On Sat, Sep 21, 2013 at 12:49 PM, Ken Dibble <[email protected]> wrote:
> > Well yeah, I actually did that exact Google before I sent this message. > It's people's reasoning that I don't understand. > I thought you would :). It's people in dead-end, low-wage, low-morale work whose job it is to open files sent in by random people and punch in invoices, hours worked, or orders into systems are the perfect target for this kind of targeting. Or clueless guys who get the email, "Here's those pictures of that beautiful girl I promised you, " perhaps spoofed to look like a buddy's email. Or gullible people. Or people too rushed who get caught by accidental oversight. > What are the odds that the recipient actually had a recent conversation > about a file with a person chosen at random by a bot to put in the "From" > field of that email? And then the person told the recipient that s/he was > going to send the file in a zip archive. I mean really? > Well, maybe one in a million? But divide those long odds by the cost - zero - to send the message, and the potential earnings - bazillions - if you can compromise yet another machine to add to the botnet. And this assumes a random, phishing attack, and not a spear-phishing attack specifically targeting a user. If you want the clerk in a accounting to open a file, you spoof an email from the VP by name citing discussions with her boss, again by name, that "he was the one to get this project done, and it needed to be done ASAP!" > This is what I mean about risk-benefit analysis. Organizational "security > experts" have taken to blocking all zip file attachments, and even have > resorted to forcing people to use a file drop to pick up attachments > instead of allowing them to come in with an email. > For some of my clients email accounts, 85% or more of the email is spam, most of it obvious garbage, but some of it fairly sophisticated social engineering, "eBay reciepts" or "VISA declined your payment" that trick fairly savvy people into opening it. And again, the economics are such that it is nearly free to send a million of these emails, and anyone you catch puts money in your pocket. > If you just tell people not to open any attachment that they don't know > exactly what it is, you've achieved the same level of security without > inconveniencing anybody or spending any extra money. > And if you tell people they should always have protected sex, AIDS infections would stop tomorrow. In theory, theory and practice have the same outcome. In practice, not so much. -- Ted Roche Ted Roche & Associates, LLC http://www.tedroche.com --- StripMime Report -- processed MIME parts --- multipart/alternative text/plain (text body -- kept) text/html --- _______________________________________________ Post Messages to: [email protected] Subscription Maintenance: http://mail.leafe.com/mailman/listinfo/profox OT-free version of this list: http://mail.leafe.com/mailman/listinfo/profoxtech Searchable Archive: http://leafe.com/archives/search/profox This message: http://leafe.com/archives/byMID/profox/CACW6n4tbQ-SQZ4mor3SijW3jbDK71VWQje+EXN6jCxGUNG=w...@mail.gmail.com ** All postings, unless explicitly stated otherwise, are the opinions of the author, and do not constitute legal or medical advice. This statement is added to the messages for those lawyers who are too stupid to see the obvious.
