If an unsual inquiry or email has an urgent plea, it's risky to act on. But many do.

I often try to make the point that the human element is almost always the weakest link, and the easiest path of attack, for an enterprise. The article below by Dan Goodin of The Register gives some good examples of how this is the case. Security penetration testers, Mike Baily and Mike Murray, consistently illustrate how easy this is - just like with my Honey Stick Project.

http://www.theregister.co.uk/2010/03/04/social_penetration/

These guys just claimed a $10,000 prize for hacking the email account of StrongWebMail CEO, Darren Berkovitz.

They have a great observation in the following statement:

The come-ons often invoke a sense of urgency, such as an opportunity to make money only if the mark moves quickly. Scammers often try to form perceived bonds with their victims by thanking them for their attention or apologizing for an interruption. The ruses amount to hacks that suspend the marks' critical faculties just long enough to get them to make a critical mistake.

The bottom line is, if it's an unexpected message, and it has an urgent deadline, be VERY suspicious and check it out before taking action. Don't think the bad guys aren't every bit as inventive as these security testers.

rate this post: