Notices by Viss (viss@mastodon.social), page 2

so that, internet friends

is why you never ever FUCKING EVER involve an outside company or outside party in an internal phishing campaign.

people will do weird shit you dont expect and stuff will go off the rails.

you need to MANUALLY ENGINEER YOUR BLAST RADIUS. yourself. by hand. dont fuckin trust some outside platform/vendor to do it for you.

i also did a talk on this program, but the link may have died https://archive.org/details/building-antibodies-the-phishing-program-at-twitter-44con

the next three campaigns i thought up were:

- 30 days: click here to maintain vpn access, if you dont, you wont be able to work remotely

- 60 days: click here to get verified (this was a trick, no staff were permitted to be verified)

- 90 days: we're switching health insurance providers, click here to put a signauture on the dumb bureaucracy. if you dont, you might lose coverage

can you guess which one had 100% click rate?

also, after that, zero problems like before.

so i say "i see. i was not expecting someone to run that far out of bounds and into the weeds like that"

to which legal says "yeah neither were we. youre not in trouble, but lets set some new rules."

"yes. thats a good idea" i say.

legal goes away, my boss remains, and he basically says "okay from now on, lets not involve any other companies or businesses or whatever in the campaigns. we would prefer to avoid the liability".

"got it. ok. i know what i can do."

then the lawyer starts:

"right, so what happened was one of the new hires was so enamored by this offer, that they went and sorta caused a ruckus at the restaurant, to such a degree that leadership there got involved, and by the time those people got read in, the only thing they heard was 'twitter is giving fake coupons to their staff', and when youre leadership and you hear that, the first person you call is legal"

".. ah."

i start explaining "so my thinking was that people would just gush over this thing, and that they would click, hit the credential stealer, and if they decoded the QR code it would say "you win, go see viss in security. a bunch of people decoded it and i gave them props, but since the restaurant uses super fancypants gift cards, theres no way a qr code could work so it was supposed to be safe"

so they nod

so i get pulled into a meeting room the next day. theres my boss, and someone else.

the someone else was twitters head of legal.

they were like "so walk us through your phishing campaign from yesterday"

RE: https://mastodon.social/@cheeaun/116777616644053403

fucking finally! :D

now i can post a gif and a poll together and confuse even more people at once! :D

remember kids: lack of consequences is tantamount to permission.

not holding people accountable for being fucking monsters is giving them permission to continue being monsters.

it might just be me
but im not sure alaksa knows directions

@ryanc i bet @cR0w would appreciate that

sorrento valley is on fire

here internet.
im just gonna go ahead and assume youll want this for monday

@periodic @pluralistic thats like the 'race to acquisition' concept i noticed when i was on twitters security team 2011-2012. they acquired several orgs and i had to do the security assessments on them. all of them were hot garbage. turns out speeding towards mvp at lightspeed and getting acquired is more favorable because when the problems are discovered its someone elses problem. go fast, fuck everything up, sell, get paid, bail, liability is someone elses now

@periodic @pluralistic oh dude, they asked me back then if they could use hipchat as the team chat. i did a review. i found open s3 buckets of all attachments and i could link them to external companies. i didn thave time to find the actual text of the chats, but all the attachments for the entire platform landed in a massive open s3 bucket. i said this was a massive liability and we should avoid hipchat

"we'll take it under advisement"

it was live 2 days later.

whats even the point?

just now i had the opportunity to make a pitch against an ai-powered soc.

repeat customer, I recently did a post-assessment retest for them, and during the retest one of their vendors started flinging ai-powered alerts screaming about attackers doing lateral movement

no, my guy, it was just nmap. authorized nmap, no less. when they were told that, their response was "ok but we might contain your entire lan anyway"

welp, thats... kinda threatning. also massively shortsighted.

@skeletor just for the audio

@skeletor

@ryanc its been like, a week right? yeah the odds are stacking

@catsalad the article makes this read like its a t-1000 on a leash.

your opportunity to push to prod has passed.

the window is now closed.

your next opportunity to push to prod is 9pm PST sunday night, before the federal holiday.