Phishing awareness gone wrong: Facebook tries to seize websites set up for staff security training Security biz Proofpoint and its subsidiary Wombat Security Technologies have sued Facebook and its Instagram subsidiary to prevent the seizure of internet domain names used for security testing. Proofpoint conducts cybersecurity training for organizations, part of which includes phishing awareness testing. This involves …
or deceptive* in its use of these domain names ? If not it seems as if their use is reasonable. To provide good training it has to use domains that have to be good enough to fool those being trained. The UDRP arbitrator is wrong and facebook is being an ass (nothing new there).
* Other than trying to deceive those being trained.
Or perhaps proofpoint should allow the relevant domains to be transferred because trademark. On the understanding that the big boys lease the names back gratis so that the training company has a valid, above board training resource. Because pro bono.
And preferably rinse repeat with other web giants for other training and/or security companies.
A mate who works for a firm who uses Wombat got creative. He reverse searched all the domain names Wombat have registered that he could find. Then added them to his spam list and hosts file so he wasn't bothered by the emails. He had to remove their main domain from both those though. This was because the emails telling him he had training to complete were being dumped directly into spam.
Are they begin malicious? No.
Are they being deceptive? Quite clearly yes, otherwise there would be no point in the whole exercise.
I think the question here is not whether the rules are broken, but whether the rules are correctly drafted in the first place.
Being required to police and enforce ownership does not mean you must take court action to confiscate domains. It's perfectly allowable to just license the use. This is the sort of situation you'd normally just agree on a pepperorn rent - Facebook has no need of the domains, Proofpoint has no need to actually pay anyone since there are plenty of other domains they could use, so both parties benefit would from a nominal license contract to allow use while protecting the trademark. The fact that Facebook insists on confiscating the domains isn't a requirement of trademark law, it's just Facebook being dicks.
If Facebook licenses the trademark infringing domains, Wombat gets the clicks. If Facebook owns the domains and then licenses them, Facebook gets the clicks. Since the clicks come from users failing the phishing test, this is *great* information to add into Facebook's database.
"there are plenty of other domains they could use"
Yes, but Wombat already knows it's the Facebook-alike domains that have the highest failure rate, that's why the chose them. If they choose another Facebook-alike domain, Facebook will do the same thing. And if they choose a non-Facebook-alike domain, they miss out on a vulnerable population. The point is to educate users, to do that you need to figure out what they will click on. I actually clicked on a phishing test link once, never thought it would happen to me. But now I watch out for that internal scenario, so the phishing testing/training did its job.
But this and many other cases by companies like Coca-Cola are simply corporate bullying, over-reaching just in case. This isn't real trademark protection. It's scorched earth policy. It's not just the domain names, but they seem more narrowly policed by aggressive companies like Facebook. They'd be better occupied policing their own nasty, malicious and lying content. The same rules that are applied to radio, TV, papers and billboard surely shouldn't be ignored because it's the internet. Seems they only want laws that suit them applied. And overly harshly.
In another thread* Google's use of automated decision making is covered.
In this one we must assume a human chose to pursue this matter against a valid security training company.
But the outcome is broadly the same- a bloody stupid decision is made without any sense of human common-sense, case-by-case, judgement.
I had joked in that thread that maybe there weren't any humans and they were really being run by computer.
But I'm starting to think it wasn't a joke.
----------------------------------------------------------------------------------------------------------------------------
* https://www.theregister.com/2021/02/08/terraria_developer_cancels_stadia_port/
Where I work we get fairly regular phishing test emails from seemingly legitimate sources with seemingly legitimate links, no problem with that.
If you are caught you then get an email with a link directing you to take a training course.
That email comes from a seemingly legitimate source with a seemingly legitimate link.
I report those emails to the phishing team and don't click on the link.
It has been like this for years.
Why they can't email me saying something like 'log in to your personal training portal on the intranet where a course link will be available'?
That would seem sensible to me.
Just a personal rant I know, but as I can't go to the pub El Reg is my new best mate ever.
I've had at least one phishing test email sent to my work address. I've probably had more but I ignore anything I think is spam, which is quite often. I've deleted a few legitimate emails and just blamed the spam filter.
The one phishing one I bothered to look at had a link and an attachment. I reported it and told IT support I thought others may have received it too. When their response was glacial that time, I cottoned on to the fact it was a test. As I don't do LinkedIn or use my work email for any social media mails with those as a link won't work for me. I don't do internet banking either so those would be another massive red flag. The address I've given work as my personal email is unique to them. If a test one is sent to that address it'll be obvious.
This is another issue. Banks' marketing depts have a history of sending emails with clickable links of the "Click here to log in and see our latest rates" variety. One month I got one such email from them within days of receiving one from their security dept, warning all customers never to click links in emails to log in!
Why is there no icon for despair?
(Which, to be fair, was also the response of their customer service person when I phoned to complain about this- a sense of despair, but knowing that the most they could do was pass this up the line).
"One month I got one such email from them within days of receiving one from their security dept, warning all customers never to click links in emails to log in!"
I'm pretty sure I've had such security emails that actually contained links themselves. My building society has a leaflet listing the domains they'll genuinely use. This hasn't penetrated as far as their marketing department who have used others. The links which appear to be genuine are actually sub-domains that resolve to marketing companies. I've even raised this at their AGM., not least because they're training their customers to be phished.
What should really concern security departments is that if marketroids expect customers to click on random links in random emails it's because they themselves see no issue in doing so. I strongly suspect that most successful phishing attacks are through marketing departments.
There's a market in (a) finding where those subdomains are hosted (generally, which cloud) (b) waiting for the campaign to finish/be abandoned then (c) new customer thrashing the cloud to be assigned that IP when it's no longer bound it it's original customer. That way, scammers have the bank (or other major organisation's) real domain to include in their emails, only now it's pointing at a web server who's contents are controlled by the scammer. Not yet a practice that marketing and IT are in lock-step on defusing.
It's not the cloud, it's someone else's highly recyclable but not entirely as-new computer (and infrastructure)
"By using domain names similar to those of well-known companies, Proofpoint is able to execute a more effective training program because the workforce is more likely to learn to distinguish typo-squatted domains, which are commonly abused by bad actors to trick workers, from legitimate domain names."and yet
the security biz maintains that no one is likely to confuse its similarly named domains to Facebook.com or Instagram.com
It's fair to say it's difficult to reconcile these two statements.
Mostly because, when you're seeing it in a security training email, you just get the URL. If you go to one of them expecting it to be real, it will look different and tell you what it is. Someone going to one of the URLs won't be faced with a lookalike service, but instead a warning that looks like this:
"Hi! This web site belongs to Proofpoint Security Awareness Training. This domain is used to teach employees how to recognize and avoid phishing attacks. This page is here to let you know that this is not a malicious web page. The email that led you here was likely sent by your employer as part of a training program."
And thus, they contend that people are unlikely to misidentify the site as the real one, because they look totally different. Nor would anyone typing in a URL type the other version--'rn' may look like 'm' when you see it, but it's very different to type or say. Those are the points that lead to the statement you quoted.
In the UK, a trademark is fundamentally attached to a business class (essentially its type of activities), so for example "knots" could in principle be trademarked independently by a string tangling service and a marine speedometer manufacturer.
Maybe it's different in the USA, but it would seem that the activities of farcebook and Wombat are sufficiently different not to cause confusion (at least I would, hope so).
Facebook, Instagram etc. are rightly protective of their registered names, and do not want anyone pretending to be them. Proofpoint and Wombat security provide security training to companies, which includes spoof phishing emails, and there are lots of actual phishing e-mails pretending to be from Facebook and Instagram (I even got one purporting to be from the UK's MI5 at work once).
Surely the solution is for 'responsible' organisations to register some of these mis-spelt domains for the use of security training and allow companies like Proofpoint to use them for training? That way the actual decoy websites used by criminals can be blocked, the training ones left as allowed at the firewalls and everyone is happy?
The problem is that Proofpoint should have asked for permission from Facebook and Instagram first.
Assume that it has come to your attention that someone has registered a domain that is obviously designed to be mistaken for your company domain. Would you (a) assume that it must be a security training company (b) someone wanting to trade on your company's goodwill or (c) someone intending to launch a phishing scam?
Personally I would think it could be any of those possibilities.
Who should be responsible for finding which of the three situations is the case? Bearing in mind that just because the web page accessed by the URL "www.theregitser.com/login" takes you to a page saying that it is a security test does not mean that there is not another page with the URL "www.theregitser.com/accounts/payments" that is a phishing attack. Or just because the person who registered the domain goes under the name of "Security Consultants Ltd" does not mean that they must be one of the good guys. Believe it or not, there are blackhats who masquerade as whitehats. (Are we allowed to use those terms these days?)
Is it not easier to just pull the plug on the domain and let the registrant fight to get it back by proving innocent intent than to conduct an in-depth investigation?
Anyway, maybe someone should register "proofpoirt.com" and see whether the company in question has any objections.
Phishing and legitimate emails are indistinguishable today because businesses and spammers are using the same "customer loyalty" companies. Oracle and SendGrid are big and there must be hundreds of fly-by-night trackers on AWS. I've configured my mail server to refuse those networks for it's own health and survival.
But...
A) Nowadays you don't need any real domain name to do phishing. Most phishing is done by people clicking the wrong links in an email or by malware infecting a legitimate site or the web browser. Infecting Apps or doing fake Apps is also becoming more and more common.
B) Any time those domains could either be seized by bad actors or infected by malware.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
