Phishing

They don't want to frighten people.

Health systems warn patients of MyChart phishing scam.

Phishing being spelled P-H-I-S-H-I-N-G. Epic's head of research.

I don't know what Epic is.

Randy probably knows.

He's a security expert.

I will tell you that.

Epic's head of research and development says that the uptick in phishing, P-H-I-S-H-I-N-G, phishing attempts are just scammers taking advantage of the MyChart brand website.

[upbeat music]

Hello, everyone, and welcome to the Hacking Humans podcast, where each week we look behind the social engineering scams, phishing schemes, and criminal exploits that are making headlines and taking a heavy toll on organizations around the world.

I'm Dave Bittner, and joining me is Joe Carrigan.

Hey there, Joe.

If there's something you'd like us to consider for the show, please email us.

It's hackinghumans@n2k.com. Joe, Maria, it is time for our Catch of the Day.

Dave, our Catch of the Day comes from the r/phishing, P-H-I, phishing.

Uh, this title of this post is Clicked on a Phishing Link from Calendly.

Yeah.

All right, next up, Huntress researchers documented a phishing campaign targeting cybersecurity professionals after Black Hat and DEF CON.

A threat actor contacted a Huntress researcher on X while impersonating a Coindesk executive and claiming to be organizing an upcoming conference.

The researcher recognized the scam but continued engaging with the attacker to study the operation.

And yeah, it's interesting for sure.

But in this case right here, Chris, I'm in the exact same boat with you.

I read this and the first time I had a double take on this, I felt like what I was reading is that someone was was phishing using like DEF CON lures and stuff like that.

And I think it was kind of like that, but it was more about like a fake security to get people to open documents and everything like that.

Now, there's 19 claims around all of that that have been granted as well.

And it's what I believe to be a disruptive force in the cyber literacy arena of human behavior and trying to get employees to understand and learn the common sense and the modicum of inside knowledge around how fishing works in order to prevent breaches from happening and to show that it works over a longer period of time, right? You've heard that old phrase, feed a human a fish, F-I-S-H, you feed them for today.

They're not hungry today.

But if you teach them how to fish...

So that's, again, a level up on Bloom's taxonomy of learning.

And so if you want to learn something.

How are you going to bring that to the world of fishing

then?

So I say, if you want people to actually understand and reference your governance policies, you need to keep them TLDR'd, short.

In other words, your password policy, it needs to be only the password policy, and it needs to be one or two pages of instruction.

You can have a table of contents, or you can have You know, the revision and approval controls in there, that's all good stuff.

But people can ignore and skip all that.

They just need to read the 30 bullet points on password hygiene that they have to follow or 15 to 20, whatever you can boil it down to.

But it needs to be short.

And then you need to reward people for engagement with that and compliance to it.

So, for example, password policy might say you must adopt the company password manager.

So they're the UK's home for reporting cybercrime and fraud.

If you receive a suspected scam email as well, you can always verify that by emailing report at phishing.gov.uk. And that reports it to the National Cyber Security Centre.

So they're two options for you.

Wow, that's great advice.

But no matter, I'm gonna turn this into a cautionary tale about phishing.

And I don't mean F-I-S-H-I-N-G.

I mean P-H-I-S-H-I-N-G, phishing.

This is a crazy story because it's a constant theme of conversation with my parents about scams, and phishing, and texts, and emails, and never hit links, and never give information over the phone, and if something texts you, just ignore it.

You don't have to reply to things.

Well, I was on the phone with Mike Waldner, who runs the two big state programs out of DSU, and I've got some fake phishing email, uh, a text message, um, and an email from Monument Health, my local healthcare provider.

It had nothing to do with Monument Health.

So I was phished, uh, P-H-I-S-H, phishing.

They're going out and phishing for, for people to, uh, uh, hack, while I was on the phone with the expert.

And I, and, uh, I thought that that was classic because that just showed how, uh, prevalent this is.

Just let it go.

Just send it to Phishing.

And if it's legit, they will get in touch with you again if they really want to get a hold of you.

But there's a lesson.

They screwed that name up.

The person, like, so you have to put the phishing email at the bottom.

Oh, okay.

Fish.

Yes.

[laughs] That's a, yes.

I'm starting to send phishing email scans-

Yeah