Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Nigerian 419 Scammers Evolving Into Malware Pushers (But Not Very Good Ones)
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/28/2014 | 12:23:42 PM
Re: Executables in Emails?
My thinking is that the earlier good practices can be drummed in the better. I've seen many tweens with smartphones! Then by the time the judgement kicks in in the mid 20s, presumaby some of the basics will be already baked in...
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/28/2014 | 12:23:37 PM
Re: Executables in Emails?
My thinking is that the earlier good practices can be drummed in the better. I've seen many tweens with smartphones! Then by the time the judgement kicks in in the mid 20s, presumaby some of the basics will be already baked in...
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/28/2014 | 12:23:32 PM
Re: Executables in Emails?
My thinking is that the earlier good practices can be drummed in the better. I've seen many tweens with smartphones! Then by the time the judgement kicks in in the mid 20s, presumaby some of the basics will be already baked in...
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/28/2014 | 12:20:04 PM
Re: Executables in Emails?
This does make sense from an impulse perspective but then what are the action items? Educating people at a younger age to protect against phisihing? My high school had CISCO Networking classes and basic computer classes but I have not seen a InfoSec related class or one that taught InfoSec related principles. 

Or would this be better projected at the university level which comprises the age most susceptible for exploitation?
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/25/2014 | 9:56:53 AM
Re: Executables in Emails?
As the parent of a 24-year old (who probably should know better), I'm not surprised that that demographic is more susceptiable to a phishing attack. That's a very impulsive age at which point the "judgement" brain cells have not fully matured. The rental car industry figured that out a long time ago when they set 26 as the minimum age that people can rent a car without a big  surcharge.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/25/2014 | 8:46:13 AM
Re: Executables in Emails?
Very interesting thanks for the reply. Some of the most interesting pieces from that article was that ages 18-25 are the most susceptible age bracking for phishing attacks. I thought it would be the opposite.

Also, that women are more susceptible than men statistically. The article attributes this to less technical training however I am not convinced. In the study was half women and half men with men receiving 48% training materials and women receiving 52% which is pretty much even. So I don't think the results support their hypothesis. But I cannot think of other reasoning as to why this would be true. 
Manos Chatzikyriakos
50%
50%
Manos Chatzikyriakos,
User Rank: Apprentice
7/24/2014 | 10:56:02 AM
Re: Executables in Emails?
You might find this paper interesting. It's about a study on the subject you mentioned, different factors that might have an impact someone's behaviour susceptibility to falling victims of phising attacks. 

http://lorrie.cranor.org/pubs/pap1162-sheng.pdf

The paper is a derivative of a thesis which you can find online if you need the full information.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/24/2014 | 10:30:24 AM
Re: Executables in Emails?
Understood, does anyone know if there is an age demographic that shows those who respond to phishing attacks? I am just curious because I know a large percentage of exploited individuals are elderly in terms of technology/financial scams. I would be interested to see if they are the largest group who open unknown attachements.
Manos Chatzikyriakos
50%
50%
Manos Chatzikyriakos,
User Rank: Apprentice
7/24/2014 | 10:00:01 AM
Re: Executables in Emails?
Unfortunately you would be surprised by how many people would actually do that. It doesn't take more than poor social enginnering skills and a .exe file named "picture.exe.jpg"
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/23/2014 | 8:47:16 AM
Executables in Emails?
Some of this was actually quite comical. But on a serious note, to confirm with your article, they are sending .exe's in the email attachment? Just to be clear, I am unsure as to why anyone would use an executable from an email. 


HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-6994
PUBLISHED: 2020-04-03
A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer. The followi...
CVE-2020-8637
PUBLISHED: 2020-04-03
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter.
CVE-2020-8638
PUBLISHED: 2020-04-03
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency parameter.
CVE-2020-8639
PUBLISHED: 2020-04-03
An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uploading a file with an executable extension. This allows an authenticated attacker to upload a malicious file (containing PHP code to execute operating system com...
CVE-2020-10601
PUBLISHED: 2020-04-03
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and insecure permissions which may allow a local attacker to bypass the password-protected mechanism through brute-force attacks, cracking techniques, or overwriting the password hash.