this post was submitted on 28 Jan 2024
93 points (97.0% liked)

No Stupid Questions

35393 readers
6 users here now

No such thing. Ask away!

!nostupidquestions is a community dedicated to being helpful and answering each others' questions on various topics.

The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:

Rules (interactive)


Rule 1- All posts must be legitimate questions. All post titles must include a question.

All posts must be legitimate questions, and all post titles must include a question. Questions that are joke or trolling questions, memes, song lyrics as title, etc. are not allowed here. See Rule 6 for all exceptions.



Rule 2- Your question subject cannot be illegal or NSFW material.

Your question subject cannot be illegal or NSFW material. You will be warned first, banned second.



Rule 3- Do not seek mental, medical and professional help here.

Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.



Rule 4- No self promotion or upvote-farming of any kind.

That's it.



Rule 5- No baiting or sealioning or promoting an agenda.

Questions which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.



Rule 6- Regarding META posts and joke questions.

Provided it is about the community itself, you may post non-question posts using the [META] tag on your post title.

On fridays, you are allowed to post meme and troll questions, on the condition that it's in text format only, and conforms with our other rules. These posts MUST include the [NSQ Friday] tag in their title.

If you post a serious question on friday and are looking only for legitimate answers, then please include the [Serious] tag on your post. Irrelevant replies will then be removed by moderators.



Rule 7- You can't intentionally annoy, mock, or harass other members.

If you intentionally annoy, mock, harass, or discriminate against any individual member, you will be removed.

Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.



Rule 8- All comments should try to stay relevant to their parent content.



Rule 9- Reposts from other platforms are not allowed.

Let everyone have their own content.



Rule 10- Majority of bots aren't allowed to participate here.



Credits

Our breathtaking icon was bestowed upon us by @Cevilia!

The greatest banner of all time: by @TheOneWithTheHair!

founded 2 years ago
MODERATORS
 

I read an article about ransomware affecting the public transportation service in Kansas, and I wanted to ask how this can happen. Wikipedia says these are "are typically carried out using a Trojan, entering a system through, for example, a malicious attachment, embedded link in a phishing email, or a vulnerability in a network service," but how? Wouldn't someone still have to deliberately click a malicious link to install it? Wouldn't anyone working for such an agency be educated enough about these threats not to do so?

I wanted to ask in that community, but I was afraid this is such a basic question that I felt foolish posting it there. Does anyone know the exact process by which this typically can happen? I've seen how scammers can do this to individuals with low tech literacy by watching Kitboga, but what about these big agencies?

Edit: After reading some of the responses, it's made me realize why IT often wants to heavily restrict what you can do on a work PC, which is frustrating from an end user perspective, but if people are just clicking links in emails and not following basic internet safety, then damn.

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 62 points 10 months ago (2 children)

It doesn't matter how strong your defenses are and how skilled your IT team is, when fucking Linda in accounting opens EVERY SINGLE GODDAMN ATTACHMENT SHE GETS!!!

[–] [email protected] 10 points 10 months ago (4 children)

She’s had poor training I guess. SEBKAC! Security exists between keyboard and chair

[–] [email protected] 11 points 10 months ago (3 children)

Linda has a standing desk. Checkmate, hackers!

load more comments (3 replies)
[–] [email protected] 7 points 10 months ago

Some people aren't trainable.

load more comments (2 replies)
[–] [email protected] 6 points 10 months ago (1 children)

Then the IT department sends everyone a Honeypot email and schedules more training and a meeting with a manager for anyone who clicks any links in the email.

load more comments (1 replies)
[–] [email protected] 35 points 10 months ago (1 children)

Attackers have to be right once. Defenders have to be right every time.

Also, user.

[–] [email protected] 10 points 10 months ago (1 children)

"i wonder whats on this flashdrive"

load more comments (1 replies)
[–] MajorHavoc 34 points 10 months ago* (last edited 10 months ago) (2 children)

Wouldn't anyone working for such an agency be educated enough about these threats not to do so?

Ahahhahhahha. Ahem. Hahahahahaha. Give me a moment to compose myself.

Thank you for that moment.

Anyway, the assumption is very reasonable. And, oh how I wish it were so.

But the answer is no, they're human, and even high tech organizations need specialists in other subjects (law, finance, book-keeping, etc) who aren't at all technology savy.

To be clear, education is such subjects is often mandatory. It just doesn't always take. Largely because many staff watch the educational video, and think they understood it, but don't really have any context for it. For example, they might learn it and still think, "Well, it clealy doesn't apply to an email from our CEO. He wouldn't send something nasty!"

Edit: The solution I've seen is a lot of education. It's not enough to say "don't click suspicious links", there's got to be ongoing training on the definition of "suspicious".

[–] [email protected] 13 points 10 months ago (4 children)

The security team at the company I work for sends out test phishing emails and if you fall for it they make you change your password. I think this annoyance helps people learn to pay attention. It doesn't seem like we have had to do as many resets due to these as time goes on.

load more comments (4 replies)
[–] [email protected] 6 points 10 months ago

Yes, this makes sense. I can also say from observing co-workers at different jobs, any training that's provided virtually (e.g., you just watch a video and answer some questions), is mostly a waste of time. I can say that I and some others took these trainings seriously, but most people did not and would jump through the hoop as mindlessly as possible.

I saw this a lot when I worked as a CNA. People would just answer the questions right, "pass" the training, and then continue doing things in the same wrong way they'd always done things.

[–] [email protected] 34 points 10 months ago (1 children)

People are by far the biggest security risk. I have seen personally tailored phising scams that were even able to fool experienced secops staff.

[–] [email protected] 9 points 10 months ago (1 children)

Company I used to work for got hit fairly bad. Am email came in from the contract agency to the accounts payable clerk, personally addressed to her and signed off all informal like, to the effect of “hey Marion, our local bank branch is closing so we’ve had to move our accounts, can you update the IBAN to the following for me?”

€150,000 down a black hole, that wasn’t even noticed until a phone call came in a week later.

load more comments (1 replies)
[–] [email protected] 22 points 10 months ago (5 children)

Wouldn’t someone still have to deliberately click a malicious link to install it? Wouldn’t anyone working for such an agency be educated enough about these threats not to do so?

lol, lmao even. I worked IT for a hospital network for about 4 years. Doctors aren't any smarter than anyone else when it comes to using a computer, because it's not what they spent all their years studying. People click on dumb shit they shouldn't all the time, doesn't matter how "smart" they're supposed to be.

load more comments (5 replies)
[–] [email protected] 22 points 10 months ago (8 children)

I once did a Phishing test for a customer during an internship. We had 50% of all employees click the Phishing link, and 30% of all employees input their login info.

What was the form? A new data protection agreement (which was the current one copied from the firm's site) which required a login to accept.

These employees all got regular cybersecurity training, and yet they still fell for such an obvious fake login

[–] [email protected] 9 points 10 months ago (1 children)

They just clicked it from within the email? Damn.

Do you have any insight into how to make people more informed? I feel like everyone sees the average training as just a hoop to jump through.

[–] [email protected] 11 points 10 months ago (1 children)

Regular Phishing tests is the only way I know how. GoPhish is an open source tool to automate them, and I have had great experiences with it.

https://github.com/gophish/gophish

[–] [email protected] 10 points 10 months ago

Thank you so much! I'll ask our IT person if we can do something like this.

One of my co-workers has been scammed so many times in her personal life that I feel anxious thinking of her clicking a malicious link in her email at work.

load more comments (7 replies)
[–] [email protected] 19 points 10 months ago* (last edited 10 months ago) (2 children)

one of the primary tenets of IT is that end users do not read. they click things like crazy, even shit they shouldnt.

the bigger the company the worse this is because volume.

its almost always an attachment bomb, or a link to malicious packages on teh web.

[–] [email protected] 10 points 10 months ago (2 children)

I'm in somewhat of a leadership position in an agency. I feel like I should talk to those above me about having more training for my co-workers. This is a nightmare scenario.

[–] [email protected] 18 points 10 months ago* (last edited 10 months ago) (3 children)

the way we deal with this in my org is testing our own staff... we use a service that sends very well faked emails. They can look like they are from our own vendors/staff even.. but they contain invalid links that an end user should know are not valid.. these emails are technically 'compromised'. when an end user clicks a link, they are informed they failed, and automatically enrolled in one of our mandatory security training classes. every time they click a bad link.

the best part is we silently rolled this out and something like 80% of c-levels failed. they were soooo pissed... but what could they do?

[–] [email protected] 10 points 10 months ago (4 children)

I've worked for places that do this, and I've seen the same people having to do the same training every time these emails went out. I feel like they never learned from it. They'd even get pissed that they had to keep retaking the training, but I feel like it never occurred to them that they should maybe change their own behavior.

[–] [email protected] 9 points 10 months ago (4 children)

we do have an HR component attached to this. if youre consistently under-performing you will eventually be fired. hipaa and all that.

keeping every user to minimum required access also helps a bit.

load more comments (4 replies)
load more comments (3 replies)
load more comments (2 replies)
[–] [email protected] 6 points 10 months ago (2 children)

If you want more information on what your company can do to help protect against ransomware, CISA's stop ransomware site has good advice:

https://www.cisa.gov/stopransomware

load more comments (2 replies)
load more comments (1 replies)
[–] [email protected] 18 points 10 months ago (1 children)

I work in a public school. The older teachers are the ones that don't even look at the sender address. "Oh, this email that sort of looks like its from an employee says to blindly open this file that I would realize is clearly fake if I took more than two seconds to look at it? I'm on it!"

Our union negotiator didn't understand different sheets in Excel files. Had a document he wanted to share out on sheet one. For some reason on sheet two he had every union employee's name, birth date, social security number, address, etc. in plain text. Emailed to the entire school district. I caught it immediately and made them aware. The frantic emails to my friend the IT guy were hilarious. "I NEED YOU TO GO INTO EVERYONE'S EMAIL AND DELETE THE MESSAGE I JUST SENT." Then when it was explained that you can't just take it back, another frantic district email "DO NOT OPEN MY PREVIOUS EMAIL. JUST DELETE." Again, not understanding that unless they empty their trash, its still recoverable for 30 days.

[–] [email protected] 11 points 10 months ago (1 children)

There's so much here, holy crap!

But I've totally noticed the spontaneous mindless clicking among people with low tech literacy. Like, every single time I try to help someone navigate an application or web site, they're fundamentally incapable of following step-by-step instructions and will randomly click on anything they see on screen. It's so weird and frustrating.

[–] [email protected] 7 points 10 months ago* (last edited 10 months ago)

Dad: Hey son, next time you're over, can you have a look at our laptop. it's running slow for some reason.

Me: Yeh no problem. Have you installed any new programs recently?

Dad: No.

Me: Opens program files, sort by date modified... Shocked Pikachu face

[–] [email protected] 17 points 10 months ago (16 children)

A classic is to just drop of 2 or 3 infected USB sticks, maybe with bait labels, on the parking lot before the first employees arrive. repeat a few times and just wait until someone plugs it in to investigate.

another good trick is to infiltrate the cleaners.

load more comments (16 replies)
[–] [email protected] 15 points 10 months ago (5 children)

An advanced phishing attack can be incredibly hard to detect. Here's an example of a browser vulnerability that allowed malicious sites to spoof legitimate looking domains. It's been fixed since then, but it's a constant battle between fixing exploits and new ones being found. A sophisticated operator can come up with ways to trick even the most tech savvy user, and most users will fall for more obvious tricks than that.

load more comments (5 replies)
[–] [email protected] 15 points 10 months ago (1 children)

Through the holy trinity of gaping holes: Windows, Office, and Exchange. And add lazy or stupid sysadmins on top who don't care to update their stuff, they make break-ins even easier.

[–] [email protected] 15 points 10 months ago

Lots of sysadmins are also overworked and burnt out by stupid requests too.

[–] [email protected] 13 points 10 months ago (1 children)

Spearfishing is probably the lowest risk and easiest way to get access to a specific network. The attacker can get a bunch of info about an organization (technologies used, people employed, physical locations) through LinkedIn or whatever social media website, and then target a specific person.

Once a target is identified, the next step would be getting that person to follow a link to type in a password, or getting them to install malware, or do whatever it is the attacker wants them to do. I read an article about a dude that got fairly big companies to pay him money by just sending fake bills.

[–] [email protected] 10 points 10 months ago

I read an article about a dude that got fairly big companies to pay him money by just sending fake bills

I'm laughing so hard at this right now. That's so funny.

[–] [email protected] 12 points 10 months ago

Because some fucker working there clicked on some email he shouldn't have.

[–] [email protected] 11 points 10 months ago (3 children)
load more comments (3 replies)
[–] [email protected] 11 points 10 months ago

The MGM attack originated with calling their help desk pretending to be somebody inside. They found enough info on LinkedIn to be convincing enough to get credentials https://www.vox.com/technology/2023/9/15/23875113/mgm-hack-casino-vishing-cybersecurity-ransomware

[–] [email protected] 10 points 10 months ago (1 children)

Since people are covering the more common options, I'll point out a rarer one. If I remember right, (please correct me if I'm wrong) the Stuxnet virus was able to infiltrate a highly sensitive nuclear enrichment facility because someone planted a zip drive in the parking lot, and some employee went ahead and plugged it in at work to see what it was.

[–] [email protected] 6 points 10 months ago (5 children)

some employee went ahead and plugged it in at work to see what it was

Holy shit lmao. It just amazes me that someone working for such a facility would do this, but I suppose it's the same as people who won't wash their hands after using the toilet or who don't use their blinker when driving.

We're just a bunch of shit-flinging primates, aren't we? We just do thinks without thinking.

And the worst part is, given the right circumstances (lack of sleep, extreme stress, illness), maybe that person could be me.

load more comments (5 replies)
[–] [email protected] 9 points 10 months ago (1 children)

Can totally tell you, that most people do not care. They do get training and notifications but they don't try to learn. The only people that actually care about it are some techies and the CFO.

load more comments (1 replies)
[–] [email protected] 9 points 10 months ago* (last edited 10 months ago) (4 children)

I remember reading an article by a penetration tester years ago at this point. His company is hired by all sorts of companies to test their network security etc. He described one client that thought it had the best network security money could buy. The pen tester took a novel approach (at that time) and put a benign Trojan on a bunch of random usb sticks then scattered them around the employee parking lot, outdoor smoking areas, etc. sure enough some of them started “phoning home” from inside the clients network fairly quickly.

My own employer has been the target of phishing and other attacks over the years. Our security team now contracts with a company that randomly sends out well crafted phishing emails to employees to see if they can detect it or if they click on a questionable link in the message. If an employee clicks on one of these then they are immediately told that they failed a test and are automatically signed up for a training session on spotting phishing and other scams.

load more comments (4 replies)
[–] [email protected] 7 points 10 months ago* (last edited 10 months ago)

Smart people can still do dumb things. Some are also highly skilled in some areas but terrible in others. My uncle was a heart surgeon, but he was terrible at driving.

load more comments
view more: next ›