PhishMe Blog

STAY CURRENT ON INDUSTRY TRENDS & PHISHME NEWS

Phishing for User Awareness

BY PhishMe IN Blog

A recent survey of over 279 IT Executives indicated that the greatest security challenge they faced was building an effective security awareness program and encouraging their employees to embrace it.  Employees, albeit unaware, oblivious or unconcerned, continue to fall prey to conniving social engineers compromising sensitive data protected by millions of dollars worth of technology. The return on investment on building user awareness is apparent and no longer a hard sell for IT security staff. The real problem lies in building an effective program that actually changes the mindset of the employees.  In a society where 90% of recovering coronary…

READ MORE

0 comments

Dirty Dirty Wi-Fi: AT&T Wi-Fi Service Phishing?

BY PhishMe IN Blog

I’m sitting at Dulles airport right now, at gate C19, on my way to Vegas. I’m excited to catch up with friends and colleagues at BlackHat this year.  I realized a few days ago that my 81 slide presentation for DefCon isn’t for a 75 minute slot.. instead I’ll be trying to fit it into a 50 minute slot! Wish me luck! Public Wifi is so dicey… I would never use it for anything other than entertainment during delays.  If I need to get work done I hop on EVDO.  Captive portals are everywhere… and if you pay much attention to…

READ MORE

0 comments

Harry Potter Phishing Attack: Fact or Fiction?

BY PhishMe IN Blog

On June 19th a spoiler for the next Rowling book Harry Potter and the Deathly Hallows was posted to the full disclosure mailing list: http://seclists.org/misc/harrypotterspoilers.html (WARNING: If you’re a Harry Potter fan you may want to hold off reading it.) The spoiler was nothing more than a summary of which main characters allegedly die in battle with Voldemort and other rivals. What is more interesting is how this book was allegedly obtained. The author of the messages claims he launched a phishing attack against Bloomsbury Publishing. “The attack strategy was the easiest one. The usual milw0rm downloaded exploit delivered by…

READ MORE

4 comments

iPhone Phishing Bait: would you like fries with that?

BY PhishMe IN Blog

We’ve all heard there’s no such thing as a free lunch, but this is not always easily remembered when online. The latest example of that is the number of iPhone related phishing messages that had flooded my inbox while I was on vacation. Some of the links didn’t even need to claim it was a ‘free’ deal; just a site claiming to have the cool tool in stock was enough to get clicks. Of course this is nothing new. Go back and replace ‘iPhone’ with ‘Wii’ or ‘PSP’ or ‘Nano’ and you get similar results. As a gadget geek, I’m always at least a…

READ MORE

0 comments

McAfee’s “Groundbreaking” Phishing Study

BY PhishMe IN Blog

Recently, I came across a press release by McAfee citing the results of a “groundbreaking” study that talks about the psychological games played by phishers and email scam artists. The results of the study indicated that “cyber criminals use fear, greed and lust to methodically steal personal and proprietary financial information”. Frankly, I didn’t see anything groundbreaking in those results. Don’t we all know that social engineers (including phishers) have to play with people’s psyches to get them to click on links and submit personal information? The study did however quote some interesting statistics from a 2006 Gartner study: Cumulative loses stemming…

READ MORE

0 comments

Rohyt Cited in Industry Week Article

BY PhishMe IN Blog

Brad Kenney interviewed me about the unique information security challenges faced by manufacturing companies. Excerpts from that interview can be found in his IndustryWeek story –  From ID to IP Theft. Moral of the story: Large employee bases whose skill set is not in technology, coupled with fragmented operations make the job of an information security officer in the manufacturing sector very challenging. -Rohyt

READ MORE

1 comment