Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Dark Reading Radio: The Human Side Of Online Attacks
Newest First  |  Oldest First  |  Threaded View
theb0x
theb0x,
 User Rank: Ninja
6/20/2014 | 12:46:23 AM
Phishing and Your Identity
It seems that the more features we have may bring more trouble to the table than it's worth with email and your identity on the internet.

Everyone loves to personalize their email message body in one way or another. Wheither it be their BOLD font, or company logo in their signature at the bottom. But using HTML markup and viewing embedded images from an internet based source will instantly reveal your public facing IP address to the Phisher leveraging an infinate possibility of attacks to your company network.

The Picture You Never Saw.

The concept is quite simple and highly effective in targeted phishing attacks.

A tiny 1x1 pixel embedded image in the body of the email hosted on the Phisher's webserver logs your IP when the email is viewed.


Right away this raises 3 concerns:

1) When the email is opened it instantly confirms to the Phisher that the user actually viewed it.

2) The Phisher has now identified your User Agent String (Email Client / Web Browser Version etc)

3) They have your IP Address and have already started enumerating all the ports on your Router / Firewall.

 

Because phishing is increasingly more targeted you can see how a simple HTML based email can provide a Phisher with enough intellegence to craft the most effective attack vector against that user.

 

 

 

 

 
theb0x
theb0x,
 User Rank: Ninja
6/19/2014 | 1:22:31 AM
Re: Phishing
I think there are certain departments in a company that continued training could be very useful. For example: Human Resources. They may be more targeted with emails claiming to have an attached resume in regards to an open position. In the process of hiring they may have to sort through dozens if not hundreds of responses to a job listing. How are they to quickly and safely determine wheither or not to view the attachment of the candidate? Because the HR email address is publicly facing the internet this makes it an extremely vulnerable target.

Another prime example is Shipping/Receiving. Employees using online resources to ship and track packages. The most common response I hear after a machine has been compromised is "I was expecting a package so I clicked the tracking link." Again they may have the task of proccessing/tracking hundreds of packages.

We could just take the fun out of email and strip all incoming mail of HTML code and have an improved attachment restrictions and filtering proccess.

But even using signature based and the most advanced heuristic detection teqniques some will still get through.

I also don't expect an end user to be able to analyze IP header information from an email to determine it's origins or legitimacy.
RetiredUser
RetiredUser,
 User Rank: Ninja
6/18/2014 | 4:14:31 PM
Re: Phishing
@DarkReadingTim

It's a touchy call and highly depends upon your users.  For instance, I've supported IT for users that saw us as a reason not to learn anything at all about their computers, outside of typing and reading emails.  On the other hand, I've worked with users that were very interested in learning new things, especially about how to not be victims of malicious email.

I think you also need to ask "What if they fail?  Repeatedly?"  What is the consequence?  I know for some jobs, if you can't certify or reach a certain level of testable knowledge, you can't stay in the role.  Would failing to master the basics or recognizing phishing attempts bring a drastic response?

In general, I love the idea.  Especially if I get to write the CBT :-)  Though I've never been one for certifications or degrees, I absolutely believe a person should be able to demonstrate knowledge of what they are tasked to do.  And if you are tasked to be a responsible employee, then perhaps you should demonstrate that skill.

But, of course, as with any employee testing, you can update this test and put it in front of staff every 6 months, and there will still be victims of phishing, whether the staff pass the tests or not.
DarkReadingTim
DarkReadingTim,
 User Rank: Strategist
6/18/2014 | 2:35:45 PM
Re: Phishing
Interesting idea -- quizzing users on what they know. Our speaker today advocated the use of phishing simulations over quizzes. What do readers think?  Is there a good way to test users to see what they know or don't know about phishing attacks and how to spot them?
theb0x
theb0x,
 User Rank: Ninja
6/18/2014 | 2:32:03 PM
Phishing
There is an excellent resource worth checking out to test your ability to recognize phishing attacks.

It's called the SonicWall Phishing IQ Test. You can find it here: http://www.sonicwall.com/furl/phishing/

 

What I like is that it provides an explaination at the end for each question.  You or your employees/clients just might learn something. 

I got 100% first try but I must say some of them are quite tricky. Look closely at each example!
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
6/18/2014 | 8:55:17 AM
Great topic & speaker -- Be there or be square!
Some logistal suggestions for newbies to our radio show. To access the broadcast and live chat, you will need to register for the site and today's broadcast, which may require you to temporarily disable your popup blocker. 

If you can't attend today's event, the audio will be available after the fact, as well as the transcript to the text chat.

Finally, if you have specific questions or comments about the topic, you can post them in advance here and we will deliver them to our virtual radio studio for our guest to address.

 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1172
PUBLISHED: 2023-03-17
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...
CVE-2023-1469
PUBLISHED: 2023-03-17
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenti...
CVE-2023-1466
PUBLISHED: 2023-03-17
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(...
CVE-2023-1467
PUBLISHED: 2023-03-17
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt le...
CVE-2023-1468
PUBLISHED: 2023-03-17
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipula...