Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
Security Networking IT

1 in 3 Michigan Workers Tested Opened A Password-Phishing Email (go.com) 119

An anonymous reader quotes the AP: Michigan auditors who conducted a fake "phishing" attack on 5,000 randomly selected state employees said Friday that nearly one-third opened the email, a quarter clicked on the link and almost one-fifth entered their user ID and password. The covert operation was done as part of an audit that uncovered weaknesses in the state government's computer network, including that not all workers are required to participate in cybersecurity awareness training... Auditors made 14 findings, including five that are "material" -- the most serious. They range from inadequate management of firewalls to insufficient processes to confirm if only authorized devices are connected to the network. "Unauthorized devices may not meet the state's requirements, increasing the risk of compromise or infection of the network," the audit said.
This discussion has been archived. No new comments can be posted.

1 in 3 Michigan Workers Tested Opened A Password-Phishing Email

Comments Filter:
  • by Anonymous Coward on Saturday March 17, 2018 @07:45PM (#56277297)

    We have similar results during my companies initial phishing test so I suspect that this result is not uncommon. Sending out training and multiple rounds of phishing test emails (which then require more training if you click) is the ONLY way to bring this number down. The users need to be made as paranoid as possible before clicking ANY links. After a year and a 1/2 we still have a few repeat offenders who still click on the links or enter username/passwords so Multi factor authentication was implemented, but its far far less then we previously had. Posting as AC for obvious reasons.

    • by Anonymous Coward

      We get those at work too. I use them as a convenient excuse to not participate in charity fund raisers that the social committee promotes by email. ("Oh I thought this was phishing")

      • by mikael ( 484 )

        Did the same to the debt collection department of my credit card bank who called me up; Indian accent - check, city with high social deprivation - check, telephone number with no SMART id (don't know what SMART is, but if the number doesn't have it, it must be a phishing attempt - check). Just make up some names and numbers and drop the call when they asked for my debit card number. Wouldn't they know that if they were from the bank? Tell them the cheques in the post.

    • by arth1 ( 260657 )

      Sending out training and multiple rounds of phishing test emails (which then require more training if you click) is the ONLY way to bring this number down.

      No, firing and hiring people with a healthier level of suspicion should work too.
      Testing gullibility should be part of applicant screening. If the applicant has given an e-mail address, that's one way of testing. During job interviews is another.
      Bonuses for those who never fall for phishing could also be a good idea, helping retain those who Get It.

      That said, dinging people for "opening" an e-mail is probably not correct. Looking at the e-mail context as plain text is harmless. There's a huge difference

      • No, firing and hiring people with a healthier level of suspicion should work too.

        These are state employees, so firing them for incompetence is not an option.

        • by arth1 ( 260657 )

          These are state employees, so firing them for incompetence is not an option.

          Not hiring gullible people might, though.
          People leaving might be slow, but certain. And if bonuses to those who don't fall for such things might help speed attrition.

  • by Snotnose ( 212196 ) on Saturday March 17, 2018 @07:47PM (#56277301)
    I've got the sender and subject visible to me, if they look legit of course I'm gonna open it. I don't click links unless it's something like a new website setup or lost password reset or somesuch where I'm expecting a message. I never enter logins nor passwords to links I get in email.

    In other words, opening the email isn't (err, shouldn't be) the problem. It's what you do after that that's the problem.

    Then again, I don't use Outlook so opening the email isn't all that hazardous to me.
  • Bad metrics (Score:5, Insightful)

    by lgftsa ( 617184 ) on Saturday March 17, 2018 @07:47PM (#56277303)

    1/3 opened the email? That means that 2/3 don't read their email.

    You can't tell if it's a phish just by the subject line and the displayed sender name, you have to at least check the sender email address, path headers and link html to make an informed decision.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      2/3 of slashdot users don't read the article summary.

    • by arth1 ( 260657 )

      I hope they mean that 1/3 opened it in a client that fetched external content or ran a script that connected remotely.

    • Re:Bad metrics (Score:4, Interesting)

      by sheramil ( 921315 ) on Saturday March 17, 2018 @10:56PM (#56277931)

      You can't tell if it's a phish just by the subject line and the displayed sender name, you have to at least check the sender email address, path headers and link html to make an informed decision.

      You'd think so. I got an email from someone claiming to work for the Taxation Office. It looked suspicious so I ignored it. Then I got a phone call from someone with an Indian accent, following up on the email. I hung up on them and checked the number; a couple of websites claimed the number belonged to a group of spammers, and some posts said it was a legitimate number from the Taxation Office - as you might expect. I searched the ATO website and couldn't find the number... I spent a couple of days chasing it up; it turned out it was from the Taxation Office, and they wanted to do a phone audit. When I mentioned the problems I had determining the legitimacy of their inquiry, they didn't seem to care.

      • they didn't seem to care.

        And yet they corrected that problem anyway. You don't get emails from the Taxation Office anymore. Or rather they moved it. The only correspondence you should get now are via messages posted to you online through the my.gov portal.

        • by arth1 ( 260657 )

          And yet they corrected that problem anyway. You don't get emails from the Taxation Office anymore. Or rather they moved it. The only correspondence you should get now are via messages posted to you online through the my.gov portal.

          Wot, an arm of the Australian government has hacked my.gov to use it for communicating with their citizens?

          • Hacked? Wtf are you talking about? My.gov is the official communications portal for government services including tax.

            • by arth1 ( 260657 )

              My.gov is the official communications portal for government services including tax.

              I repeat: The GP is in Australia.
               

              • I repeat: The GP is in Australia.

                ... and you're repeating yourself why? : http://my.gov.au/ [my.gov.au]

                • by arth1 ( 260657 )

                  ... and you're repeating yourself why?

                  Because you do?

                  my.gov.au != my.gov, and my.gov is what you said. Twice.

                  • I invite you to click on the link and see what they call themselves.

                    I also invite you to go to www.my.gov and realise why you won't get an email from that site either.

    • by Bert64 ( 520050 )

      Most email clients don't make it especially simple to show where links are actually pointing, you used to get a statusbar which showed the actual target (in browsers too) but thats uncommon now too. And most users wouldn't know what this meant anyway.

      Most mail clients only show you the From: header field, while most mail servers only perform filtering on the envelope from, so its quite easy for someone malicious to bypass filtering and still make it look like the mail came from someone you know. It's not ha

      • by gtall ( 79522 )

        There are two additional problems. Most users wouldn't know how to read the entire email header even were it visible. And checking up on all the dodgy emails? C'mon, who has time to do that?

  • Seriously, these phishing scams have been going on for far too long now and cost billions. If there is information that can not be disseminated people should be directed to go to a well vetted website.

    • by Anonymous Coward

      What is your solution for replies. There will always be risk with 2 way communication

    • Don't worry. Microsoft is working on making links in e-mail useless [slashdot.org].

  • secured ? (Score:5, Interesting)

    by johnjones ( 14274 ) on Saturday March 17, 2018 @08:10PM (#56277401) Homepage Journal

    the email system never verified the URL nor where the email was from

    so your email system is so poor you have to rely on the end user not to click on a link ?

    simply block / rewrite URL's that have not been verified

    only accept mail from domains that have been verified and claim the email is from them
    (for example that have DNSSEC and DANE setup correctly as gov address's have this and can therefore prove that they sent the email)

    simple basics that are not the end users fault

    • Re:secured ? (Score:5, Insightful)

      by Sarten-X ( 1102295 ) on Saturday March 17, 2018 @09:31PM (#56277757) Homepage

      There is no technical solution for user awareness.

      Sure, you can verify senders... then you only get spam from compromised hosts, or free relays/mass-mailers, or any other way that attackers are increasingly using to get around such things.

      You can mangle unrecognized URLs... but then your users complain that their legitimate emails from partners and vendors aren't getting through properly (especially when they just signed the contract), and it still doesn't help when the attackers use bit.ly and other common services to hide.

      Once all that has failed, you're still relying on end users to not click links... but if you sold your boss on this "simple basics" security checkbox, you suddenly realize that you never got funding for a user-education course, and that targeted phishing campaign is now wildly successful and claiming victims across your enterprise.

      Sure, go ahead and include all of that technical wizardry, and it will indeed reduce your exposure, but please don't spread the myth that a technical barrier is a one-step fix for email security problems. Users are the last bastion of a defense-in-depth solution, which is also one of those "simple basic" concepts.

    • by Anonymous Coward

      Rewriting URL's is in theory good-- but in reality, try having a technical discussion with someone that involves web development or administration.

      Better yet, try following a vendor-supplied link to their support site. Or activating your account on a vendor site.

      URL rewriting makes email practically useless for my job.

  • They like their phishing up there.
  • by nospam007 ( 722110 ) *

    Around 20% of the population have an IQ under 85, that should be about it.

    I guess lots of them have a MAGA hat. GDARVF

    • You nailed it, everything that has ever happened is somehow related to Trump. Some worker opens an email? Trump did that
  • This is tough ... (Score:5, Interesting)

    by CaptainDork ( 3678879 ) on Saturday March 17, 2018 @08:37PM (#56277513)

    ... and I dealt with it during my career. I'm a retired IT.

    I held seminars, talked to employees one-on-one, and damned if we didn't still get hit.

    It was a law firm and the staff never fell for phishing.

    My problem was the fucking lawyers, especially the managing partner!

    That bastard would click on anything.

    He got a goddam email that said his UPS package wasn't going anywhere unless he looked at the invoice and corrected the address.

    I asked him if he sent anything via UPS and he said, no.

    I asked him if he remembered signing an exclusive with FedEx that I negotiated and he did.

    I asked him if he, personally, ever sent a package anywhere or if he let his staff do that -- he said staff.

    He did that shit over and over again.

    --

    I'm waiting for AI to step in; predict the outcome of clicking on a link and forbidding forward progress until an IT person concurs.

    • ... and I dealt with it during my career. I'm a retired IT.

      I held seminars, talked to employees one-on-one, and damned if we didn't still get hit.

      It was a law firm and the staff never fell for phishing.

      My problem was the fucking lawyers, especially the managing partner !

      That bastard would click on anything.

      He got a goddam email that said his UPS package wasn't going anywhere unless he looked at the invoice and corrected the address.

      I asked him if he sent anything via UPS and he said, no.

      I asked him if he remembered signing an exclusive with FedEx that I negotiated and he did.

      I asked him if he, personally, ever sent a package anywhere or if he let his staff do that -- he said staff.

      He did that shit over and over again.

      --

      I'm waiting for AI to step in; predict the outcome of clicking on a link and forbidding forward progress until an IT person concurs.

      Was his name Homer?

    • by cyn1c77 ( 928549 )

      ... and I dealt with it during my career. I'm a retired IT.

      I held seminars, talked to employees one-on-one, and damned if we didn't still get hit.

      It was a law firm and the staff never fell for phishing.

      My problem was the fucking lawyers, especially the managing partner !

      That bastard would click on anything.

      Obviously, he was looking for someone to sue!

  • by Mozai ( 3547 ) on Saturday March 17, 2018 @09:04PM (#56277655) Homepage
    "Opening" an email is tracked by whether an image in the HTML version of the email was fetched. Too many email clients will pre-fetch images so that it will look better or open faster when the human user finally does click on the item in their inbox. Knowing government employees, they aren't allowed to chose email software for work, and the config settings are locked-down. I expected that "opened the email" statistic to be way higher because government employees usually don't have a choice.

    The 20% is the important statistic and that's scary enough already; no need for ABC News to embellish the story.

    • Good idea, but you have some problems. If they're not in control of their clients and the clients were pre-fetching the images, wouldn't you expect it to be much higher than [some percent?] If the policy changes from team to team, you already gave up your whole "gubermint no choices" narrative.

      Also at the other end, there are people like me who don't let the client display images even when I "open" (read: read) the email. It seems pretty silly to me that I think I might be getting a targeted attack message,

  • by hibiki_r ( 649814 ) on Saturday March 17, 2018 @10:05PM (#56277829)

    I've been a part of aggressive, well crafted phishing tests in Silicon Valley companies. Some of those tests were secret enough that only 3 people were aware of the test in advance... and the results were terrifying. Thanks to HTML abuse, forged headers and very good copy, I've seen 70% of storied security teams fall for the phishing attempt, going as far as to enter their 2fa values for AWS. In a real world situation, just one person falling for it would have been a problem.

    In practice, what I have learned is that against a sophisticated opponent, any security system that relies on just usernames, passwords, and simple 2fa might as well not exist. The bare minimum is unique usernames and passwords just to double check that the right human is on the other side, attached to client certificates that are unique to each machine, and strong mechanisms to make sure that nobody generates user + certificate pairs for new computers without big flashing signs popping up. Anything weaker is just relying on being an uninteresting target, which is not a good thing to rely on.

    • by mikael ( 484 )

      We had courses at my work place. Things to look for include mis-spelt words, links that didn't use https and/or moved to a different domain from the sender. Which makes me ask, why couldn't an email filter pick this up.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        We had courses at my work place. Things to look for include mis-spelt words, links that didn't use https and/or moved to a different domain from the sender. Which makes me ask, why couldn't an email filter pick this up.

        That's also my question.
        How often do corporations of any size used spoofed headers for business emails? They do that for their newsletters, advertisements, and email surveys and crap, yes, but not for invoices and person to person communications.

        I wish our email client had a configuration to flag to the user "This email's sender does not match the actual origination." As well as "This email appears to have originated in Bulgaria". If we actually had a vendor in Bulgaria, the people who handled that

      • I include, "asks me to do something that would be really non-secure and provides a link to make it convenient."

        Security and convenience are a trade-off, if you're distributing real information to technical workers that they would take actions based on, you don't want to even try to make it convenient with links. You want to just give them the data: "Foo has problem Bar, please log into your Secure BlahBlah and don't forget to wipe the cargo port with the rubber chicken." No link. If they don't know how to a

    • by raymorris ( 2726007 ) on Saturday March 17, 2018 @11:13PM (#56277991) Journal

      I have found that when the security team sends out "phishing" emails about once a month, that helps. Opening the link takes the employee to a page reminding them about phishing. If instead they click the "report" button in Outlook, they get a happy message. It changes behavior after a few months.

    • by AHuxley ( 892839 )
      Great for contractors renting AV gov/mil solutions too.
      Think of the clean up contracting over time for every email opened and clicked.
      The renting of new tools after a criminal malware event that are then suggested.
      The US party political cyber news if the very average criminal malware is "Bear" or "Russia" related too.

      What would happen if workers did not click? Thats money off the table for contractors who have to have AV products to sell.
  • The problem is that they also use a number of 3rd party vendors (with non-State domains) to host various official systems. They conducted a mandatory survey of employees once (survey monkey, iirc) and had to send out a follow-up e-mail telling everyone that the first e-mail was real and was safe to click on. Apparently, a large percentage of people were reporting the e-mail as a phishing attack or simply ignoring it.

    It didn't help that the mandatory yearly cyber-security training came out shortly before t

  • by cascadingstylesheet ( 140919 ) on Saturday March 17, 2018 @11:13PM (#56277989)

    That's of State of Michigan workers, not "Michigan workers". (Before the coasties get too smug)

    (Then again, I wouldn't expect much better from a typical company. Anywhere.)

  • Quick search revealed at least a dozen companies that offer phishing tests to employees, to send fake phishing emails to them to see if they open and click on links. If management isn't using these tools when so many are available they're as much responsible as if they chose not to use virus scanners or network firewalls. And why doesn't Google, Microsoft and the other email providers do more by sending fake phishing emails out to educate users more? All it takes is a few fake phishing emails to educate
  • I configure my mail clients to only put my inbound in my inbox if you're in my collected addresses. When the report came out, it was an email I simply never saw. But... about 1/3 of this high tech company got phished. On the downside I kinda sorta failed because I didn't report the suspicious email. Meh.

  • AC for obvious reasons.

    Got a phone call from Anthem. They left a voice mail with a number of personal details (name of family members) and asked for a call back to some 1-800 number, The originating phone number was not listed on their web site. I called back the 1-800 number and it asked for personal details such as date of birth. "To make sure it's you, please enter your date of birth."

    Uh... No.

    I hung up and sent my HR department a note telling them that someone was conducting a phone phishing campaign on

Happiness is twin floppies.

Working...