Employees Fail the Same Phishing Test

I worked in a place that had hired a professional company (maybe Mandant?) to see how quickly they could break into our systems. Some guy wandered in, past the lobby receptionist, a fucking hired guard let him into our training rooms when he claimed his badge didn't work, he went into an empty conference room, and then hooked up a laptop to our LAN and had administration domain access within 20 minutes off the street because the head of our help desk had all the credentials stored in plaintext in an old Keepass dump (to csv) on a public share. We had video footage from a tie-cam showing how easy it was. As far as employees, they were mailed a fake login screen, and out of 200 employees, 10 tried to enter in their logins and passwords within 5 minutes of the mailing before it was reported, which was pretty good, really. There was a huge hubbub and uptraining. Cost the company thousands. Then they tried again after 4 months. Guy walked in off the street, ghost-followed behind an employee, went into the restroom, put on an expired visitors sticker-badge, then exited and entered a meeting with other people with visitor stickers saying, "sorry, I'm late." Sat down during the meeting, plugged his laptop into our LAN again, and found nobody had updated the credentials to the AD servers since the last hack. This time, it took him 30 minutes. Nobody even asked him who he was. He even pretended to participate in the meeting with followup questions after he hacked our system. The employees were sent the fake logins again, and this time 14 people tried to enter in their credentials, where most of them were the same people who did so last time. The email was never reported.

Пост рассказывает о проваленном аудите безопасности: приглашённый специалист без труда проник в офис, получил доступ к локальной сети и административным учётным данным, а сотрудники дважды вводили свои пароли на поддельной странице входа. Шутка в том, что после первого инцидента компания почти ничего не исправила, а во второй раз ещё больше сотрудников попались на ту же фишинговую уловку; это отправляют как реакцию на вопиющую безалаберность в кибербезопасности. EN: The post describes a failed security audit: an invited specialist easily entered the office, accessed the local network and administrative credentials, and employees entered their passwords on a fake login page twice. The joke is that the company fixed almost nothing after the first incident, and even more employees fell for the same phishing trick the second time; it is shared as a reaction to outrageous cybersecurity negligence.

• @gentoomemes / 9751 2024-02-29