The tailgating thing was only allowed if you could see their badge, and with the exception of being on a clean suit, your badge was to be visible at all times, and we were trained and told to check for badges as we were walking around the facility.
Forgetting your badge was a bitch though, there was literally only one door that could be opened from the outside without a badge and that was the front desk.
That must be nice. My company does a lot of work for one of the world’s largest chip manufacturers and getting access to some of their facilities is like pulling teeth. Somebody forgot to submit the right paperwork, it didn’t go to the correct department or project manager, this facility is always locked down on the third Tuesday of every month, for reasons, you name it I’ve encountered it.
I wish our military bases were that secure
The people who do the cleaning
What do you mean by “the cleaners”?
The people who push the brooms and empty the trash bins.
An advanced phishing attack can be incredibly hard to detect. Here’s an example of a browser vulnerability that allowed malicious sites to spoof legitimate looking domains. It’s been fixed since then, but it’s a constant battle between fixing exploits and new ones being found. A sophisticated operator can come up with ways to trick even the most tech savvy user, and most users will fall for more obvious tricks than that.
Oh yes, the Latin vs. Cyrillic characters trick! Now that you mention it, I remember watching a YouTube video about this. Scary shit.
Homoglyph attacks!
There’s a new similar phishing attack thanks to Google and their .zip domain. Web browsers support a feature that lets you use addresses of the form
protocol://username:password@domain.tld. That feature allows you to log in todomain.tldwith the given credentials. When you combine that with Unicode forward slashes, you can craft addresses that look likehttps://microsoft.com/files/@windowsupdate.zip, where the part betweenhttps://and@is a username and the part after@is the actual address most likely used for malicious intends. My example uses normal slashes, so will lead to Microsoft’s website and page not found error.windowsupdate.zipis a domain someone has registered, but leads to no-where as of today. PSA: Don’t go to random web addresses you find on the Internet or elsewhere.How is this shit not fixed yet? That’s literally undetectable phishing
It is fixed, if you follow one of their example links you should see a warning now. I was using it as an example of how there can be hard to detect exploits.
EDIT: it’s fixed in Chrome. Just tried Firefox and they don’t have a warning 😕
Through the holy trinity of gaping holes: Windows, Office, and Exchange. And add lazy or stupid sysadmins on top who don’t care to update their stuff, they make break-ins even easier.
Lots of sysadmins are also overworked and burnt out by stupid requests too.
I remember reading an article by a penetration tester years ago at this point. His company is hired by all sorts of companies to test their network security etc. He described one client that thought it had the best network security money could buy. The pen tester took a novel approach (at that time) and put a benign Trojan on a bunch of random usb sticks then scattered them around the employee parking lot, outdoor smoking areas, etc. sure enough some of them started “phoning home” from inside the clients network fairly quickly.
My own employer has been the target of phishing and other attacks over the years. Our security team now contracts with a company that randomly sends out well crafted phishing emails to employees to see if they can detect it or if they click on a questionable link in the message. If an employee clicks on one of these then they are immediately told that they failed a test and are automatically signed up for a training session on spotting phishing and other scams.
At my previous place of employment I would report Phish on any and all spam and get lectures about reporting Phish on all my spam. Like, how am I supposed to know if you initiated the fuckin email or if a bad actor outside did? Can you give me some pointers on how to tell if it’s your spam or someone else’s? My current employer just adds it to the block list without acting like a douche lol
If an employee clicks on one of these then they are immediately told that they failed a test and are automatically signed up for a training session on spotting phishing and other scams
My former employer did this (might have contracted with a similar company). The emails were really convincing, but I don’t think most of us ever clicked them, though I remember other staff asking me if I thought it was a phishing email. I’d ask them what made them think that it was phishing so they’d learn. The last thing I wanted on top of everything else was the hassle that would come if our network got compromised, because we worked with so much private and sensitive client data.
But there was one co-worker who I’ve mentioned elsewhere in this thread who would click on something in the message almost every time. She took the mandatory training so many times, but it never stuck for some reason. I was always amazed she kept her job.
Yeah, I don’t think too many people click on those “educational” phishing emails but it does happen once in a while. We have a slack channel where people can contact the security team and I do regularly see people asking about suspicious emails. They never admit if they’re test emails but always thank folks for reporting them.
It was a little bit different at my employer. If we correctly reported something as phishing, if it was a test, we’d get a message back saying that we correctly identified the message along with more tips about identifying phishing.
Spearfishing is probably the lowest risk and easiest way to get access to a specific network. The attacker can get a bunch of info about an organization (technologies used, people employed, physical locations) through LinkedIn or whatever social media website, and then target a specific person.
Once a target is identified, the next step would be getting that person to follow a link to type in a password, or getting them to install malware, or do whatever it is the attacker wants them to do. I read an article about a dude that got fairly big companies to pay him money by just sending fake bills.
I read an article about a dude that got fairly big companies to pay him money by just sending fake bills
I’m laughing so hard at this right now. That’s so funny.
Because some fucker working there clicked on some email he shouldn’t have.
People.
This society would be so great if it weren’t for all these damn people smh
FOR REAL
its usually an ID10T problem
Since people are covering the more common options, I’ll point out a rarer one. If I remember right, (please correct me if I’m wrong) the Stuxnet virus was able to infiltrate a highly sensitive nuclear enrichment facility because someone planted a zip drive in the parking lot, and some employee went ahead and plugged it in at work to see what it was.
some employee went ahead and plugged it in at work to see what it was
Holy shit lmao. It just amazes me that someone working for such a facility would do this, but I suppose it’s the same as people who won’t wash their hands after using the toilet or who don’t use their blinker when driving.
We’re just a bunch of shit-flinging primates, aren’t we? We just do thinks without thinking.
And the worst part is, given the right circumstances (lack of sleep, extreme stress, illness), maybe that person could be me.
Also people often need to experience a problem before they realize its a problem. I doubt that specific individual will ever make that specific mistake again.
This is also true.
Smart people can still do dumb things. Some are also highly skilled in some areas but terrible in others. My uncle was a heart surgeon, but he was terrible at driving.
