Posts by Doctor Syntax 42420 publicly visible posts • joined 16 Jun 2014
"The only missing step would be to persuade someone else in IT to actually send the emails."
Not in IT. In HR (two birds, one stone). You send them a phishing email as from the CEO telling them to do it. Being a BOFH it would, of course, genuinely be from the CEO's email account.
"1) Signed all employees up to PerkBox ( a ligitimate enterprise) but the invite emails came from Perkbox before the briefing from the company ......"
I worked for a large UK comms company (guess which!) which did the same thing with Amex. I'd already cut up the obviously fake Amex card before the briefing came round.
We routinely (monthly) send out phishing email tests
If it's that routine surely they're easily spotted - "Last Friday of the month. The Phishing test should be along shortly."
It contained all the hallmarks for a typical phishing email, misspelled words
Depending on the quality of your HR staff this might be a strong indicator that it was genuine.
"a message I'd send to a bunch of trained IT support people would likely only have one, hard to identify, indicator as I'd expect them to have a much higher level of awareness and skills than most. A message going out to a group of office workers/managers would have more and easier to identify indicators in it."
I'm not sure of the logic of this. You seem to think that genuine phishing emails to IT support would only have one hard to find identifier whilst those to managers or office workers would have several. I'd have thought that genuine phishing emails to anyone would have been made as hard to identify as possible irrespective of the target.
It depends on who the target is. If it's a matter on inveigling someone into sending money to qualify for a payment then, yes, they want to filter out those who'll sus it out and not waste their time on them. But for someone wanting to gain a foothold in a corporate network they have to look corporate themselves. They want someone who'll be fooled by good grammar and spelling.
"banks ...spent most of the last two decades (and some of them haven't stopped) phoning you up"
Some banks still do that by phone? Can you give an example - I might move my account there. All those I've dealt with have moved onto email.
I used to explain to the HSBC business bankers (sp?) that I'd told my bank that I wouldn't answer questions like that and, without confirming or denying that they were impersonating the right bank, they couldn't be my bank. This was routinely followed up a few days afterwards by a plaintive letter saying that they couldn't sell me anything help me.
"Not blaming the people who clicked the link"
Depending on how many clues there were to it looking like a genuine phishing email I might have to disagree with you.
Unfortunately, these days marketing departments seem incapable of sending out emails that don't look like phishing attempts and it wouldn't surprise me if HR departments weren't far behind so it might be a close call on how much it looked like a phish.
I've never been to Swindon but when I lived in Wycombe there were an inordinate number of roundabouts on any route to anywhere. It also has a five lane two way roundabout with mini-roundabouts - I believe on the same principle as the Swindon Magic Roundabout which worked very well. I think the principle could be usefully applied to the big roundabout at J24 of the M62.
And sheer practicality, at least as far as pipeline replacement goes. At one end there's a huge (relative to tanker size) source and at the other a huge receiver. Somehow you've got to get tiddly tanker connections into those and then take off tiddly tanker sized portions at one end, receive them at the other and get them back into whatever sort of storage or process the pipeline was feeding.
In the early '90s there was a water shortage in part of West Yorkshire. Yorkshire Water got hold of every tanker capable of carrying potable liquids (another constraint on availability of tankers is what they're specified to carry) so that commuting along the M62 I passed tankers coming the other way about twice a minute between Keilder and Scammonden. It served its purpose in providing a minimal supply until there was adequate rainfall but it wasn't at normal volumes and it wasn't sustainable.
Nowadays there's a water distribution grid to avoid that. I hope it's secure.
Turn phone off or leave it downstairs, then go to bed without the possibility of the damn thing waking you up.
Not on O2 so the only thing I missed was a call from a bloke from Yorkshire Water having trouble locating one of their holes in the road in relation to my house because their GIS has had the wrong house name ever since they downloaded it from PAF. PAF was corrected about 20 years ago.
Of course if GIS says it's so it must be right. So that wasn't one of their unmarked water mains that appeared in a hole they dug last year. The excuse that time was that it must be an old dead main despite the fact that the leaking pipe went underneath it and the connection it makes with the live water main dates back to the mid to late '50s.
"It is not expected to have the power remaining to operate a single scientific instrument beyond 2025."
I wouldn't put it past the abilities of this amazing team to devise some means of enabling an instrument to be used intermittently even beyond that date. And I'm sure there'll be investigators working through the existing data a good while after that.
It's good to be reminded of the best we humans are capable of.
"AT THE BEGINNING."
And do so be designing a clear physical separation between what's instructions and what's data. Simply making a logical distinction based on what's no more than housekeeping information allows for that housekeeping information to be modified and then the machine has nothing to tell it that its reading data as code.
"I have never worked with pipeline systems, but my guess would be that their is some need to extract billing and operating data from the product delivery system and probably some need to input some commands at times. So a completely separate system might be difficult/impractical/impossible"
That pipeline has been in operation for longer than an internet-based control system seems feasible. It has been proven to be operable without exposure to the net. It has now been proven to be inoperable with exposure to the net.
We can, then, eliminate impossible and impractical. Difficult, maybe. Probably an option you left out - inconvenient. But far better than what they've got now.
"it would make more sense for companies to just fix the bugs themselves and then commit them back to the project ... Often a company's employment contract will insist that it has complete ownership over all intellectual property that an employee creates."
There's absolutely nothing in the second part of that that stops the company committing back to the project. The company owns the IP and can do with it as it wishes.
There could, however, be a problem with companies who claim IP ownership of what employees do in their own time.
"If an open source maintainer gives up because it's not fun and not worth their time, there's little you can do other than fork it."
And the ability to do that is because it's open source. I remember looking at the description of some S/W, thought it might be useful to the business I worked for and then the company that wrote it got bought up by Microsoft and that was the last I ever heard of the product.
I'm reminded of the situation where we had some commercial source code but not enough to compile the full application. After having the second Friday lunchtime interrupted by a bug in a weekly program run I spent the afternoon working through the code to find the bug. Even after reporting it to them, including how to fix it, it took a few weeks before we got the revised binary. I wouldn't be surprised if the same dodgy coding practices were hidden in more of their programs.
"QCs make a lot of money"
A colleague bought a house previously occupied b a QC & said they kept getting debt chasing letters for him. However both he & I were in a position to observe QCs at work and we both knew who he was, I wouldn't have rated him as one of the more able ones.
