Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


08:15 AM

Phish Bait

A security company is testing the effects of a phishing exploit that comes from inside the corporate network

4:20 PM -- Yet another phish tale.

And this one may be a sneak-peak of things to come: What if a phishing exploit came from within your network?

Consilium1, which performs white-hat attacks and penetration tests, is about to try that exploit on one of its clients, with a twist.

Using its penetration tool, the firm will send an official-looking email which appears to be from an actual company administrator or executive but contains a potentially deadly link. But if users click on this link, it doesn't send them to some infected Website or grab their browser settings. No, this phish plops them right onto the "attacker's" laptop and deploys an agent that automatically gives the attacker administrative privileges on the user's workstation, according to Sean Kelly, business technology consultant for Consilium1.

The good (and bad) news is this exploit only works from within the same subnet on a LAN, so it won't be some Eastern European phishing gang attacking your organization. It will be someone from within the company, or a crafty social engineer who gets past the receptionist.

What made did Consilium1 come up with such a creepy phishing concept? Curiosity.

"We generally just attack servers or do a vulnerability scan to see if there are any missing patches or holes, and we try to run exploits to crack them," Kelly says. Or the firm performs sneaky acts of social engineering, like impersonating a telecommunications company to see if they can get access to the server room.

This time around, Consilium1 wanted to test-run a socially engineered phishing attack to see if its client's users will take the bait. If they do -- which is likely, since a spoofed internal email can be pretty convincing -- it could open up a whole new can of phishing worms.

— Kelly Jackson Higgins, Senior Editor, Dark Reading

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-10
Valve Steam through 2021-04-10, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow that occurs for a Steam invite after one click.
PUBLISHED: 2021-04-10
A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.