@PocketBrain@unksol That’s what we teach users, yes. But at the same time, we all know that like 80% of people are definitely that dumb and untrainable, and smarter folks’ time will be wasted unfucking their idiot relatives’ and managers’ computers.
07:11, a postdoc in a PII-sensitive computational field at a high-ranked school: “I think I shouldn’t respond to this extremely obvious phishing email, can you confirm?”
07:16, same guy: “I thought about it and I didn’t want my account get locked so I sent them my password, please let me know if that was right.”
I don’t do desktop, but I’m pretty sure his ass got reimaged without prejudice.)
The prosocial thing would be to put the kibosh on this foolishness.
@PocketBrain@unksol@whogots I would love to spend some time inside that postdoc’s head. Watching people use computers in an unfamiliar way is fascinating. If you try hard enough, you can usually come up with plausible stories about things people don’t know that explain their behavior. I have never squared that brand of smart idiocy, though. I mean… eh. At least he kept you in the loop.
That type of scam is intended to get you into a panic; your rational brain shuts down in a panic, to make you clutch your purse, hike up your skirt, defend your goodies without rationalizing about it. How much junk mail has “LAST NOTICE!” printed on it? Also the IRS scam thing with the robot voice saying your local Sheriff has a warrant on you, that you can cancel by paying off your tax bill over the phone right now. Panic. The best antidote is to be informed and educated. My company actually sends out fake phishing emails; once I did a whois on the link and figured out it was owned by the corp. I attached the email according to policy and sent to our CIRT with the text, “nice try” and the results of the whois report. Now they only use fake URLs registered through 3rd and 4th parties so it’s not so quick and easy to track. I still try to identify which ones are the corp. testing people and respond with “nice try.”
@PocketBrain@unksol@whogots I mean, something like, “I’m a inportant doctor. If my account is locked, I can’t work. But I was supposed to not email my password to informatien@passwords_tchnolology.ru – what a conundrum. I will contact IT.”
… five minutes later…
“I’ve been standing here an entire hour. I’ve got to get back to my… tasks. I’ll just send the password. It’s probably IT, and even if it’s not, it’s probably not a targeted attack, so it can probably get fixed before it’s an issue, and I don’t have to wait for an indeterminate time, possibly disrupting the entire day.”
The solution is a shock collar that goes off whenever his password is in an outgoing email. You’re thinking “but then we have to store the password locally for comparison”. Sure, but you know it is daughter name + birthday anyways, so that he can remember those two pieces of information by typing them in frequently.
But I digress.
Point is, it’s usually unfixable missing knowledge and context more than rank stupidity.
Man, they are doing it everywhere that has a referral counter. I thought it was just deals sites, but NOOOO, apparently hit the “Maranatha Rottweiler Kennel”? An internet hotspot if I’ve ever seen one.
I need to stop looking at this and get to my Monday meeting slalom, but if someone can send a screenshot, a link, and a Google search to firstname.lastname@example.org and email@example.com, that’d be cool of you.
@dashcloud You can’t uncheck the “share this report with website owner” box on the reporting form. Gross gross gross… defo removing us from this report and letting them chew on the hundreds of other sites that were attacked.