Comments on: I might have fallen for this http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/ The views of one man on security, privacy and anything else that catches his attention Fri, 21 Nov 2008 22:55:25 +0000 http://wordpress.org/?v=abc By: Martin http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1682 Martin Tue, 22 Apr 2008 17:25:27 +0000 http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1682 Randy, We can stop the CEO in theory, but too many of them take the attitude that "it's my company, I'll have all the power I want!" You know this as well as I do. I'd love it if the majority of C-level execs would let IT and Security do their job, but the reality in too many businesses is that their ego makes them want to be the administrator on their machine. Randy,

We can stop the CEO in theory, but too many of them take the attitude that “it’s my company, I’ll have all the power I want!” You know this as well as I do. I’d love it if the majority of C-level execs would let IT and Security do their job, but the reality in too many businesses is that their ego makes them want to be the administrator on their machine.

]]> By: Martin http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1681 Martin Tue, 22 Apr 2008 17:23:01 +0000 http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1681 Sam, I wouldn't know that subpoenas are never sent via email and I wouldn't be surprised to find out many CEO's are equally ignorant. This is an appeal to emotions, specifically fear, and we all let fear overcome common sense from time to time. My natural paranoia probably would have stopped me before I clicked on anything, but not necessarily. Martin Sam,

I wouldn’t know that subpoenas are never sent via email and I wouldn’t be surprised to find out many CEO’s are equally ignorant. This is an appeal to emotions, specifically fear, and we all let fear overcome common sense from time to time. My natural paranoia probably would have stopped me before I clicked on anything, but not necessarily.

Martin

]]> By: randy http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1680 randy Tue, 22 Apr 2008 17:17:05 +0000 http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1680 "We can’t prevent our CEO’s from installing software" I'd just like to state that we absolutely can stop them from installing software. If we set their account to that of a limited user, they'll be prevented from installing software, and most importantly ActiveX controls. This means that if AV works or not, it still can't be installed. If AV works, that's just an added bonus. If they want software installed, it should be done through the proper channels; the same ones everyone else in the company follows. Besides, they have more important things to do than figure out how to get some piece of software up and running. Shouldn't they be focused on the business while someone from the helpdesk figures the software out? If your CEO has admin rights this event is a perfect reason to justify taking them away. “We can’t prevent our CEO’s from installing software”

I’d just like to state that we absolutely can stop them from installing software. If we set their account to that of a limited user, they’ll be prevented from installing software, and most importantly ActiveX controls. This means that if AV works or not, it still can’t be installed. If AV works, that’s just an added bonus.

If they want software installed, it should be done through the proper channels; the same ones everyone else in the company follows. Besides, they have more important things to do than figure out how to get some piece of software up and running. Shouldn’t they be focused on the business while someone from the helpdesk figures the software out?

If your CEO has admin rights this event is a perfect reason to justify taking them away.

]]> By: Sam Van Ryder http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1679 Sam Van Ryder Tue, 22 Apr 2008 16:47:32 +0000 http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1679 I don't understand why anyone would fall for this. Since when are subpoenas served via email? The only reason I see someone falling for this is because they are not technically astute (such as a lawyer or exec), but I would expect at least some level of suspicion from anyone else (quite frankly, even from an exec). I could see an attorney falling for this out of curiosity - but not because they thought it was a real subpoena. Certainly, Martin - you couldn't fall for this one! I don’t understand why anyone would fall for this. Since when are subpoenas served via email? The only reason I see someone falling for this is because they are not technically astute (such as a lawyer or exec), but I would expect at least some level of suspicion from anyone else (quite frankly, even from an exec). I could see an attorney falling for this out of curiosity - but not because they thought it was a real subpoena.

Certainly, Martin - you couldn’t fall for this one!

]]> By: Don Noll http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1672 Don Noll Mon, 21 Apr 2008 22:55:34 +0000 http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1672 I saw a similar attack back in 2006 with Better Business Bureau faked letterhead, was mailed to the CFO of consulting client of mine. I saw a similar attack back in 2006 with Better Business Bureau faked letterhead, was mailed to the CFO of consulting client of mine.

]]> By: kurt wismer http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1668 kurt wismer Mon, 21 Apr 2008 21:07:05 +0000 http://www.mckeay.net/2008/04/21/i-might-have-fallen-for-this/#comment-1668 actually, i think this is a really good argument for a) treating all new software as suspicious, and b) using untrusted software (if at all) in a virtual machine or some other sort of sandbox (or better yet on a ghostable test machine that's partitioned off from the 'trusted' network if you're in that sort of environment)... that probably sounds paranoid (though it's been said that a certain level of paranoia is healthy), but even if it turned out to not be intentionally malicious who wants crud from some one-time-use application cluttering up their main pc? actually, i think this is a really good argument for a) treating all new software as suspicious, and b) using untrusted software (if at all) in a virtual machine or some other sort of sandbox (or better yet on a ghostable test machine that’s partitioned off from the ‘trusted’ network if you’re in that sort of environment)…

that probably sounds paranoid (though it’s been said that a certain level of paranoia is healthy), but even if it turned out to not be intentionally malicious who wants crud from some one-time-use application cluttering up their main pc?

]]>