1 in 3 Michigan Workers Tested Opened A Password-Phishing Email (go.com) 119
An anonymous reader quotes the AP:
Michigan auditors who conducted a fake "phishing" attack on 5,000 randomly selected state employees said Friday that nearly one-third opened the email, a quarter clicked on the link and almost one-fifth entered their user ID and password. The covert operation was done as part of an audit that uncovered weaknesses in the state government's computer network, including that not all workers are required to participate in cybersecurity awareness training... Auditors made 14 findings, including five that are "material" -- the most serious. They range from inadequate management of firewalls to insufficient processes to confirm if only authorized devices are connected to the network. "Unauthorized devices may not meet the state's requirements, increasing the risk of compromise or infection of the network," the audit said.
Re: (Score:2, Informative)
It's a grammatically correct headline. Learn to read: "1 in 3 Michigan Workers Tested" is the noun phrase (containing a participle form of verb used adjectivally) serving as the subject of the verb "Opened," which takes "A Password-Phishing Email", which is the noun phrase in the role of object for the transitive verb.
If it's to be nitpicked, one might nitpick that it should read "Password-Phishing Emails" or just "Password-Phishing Email" (no "a" which should be omitted in the headline for brevity reasons
Re: (Score:3)
OPENED the email, or actually pursued it? (clicked a link, replied to the email) Depending on the subject line, it may be totally innocuous looking until you OPEN the email and read the content.
Re: (Score:3)
OPENED the email, or actually pursued it?
Opening an email in a modern mail client or web app should be harmless. Some old apps would automatically load html-linked images, but if that is still a problem, it is not the user's fault.
Re: (Score:2)
Some old apps would automatically load html-linked images, but if that is still a problem, it is not the user's fault.
If it's configurable, in a way that A Reasonable Person would understand how to, they get some blame too.
It's not like if IT doesn't do their job, that absolves workers. Security is something that needs to be thought about by everyone, from janitor to CFO.
Responsibilities (Score:2)
It's not like if IT doesn't do their job, that absolves workers. Security is something that needs to be thought about by everyone, from janitor to CFO.
Simply declaring such a responsibility, whether rightfully or not, doesn't improve security an inch. That would be magical thinking.
Obvious fact is, people who are no IT specialists tend to lack the awareness and knowledge to be able to fulfill such a responsibility. If employers, or, in case of public service, we as a society, want employees to care for security, employers have to make sure that they get proper training. Something that obvously has been neglected in the cases we're talking about here. It's
Re: (Score:2)
Current operating systems are designed by and for IT specialists, they are not suitable for people without such knowledge. If you need to use something that can only be done on such a system then you should receive appropriate training on how to use it properly, and/or use a machine that is managed by someone who does have the appropriate knowledge.
Re: (Score:2)
Simply declaring such a responsibility, whether rightfully or not, doesn't improve security an inch. That would be magical thinking.
True. Merit for those who do well, and demerit and eventually replacement for those who don't, on the other hand, should work.
employers have to make sure that they get proper training
The problem is not with knowledge, it is with attitude and aptitude. There are people who will never act in safe manners, no matter how much training they receive are hired by people who don't care.
I have held computer security classes, and generally, they only help those who have an interest. People who are trusting, gullible or greedy by nature won't change due to mere knowledge
Re: (Score:3)
Opening an email should be a safe action, until you've opened it you have no idea what it contains and it might be a perfectly legitimate mail. The IT department should ensure that opening mails and reading their contents is safe.
Visiting a site linked from an email should also be safe, and that's also the responsibility of the IT department to ensure that browsers and plugins are kept up to date and appropriately hardened against attack.
Actually entering passwords into a site is the only thing users should
Re: (Score:2)
hehe, I still use pine just to make sure, so it isn't only "modern mail client or web app" :)
Re:Headline? (Score:5, Insightful)
The 1/5 entering their password into the website is the buried lead IMHO. That's absolutely ridiculous.
Re: (Score:3)
Re: Headline? (Score:1)
Sounds about right (Score:5, Informative)
We have similar results during my companies initial phishing test so I suspect that this result is not uncommon. Sending out training and multiple rounds of phishing test emails (which then require more training if you click) is the ONLY way to bring this number down. The users need to be made as paranoid as possible before clicking ANY links. After a year and a 1/2 we still have a few repeat offenders who still click on the links or enter username/passwords so Multi factor authentication was implemented, but its far far less then we previously had. Posting as AC for obvious reasons.
Re: Sounds about right (Score:1)
We get those at work too. I use them as a convenient excuse to not participate in charity fund raisers that the social committee promotes by email. ("Oh I thought this was phishing")
Re: (Score:3)
Did the same to the debt collection department of my credit card bank who called me up; Indian accent - check, city with high social deprivation - check, telephone number with no SMART id (don't know what SMART is, but if the number doesn't have it, it must be a phishing attempt - check). Just make up some names and numbers and drop the call when they asked for my debit card number. Wouldn't they know that if they were from the bank? Tell them the cheques in the post.
Re: (Score:2)
Sending out training and multiple rounds of phishing test emails (which then require more training if you click) is the ONLY way to bring this number down.
No, firing and hiring people with a healthier level of suspicion should work too.
Testing gullibility should be part of applicant screening. If the applicant has given an e-mail address, that's one way of testing. During job interviews is another.
Bonuses for those who never fall for phishing could also be a good idea, helping retain those who Get It.
That said, dinging people for "opening" an e-mail is probably not correct. Looking at the e-mail context as plain text is harmless. There's a huge difference
Re: (Score:1)
No, firing and hiring people with a healthier level of suspicion should work too.
These are state employees, so firing them for incompetence is not an option.
Re: (Score:2)
These are state employees, so firing them for incompetence is not an option.
Not hiring gullible people might, though.
People leaving might be slow, but certain. And if bonuses to those who don't fall for such things might help speed attrition.
Opening the email is bad? (Score:5, Insightful)
In other words, opening the email isn't (err, shouldn't be) the problem. It's what you do after that that's the problem.
Then again, I don't use Outlook so opening the email isn't all that hazardous to me.
Re:Opening the email is bad? (Score:5, Insightful)
From TFS: "almost one-fifth entered their user ID and password."
The headline probably should have led with that.
Bad metrics (Score:5, Insightful)
1/3 opened the email? That means that 2/3 don't read their email.
You can't tell if it's a phish just by the subject line and the displayed sender name, you have to at least check the sender email address, path headers and link html to make an informed decision.
Re: (Score:2, Informative)
2/3 of slashdot users don't read the article summary.
Re: (Score:3)
I hope they mean that 1/3 opened it in a client that fetched external content or ran a script that connected remotely.
Re:Bad metrics (Score:4, Interesting)
You can't tell if it's a phish just by the subject line and the displayed sender name, you have to at least check the sender email address, path headers and link html to make an informed decision.
You'd think so. I got an email from someone claiming to work for the Taxation Office. It looked suspicious so I ignored it. Then I got a phone call from someone with an Indian accent, following up on the email. I hung up on them and checked the number; a couple of websites claimed the number belonged to a group of spammers, and some posts said it was a legitimate number from the Taxation Office - as you might expect. I searched the ATO website and couldn't find the number... I spent a couple of days chasing it up; it turned out it was from the Taxation Office, and they wanted to do a phone audit. When I mentioned the problems I had determining the legitimacy of their inquiry, they didn't seem to care.
Re: (Score:2)
It was the Australian Tax Office, and my point was, it sure as hell looked like a phishing attempt, but it wasn't.
Re: (Score:2)
they didn't seem to care.
And yet they corrected that problem anyway. You don't get emails from the Taxation Office anymore. Or rather they moved it. The only correspondence you should get now are via messages posted to you online through the my.gov portal.
Re: (Score:2)
And yet they corrected that problem anyway. You don't get emails from the Taxation Office anymore. Or rather they moved it. The only correspondence you should get now are via messages posted to you online through the my.gov portal.
Wot, an arm of the Australian government has hacked my.gov to use it for communicating with their citizens?
Re: (Score:2)
Hacked? Wtf are you talking about? My.gov is the official communications portal for government services including tax.
Re: (Score:2)
My.gov is the official communications portal for government services including tax.
I repeat: The GP is in Australia.
Re: (Score:2)
I repeat: The GP is in Australia.
... and you're repeating yourself why? : http://my.gov.au/ [my.gov.au]
Re: (Score:2)
... and you're repeating yourself why?
Because you do?
my.gov.au != my.gov, and my.gov is what you said. Twice.
Re: (Score:2)
I invite you to click on the link and see what they call themselves.
I also invite you to go to www.my.gov and realise why you won't get an email from that site either.
Re: (Score:2)
Most email clients don't make it especially simple to show where links are actually pointing, you used to get a statusbar which showed the actual target (in browsers too) but thats uncommon now too. And most users wouldn't know what this meant anyway.
Most mail clients only show you the From: header field, while most mail servers only perform filtering on the envelope from, so its quite easy for someone malicious to bypass filtering and still make it look like the mail came from someone you know. It's not ha
Re: (Score:2)
There are two additional problems. Most users wouldn't know how to read the entire email header even were it visible. And checking up on all the dodgy emails? C'mon, who has time to do that?
Do away with links in emails already! (Score:2)
Seriously, these phishing scams have been going on for far too long now and cost billions. If there is information that can not be disseminated people should be directed to go to a well vetted website.
Re: Do away with links in emails already! (Score:1)
What is your solution for replies. There will always be risk with 2 way communication
Re: (Score:2)
Sure, you just got about 6 and a half billion more people to teach about PGP.
People didn't have to learn about cryptographic algorithms to use HTTPS. Thee is no reason they need to learn it for secure email either. All that is needed is for Google, Facebook, Microsoft, and Apple to agree on a standard. Everyone else will be forced to follow or be left behind.
Re: (Score:2)
There is a standard - S/MIME, OSX/iOS mail and Outlook all support it by default, not sure about Gmail...
The problem is it takes effort to configure, so noone does.
Re: (Score:2)
Of course not. All technical details are handled by the software. The user doesn't have to have a clue that something called a "key" is involved. A random key can be generated and discarded, since it's of no use after the session, and doesn't have to be used on any other browser.
This won't work for email. To use PGP effectively, the user must generate a key pair and publicize the public key. This means that the user has to be a
Re: (Score:2)
When email was text there wasn't this much of a problem. The merger between email and browsers with javascript enabled, however, has been horrendous. And incomprehensible links just makes things worse. Link shorteners are totally untrustworthy, but so are links that push you to a php page, and there are all sorts of links full of various kinds of gibberish so you never know where they're going to link you to. It's not too bad if you don't have javascript enabled, but just try to convince people to avoid
Re: (Score:2)
The merger between email and browsers with javascript enabled ...
Citation please. Can you name a single email client or app, less than a decade old, that executes JavaScript inside a received email?
Re: (Score:2)
Read what you quoted again!
Try it as grouping it as "The merger between email and [browsers with javascript enabled]"
Re: (Score:2)
Thats the UI for the webmail system, not javascript embedded in the content of received messages.
Re: (Score:2)
You do know that if there is js in an email, and you use the gmail web client, it doesn't pass that shit through?
No, you didn't. And yet! lol
I don't even think you were just leaning on an inappropriate pedanticism that isn't relevant. I think it is a worse problem.
Re: (Score:2)
Use an isolated and hardened system for accessing the web, keep business systems airgapped from the public internet, what limited data needs to pass back and forth is easier to check. Your developer only needs to read, not usually copy large amounts of data.
Re: (Score:2)
Don't worry. Microsoft is working on making links in e-mail useless [slashdot.org].
secured ? (Score:5, Interesting)
the email system never verified the URL nor where the email was from
so your email system is so poor you have to rely on the end user not to click on a link ?
simply block / rewrite URL's that have not been verified
only accept mail from domains that have been verified and claim the email is from them
(for example that have DNSSEC and DANE setup correctly as gov address's have this and can therefore prove that they sent the email)
simple basics that are not the end users fault
Re:secured ? (Score:5, Insightful)
There is no technical solution for user awareness.
Sure, you can verify senders... then you only get spam from compromised hosts, or free relays/mass-mailers, or any other way that attackers are increasingly using to get around such things.
You can mangle unrecognized URLs... but then your users complain that their legitimate emails from partners and vendors aren't getting through properly (especially when they just signed the contract), and it still doesn't help when the attackers use bit.ly and other common services to hide.
Once all that has failed, you're still relying on end users to not click links... but if you sold your boss on this "simple basics" security checkbox, you suddenly realize that you never got funding for a user-education course, and that targeted phishing campaign is now wildly successful and claiming victims across your enterprise.
Sure, go ahead and include all of that technical wizardry, and it will indeed reduce your exposure, but please don't spread the myth that a technical barrier is a one-step fix for email security problems. Users are the last bastion of a defense-in-depth solution, which is also one of those "simple basic" concepts.
Re: (Score:1)
Rewriting URL's is in theory good-- but in reality, try having a technical discussion with someone that involves web development or administration.
Better yet, try following a vendor-supplied link to their support site. Or activating your account on a vendor site.
URL rewriting makes email practically useless for my job.
Michican has a few Great Lakes (Score:2, Funny)
Small wonder (Score:1, Troll)
Around 20% of the population have an IQ under 85, that should be about it.
I guess lots of them have a MAGA hat. GDARVF
Re: (Score:2)
This is tough ... (Score:5, Interesting)
... and I dealt with it during my career. I'm a retired IT.
I held seminars, talked to employees one-on-one, and damned if we didn't still get hit.
It was a law firm and the staff never fell for phishing.
My problem was the fucking lawyers, especially the managing partner!
That bastard would click on anything.
He got a goddam email that said his UPS package wasn't going anywhere unless he looked at the invoice and corrected the address.
I asked him if he sent anything via UPS and he said, no.
I asked him if he remembered signing an exclusive with FedEx that I negotiated and he did.
I asked him if he, personally, ever sent a package anywhere or if he let his staff do that -- he said staff.
He did that shit over and over again.
--
I'm waiting for AI to step in; predict the outcome of clicking on a link and forbidding forward progress until an IT person concurs.
Re: (Score:2)
... and I dealt with it during my career. I'm a retired IT.
I held seminars, talked to employees one-on-one, and damned if we didn't still get hit.
It was a law firm and the staff never fell for phishing.
My problem was the fucking lawyers, especially the managing partner !
That bastard would click on anything.
He got a goddam email that said his UPS package wasn't going anywhere unless he looked at the invoice and corrected the address.
I asked him if he sent anything via UPS and he said, no.
I asked him if he remembered signing an exclusive with FedEx that I negotiated and he did.
I asked him if he, personally, ever sent a package anywhere or if he let his staff do that -- he said staff.
He did that shit over and over again.
--
I'm waiting for AI to step in; predict the outcome of clicking on a link and forbidding forward progress until an IT person concurs.
Was his name Homer?
Re: (Score:2)
... and I dealt with it during my career. I'm a retired IT.
I held seminars, talked to employees one-on-one, and damned if we didn't still get hit.
It was a law firm and the staff never fell for phishing.
My problem was the fucking lawyers, especially the managing partner !
That bastard would click on anything.
Obviously, he was looking for someone to sue!
1 in 3 are forced to use bad email software (Score:5, Interesting)
The 20% is the important statistic and that's scary enough already; no need for ABC News to embellish the story.
Re: (Score:2)
Good idea, but you have some problems. If they're not in control of their clients and the clients were pre-fetching the images, wouldn't you expect it to be much higher than [some percent?] If the policy changes from team to team, you already gave up your whole "gubermint no choices" narrative.
Also at the other end, there are people like me who don't let the client display images even when I "open" (read: read) the email. It seems pretty silly to me that I think I might be getting a targeted attack message,
Re: (Score:2)
The part you missed is that the purpose of the audit is to find out what the state of the situation is. It is not the purpose of the audit to assign or restrict Virtue.
So the whole, "Golly it isn't their fault but they look bad" angle is really weak. If you know better, simply refrain from thinking the wrong party is responsible, and take the message as, "there is no system, and the users aren't expert enough to do it right without a system." You don't hide that from ebil "papers" in order to protect people
Those numbers are actually good! (Score:5, Interesting)
I've been a part of aggressive, well crafted phishing tests in Silicon Valley companies. Some of those tests were secret enough that only 3 people were aware of the test in advance... and the results were terrifying. Thanks to HTML abuse, forged headers and very good copy, I've seen 70% of storied security teams fall for the phishing attempt, going as far as to enter their 2fa values for AWS. In a real world situation, just one person falling for it would have been a problem.
In practice, what I have learned is that against a sophisticated opponent, any security system that relies on just usernames, passwords, and simple 2fa might as well not exist. The bare minimum is unique usernames and passwords just to double check that the right human is on the other side, attached to client certificates that are unique to each machine, and strong mechanisms to make sure that nobody generates user + certificate pairs for new computers without big flashing signs popping up. Anything weaker is just relying on being an uninteresting target, which is not a good thing to rely on.
Re: (Score:3)
We had courses at my work place. Things to look for include mis-spelt words, links that didn't use https and/or moved to a different domain from the sender. Which makes me ask, why couldn't an email filter pick this up.
Re: (Score:2, Insightful)
We had courses at my work place. Things to look for include mis-spelt words, links that didn't use https and/or moved to a different domain from the sender. Which makes me ask, why couldn't an email filter pick this up.
That's also my question.
How often do corporations of any size used spoofed headers for business emails? They do that for their newsletters, advertisements, and email surveys and crap, yes, but not for invoices and person to person communications.
I wish our email client had a configuration to flag to the user "This email's sender does not match the actual origination." As well as "This email appears to have originated in Bulgaria". If we actually had a vendor in Bulgaria, the people who handled that
Re: (Score:2)
I include, "asks me to do something that would be really non-secure and provides a link to make it convenient."
Security and convenience are a trade-off, if you're distributing real information to technical workers that they would take actions based on, you don't want to even try to make it convenient with links. You want to just give them the data: "Foo has problem Bar, please log into your Secure BlahBlah and don't forget to wipe the cargo port with the rubber chicken." No link. If they don't know how to a
Monthly phishes from security really help (Score:5, Interesting)
I have found that when the security team sends out "phishing" emails about once a month, that helps. Opening the link takes the employee to a page reminding them about phishing. If instead they click the "report" button in Outlook, they get a happy message. It changes behavior after a few months.
Re: (Score:2)
Think of the clean up contracting over time for every email opened and clicked.
The renting of new tools after a criminal malware event that are then suggested.
The US party political cyber news if the very average criminal malware is "Bear" or "Russia" related too.
What would happen if workers did not click? Thats money off the table for contractors who have to have AV products to sell.
Our State IT department conducts these tests, too (Score:1)
The problem is that they also use a number of 3rd party vendors (with non-State domains) to host various official systems. They conducted a mandatory survey of employees once (survey monkey, iirc) and had to send out a follow-up e-mail telling everyone that the first e-mail was real and was safe to click on. Apparently, a large percentage of people were reporting the e-mail as a phishing attack or simply ignoring it.
It didn't help that the mandatory yearly cyber-security training came out shortly before t
ahem (Score:3)
That's of State of Michigan workers, not "Michigan workers". (Before the coasties get too smug)
(Then again, I wouldn't expect much better from a typical company. Anywhere.)
Management's fault (Score:2)
I got probed at work like this (Score:2)
I configure my mail clients to only put my inbound in my inbox if you're in my collected addresses. When the report came out, it was an email I simply never saw. But... about 1/3 of this high tech company got phished. On the downside I kinda sorta failed because I didn't report the suspicious email. Meh.
ANTHEM legit communication looks like phishing! (Score:1)
AC for obvious reasons.
Got a phone call from Anthem. They left a voice mail with a number of personal details (name of family members) and asked for a call back to some 1-800 number, The originating phone number was not listed on their web site. I called back the 1-800 number and it asked for personal details such as date of birth. "To make sure it's you, please enter your date of birth."
Uh... No.
I hung up and sent my HR department a note telling them that someone was conducting a phone phishing campaign on
Any design where people must do the right thing... (Score:2)
...all the time has already failed.
Re: (Score:2)
Michigan has been the home of communism since Henry Ford died.
Back in the days when communists were red and conservatives were blue, i.e. before a TV channel employee got the two mixed up in a poll presentation and the wrong colours stuck in the minds of largely ignorant Americans.
What we have in the US these days is brown.
Re: (Score:2)
Holy frak guys, just start the second civil war already. The rest of the world knows it's coming, might as well just get down to it.
Re: (Score:2)
Holy frak guys, just start the second civil war already. The rest of the world knows it's coming, might as well just get down to it.
In before Han shoots first!
Re: (Score:2)
Michigan turned red in 2016. Conservatives like you are really a stupid bunch, but we knew that already.
One election doesn't change the dozens of years of voting history
Re: (Score:1)
Michigan has a republican governor, state senate and state house, and has for the last 8 years. It's had a republican senate for the last 12 years. Currently, in the house and senate, they have a super-majority.
We've got one of those fine cases of gerrymandering. Michigan isn't as extreme as some other places, but our districts have been drawn to "crack" and "pack" to pretty much hand the republicans the majority. My district is 9 houses wide at my section, and extends 6 miles in each direction where th