Cyber Security Awareness: Malware & Spear Phishing

Watch on YouTube

Careful where you click and what you plug into your computer. There are all sorts of threats out there.

Phishing Attack

Watch on YouTube

It's not usually viruses, per se, that are in modern phishing attacks. This might be a hold-over from a time when people used the term virus to mean any kind of malicious software. Thankfully people have figured out the proper term for that is must malware.

That sinking feeling

from here and here (image source)

Sometimes I wonder what average folks think of when they hear computer security terms. Obviously phishing has nothing to do with water (unless maybe you're using a yacht as bait or something)

Scam Messaging Service

from here and here

Opting out of having a cell phone isn't easy. There are lots of things I can't do, lots of sites I can't use, lots of accounts I can't restore, etc. But you know what? there are more ways to get scammed over SMS than there are people I want to talk to, so no thank you. I wonder if the same thought has crossed the mind of this person who recently got scammed by a phony Canada Post text.

The only winning move is not to play

found on eBaum's World

You'll never be caught clicking on the wrong thing if you never click on anything.

One more reason not to get the checkmark

from here and here

Phishing that targets verified Twitter users seems like important people problems. If you're one of those people then watch out. I think most people aren't, however.

There's a reason he only got one victim

from here and here

I'm sure I'm not the only one who has seen the results of some comically misconfigured spambots before. I fully expect there are other misconfigurations that are just so broken that no one would ever see the results, except maybe the attackers themselves.

Does it involve worms?

from here and here

I'm not sure why phishing over different mediums requires different words, or why it is that all these different -ishings are so annoying, but they are so let's not make any more of them.

Catphishing In Progress laptop skin

Product Page

This seems like the kind of thing that might appeal to certain members of the red-team community.

Phishing shirt

 

Product Page

Don't get caught unaware by a phishing attack, or if you do, don't be wearing this shirt when you report it to your IT department (they will not appreciate the irony)

Maybe I should click on all the things

from here

While it's true that a COVID-themed phishing test is exactly what criminals would do, it's also true that this is exactly how you create disgruntled workers who sabotage operations, either through negligence or malicious action. West Midland Trains needs to learn how to read the room and keep their employees on their side.

At least he's not holding up a dead animal

from here and here (image source)

I hear there are a lot of guys who put a picture of themselves holding up fish in their Tinder bio and I have no idea why they think that's good but I couldn't resist the pun.

Gone Phishing mask

Product Page

Probably not the kind of mask if you're trying to socially engineer someone in person, or maybe it is. Most people probably don't even know what phishing is, so one might reasonably assume the mask won't give away your intentions.

And for those who do know what it means, you could just tell them you're trying to raise awareness of a cyber-security threat everyone faces. You know, like I am right now.

Plain-text shows the plain truth

from here and here

Scammers don't even bother to hide the truth when it comes to plain-text email. On the flip-side, however, they're often much better at generating the plain-text portion of their HTML emails than the businesses they're trying to impersonate.

On an unrelated note, I wonder if OK Scammer could catch on the way OK Boomer did. I know I want to direct that kind of derision at scammers - how about you?

It Wasn't Me - A Video Parody on Phishing

Watch on YouTube

Listen closely to this song, it contains valuable lessons about being skeptical of people reaching out to you over the Internet and asking for sensitive information. They're frequently not who they claim so you need to get in the habit of finding ways to contact the real organization they claim to represent and verify the authenticity of their claims.

Gone Phishing tote bag

Product Page

I thought this was a clever design. I imagine people asking questions about it, and those questions could be learning opportunities.

It's a trap!

found on Art Of Trolling

If you see emails like this, don't click the provided link. It's absolutely not legit. Take a look at the email address(es) for one thing. Also it follows all the classic patterns for a phishing scam - it's vague, it generates a sense of urgency by telling you your account is going to be deleted, and it tells you to log in with the link provided and enter more information in order to prevent that from happening. The link will go to a fake login page where they'll steal your username and password, and that extra information they want you to enter afterwards is to steal even more information, perhaps credit card information or answers to security questions so they can break into other accounts besides just your email - though once they get into your email account they can use the forgotten password feature for your other accounts to gain access to them because they'll mostly work by sending you codes and/or links to your email account that they now control.

The Defence Works: Phishing Emails In Real Life

Watch on YouTube

The interactions that phishing emails try to employ really don't stand up to scrutiny when used in the real world, do they? Honestly, it would be creep as fuck if a guy from your bank actually sat down beside you on a park bench to discuss a problem with you. How the fuck would your bank even know you were there?

Phishing Security Awareness Poster

Product Page

I suppose this would be a little too wordy for a t-shirt, but as an office poster it works quite well, and the designer has an entire range of merchandise like this.

The Modern Rogue: Why People Still Fall For Phishing Scams

Watch on YouTube

Lots of great information and strategies discussed in this episode (there are apparently quite a few more about a variety of security topics).

I'd actually never heard of laser phishing before. That didn't used to be a thing. I guess technology has finally advanced far enough for that to work.