Notices by Jake Hildreth (acorn) :blacker_heart_outline: (horse@infosec.exchange), page 16

@christianp Hmmm, maybe they discontinued it. I got mine ~1.5 years ago.

They are very dark, and according to my normal vision-having wife, they make everything look very red/purple. To me, reds become visible and orange absolutely fucking POPS. I can even tell see some variation in greens.

@christianp @wj Have you tried the Strong Protan versions that are relatively new? The OG version did t do much for me, but SP does! Being super red-weak succcccccks.

@Viss Is it really a training session without the threat of incarceration?

@Viss The last bullet point is

@Sempf @ShmooCon Excellent. Maybe next year I can talk about my sysadmin => security => baby dev path and my approach to distilling research into tiny tools to help overworked people?

@Sempf @ShmooCon How'd your Veilid talk go, and was it recorded?

@Sempf @ShmooCon I guess I should say, if it's not an upgrade from Ohio, why leave? 🤣

@wendynather @evacide

@emilygorcenski I updated mine this morning. My lead dev is updating the company's right now. Woo.

@Sempf @ShmooCon Who wants to be in DC in January? I want to go warm places in winter!

@dko Oh yay! This fills me full of joy!

If your org uses a third-party solution for phishing training, it is likely that all of the testing emails contain a specific header. Mail filtering is generally configured to allow them to bypass rules and make it to all inboxes as intended. It is also often used to prevent rewriting the URLs in links if your org has a system that does so ( Proofpoint, Barracuda, etc. ).

As an employee, if you don't want to bother with the regular phishing training, look at the message details and see if you can find the header used to bypass protections in your org. Some of the common ones are:
X-Phishtest
X-ThreatSim-Header
X-ThreatSim-ID
X-PhishMeTracking
X-PhishMe

Then in your mail client, set up a rule to take whatever action you wish. You can create an alert, move the message to a specific folder, or even execute a program or script if IT hasn't disabled that function.

I fully support those of you of a chaotic persuasion to take the URLs from your org's phishing messages and fully enumerate the unique identifier section. Just brute force it and see if everyone gets assigned phishing training.

It used to be that as an attacker, you could put all of those headers in and likely bypass filters due to the org setting a basic allow rule for one of them for phishing training. However, more orgs have finally either moved to third-party mail service that usually does a better job at filtering, or they are getting around properly configuring SPF, DKIM, and DMARC with strict rules that specify sending domains that are allowed with the header mentioned above. YMMV, of course.

#phishing #infosec

@LitMoose Hi Real Moose! 👋

@devleader With enough ifs and foreaches, I can do anything!

@Ptisan @support Ope! Totally misread that. Sorry!

@Ptisan @support You can log into any Mastodon app using your infosec.exchange account. There are many, and each has its pros and cons. If you’re on iOS, try Toot! It was my favorite of the few I tried. I think Tusky is the most popular Mastodon app for Android. You can even use Elk (https://elk.zone) if you want a web app. I use Elk because the experience is similar in both mobile and desktop incarnations.

@chux0r Have you considered meat?

@da_667 Magic, right?

@malwaretech @hacks4pancakes Brilliant. And deposit goes up every time you no-show and try to schedule again.

Just a reminder that the US Air Force forced Chobani to change their yogurt formula to not contain any hemp seeds because some military people ate it, and if you’re not a white billionaire guy they’re that strict about something that might have contained something you could potentially have made pot out of but didn’t and in some alternate universe might trip a drug test.

https://toot.community/@Bewickwren/111712433044579577