According to Wikipedia: " AARD code was originally discovered by Geoff Chappell on 17 April 1992 and then further analyzed and documented in a joint effort with Andrew Schulman.[2][3][4][5][6] The name was derived from Microsoft programmer Aaron R. Reynolds (1955–2008),[7] who used "AARD" to sign his work; "AARD" was found in the machine code of the installer"
It is inexcusable that Twitter is employing people who are susceptible to social engineering attacks like this. This is simple training and seriousness.
You too could be social engineered. The worlds foremost security specialists are not immune, good chance that there is some social engineering vector that would work on you.
Admitting that to yourself is a huge step forward in being able to detect it. Believing yourself immune increases your chances of being spearfished.
Where I work there is training software that is somewhat effective at preventing phising - it actually sends out phising emails itself. Then employees who fall for it are given extra training (in a no fault sort of way).
Perhaps, but im also wary of these types of things, because i worry that people will feel embarassed at being tricked, and will (maybe subconciously) see the internal security team as the enemy, which is also a bad outcome.
I also worry that the emails might not represent real attack emails, and we end up training users to identify the test emails but not real attack emails.
Nothing is 100% secure. Having users fail to spot a pishing mail, is a very good training on general awareness, but no guarantee, that they will not make misstakes under pressure.
I would actually be interested in seeing some studies on that.
My gut feeling is for engineers, the phising training that most companies use is wholly ineffective at doing anything, and in particular it is especially ineffective against targeted attacks. But i have yet to see any research one way or another.
I suspect less technical users might benefit from such training a bit more (but still not that much)
I will freely admit that I fell for a phishing campaign. I’d just bought something on eBay (this was a while ago). I got an email about something in my account later that day that made it through my spam filters. I clicked on it, signed in, and then realized I’d done the deed. Nothing happened or was lost, but yes - it just takes one quick mistake.
Some password databases involve copy and pasting or autotyping. If you want automatic hostname verification you need a password database integrated with your browser. On mobile many browsers don't support extensions so integrating my password database into the browser would be hard.
In short, I do not know my ebay password, but I could have fallen for this phishing attack.
On mobile this is possible even without browser extensions - enpass, lastpass etc work just fine in Chrome or any other app, if it detects a password field.
I loved this show. You can watch purely for the opportunity to drool at Lee Pace even if for no other reason, and there are PLENTY of other reasons. It's a great story and gives a very insider look at the early days of the commercial web, online gaming, the PC, etc. etc. . . . Deals very well with sexism in the industry without being hectoring about it. And did I mention Lee Pace? I think I might have . . .
