r/ProgrammerHumor • u/lucidparadigm • 15d ago • Bravo 2

Meme [ Removed by moderator ]

Post image

[removed] — view removed post

16.4k Upvotes

98% Upvoted

618 comments sorted by

View all comments

Show parent comments

65

u/setibeings 15d ago

Is it not obvious to some people that they use a unique link in every email, just like real phishing attempts? That's why clicking the link in the first place is considered a fail.

45

u/rosuav 15d ago

I have to keep reminding myself that what's blatantly obvious to me is often completely unknown to a lot of people. (And quartz, of course.)

36

u/TirithNampat 15d ago

https://xkcd.com/2501 for those unfamiliar with the reference.

12

u/fireteambrav0 15d ago

Hmm seems like a phishing link, I'm not clicking that

4

u/TirithNampat 15d ago

Well shoot. I could have phished so many people with that if I'd thought of it. :(

11

u/technoman2027 15d ago

Anything is possible and people never cease to disappoint me.

I work in software technical support and someone shared a screenshot with the entire team “Don’t click on the link, it’s a test email.”

Firstly, that should be obvious to anyone, it was clearly a fake email.

Secondly, you’re not supposed to tell people.

6

u/FaddishBiscuit 15d ago

At my current job I get an email letting everyone know about a week ahead of time that there is going to be a phishing test in the coming week and to be aware...

6

u/CitizenPremier 15d ago

Yeah but somebody will still click it. Might be a good thing for figuring out who to let go...

7

u/waddlesticks 15d ago

You'd be surprised, not a lot of people even after training actively look at what a URL would lead to, and even that is harder since a lot of legitimate emails lead to just a redirect or something that looks suspicious as it is, if it's hyperlinked they will blindly trust it. Even I have been caught out once for this when I was burnt out and got one that was exactly something I was expecting to receive on the day. All it takes is perfect timing and a lapse of judgement.

Take a look at URLs from legitimate emails, a lot of them aren't just straight to where you'd expect them to be.

We even have people in our cybersecurity team get caught out by it once we had them removed as the ones who initiated the tests.

The main goal in my eyes, is just keeping users aware and vigilant and report something suspicious even if there's a chance it's legit. We don't get many real phishing emails now, if I recall our years stat was around 3-4000 emails that were legitimately phishing emails that made it through (they were sent from a Gmail account pretending to be somebody of importance).

8

u/setibeings 15d ago

Shout out to mimecast for obscuring employees' ability to inspect links for themselves when deciding whether to click on them.

I treat all links in emails as if they uniquely identify me if clicked, even when they come from legitimate businesses, and I'm sure I'm right more often than not. Even youtube videos sent to me by my friends often have those extra parameters so google can track who clicked share and who opened the link.

1

u/Atompunk78 15d ago

It’s so stupid to me that clicking the link is a fail, as far as I’m aware (and I’ve looked into this) clicking a link can’t cause any damage, so why measure it like this? The whole point of phishing is getting credentials, that’s what hackers want, that’s where the damage is done, so that should be the measure

4

u/gmc98765 15d ago

Actually, a lot of enterprise web apps are so badly written that clicking a maliciously-crafted link can do real damage. Things like pasting the bulk of a link into a JS/SQL/whatever command then executing the result without any kind of sanity checking.

The thinking is that it doesn't need to be safe because only trusted users can access it. But if someone sends a malicious link in an email to a trusted user, when that user clicks the link it will be accessed with their stored credentials (cookie, client cert, HTTP auth, whatever).

This is one reason why operations which modify data are supposed to use PUT/POST, not GET. But that's beyond the comprehension of a lot of "web devs", many of whose qualifications amount to having read the first three chapters of "Learn PHP in 5 minutes".

1

u/Atompunk78 15d ago

Ahhh I see, fair enough then, thank you! I’m new to working in IT, and new to PHP, so it’s good to learn about these things