1

My company sends honeypot phishing emails from within our organization in Microsoft Outlook. e.g. hr@mycompanyname.com , ithelpdesk@mycompanyname.com , etc. I fell to one of these in a lapse of judgment while working late (I clicked a link in a honeypot email, hr@mycompanyname.com asking me to fill out an HR form, which told me to do some remedial security training). Now I want to block that bad email, so as to not fall for any more of them from that source. I found that I could not block the email as it was from within my organization (it's some outlook admin setting I think).

However I may be able to set certain senders be sent to junk through the "rules" setting, as to save myself time/attention or possible falling for any more traps.

I would consider a fairly normal and reasonable reaction to phishing emails to be to block the sender and delete the email.

Would automatically sending emails from known honeypot addresses from within my company to junk automatically be a bad idea?

I feel it would be a bad idea for the company to use previous honeypot email addresses on legitimate emails for important information. I would also expect that important information can be escalated beyond email in person, or through work phone or other channels of communication (company instant messaging, company HR system, etc) The company is somewhat small ~100 people.

I know legitimate email addresses belonging to the company can be compromised and bad stuff sent through them. Thus always constant vigilance is important regardless of sender, and I'm not practicing my "security mindfulness" if I just block my known encountered honeypots, because I'm not playing the game. However with my knowledge and due diligence of these appearing to be dedicated honeypot email addresses (never/not used for anything else), I feel blocking known dedicated honeypot email addresses serves to benefit myself and the company's interests (letting me just work).

  • "Having fallen to one of these in a lapse of judgement while working late, I endeavoured to block it, as to not fall for any more of them from that source." - Could you clarify what did you "fell" for? In what way are they phishing/honeypot if they are from withing your company, probably handled by some coworker of yours? – DarkCygnus Oct 2 '18 at 17:32
  • 1
    Move to junk or delete without a trace? There's a rather big difference. And how many of these fake emails are people sending that you're dedicating this much thought to them? – Lilienthal Oct 2 '18 at 18:01
  • @JoeStrazzere yeah I think a lack of awareness in the organisation / with the OP is the big issue here – Matthew E Cornish Oct 2 '18 at 18:30
  • @DarkCygnus Updated question, clicked link to fill out hr form from hr@mycompany'sname.com, which led me to remedial training. – user1821961 Oct 2 '18 at 18:32
  • @Lilienthal both are available, I'm planning junk, there aren't that many emails, but it doesn't take me much effort to add them to a junklist, I wanted to gather other opinions on if this was a bad idea. – user1821961 Oct 2 '18 at 18:33
14

Would automatically sending emails from known honeypot addresses from within my company to junk automatically be a bad idea?

I don't think it's a good idea...

First, one should not have to block emails coming from your own company, as you never know when one will have relevant or important information that needs your attention. If you start blocking company emails, you may miss one that could be important and get you in trouble.

Now, with all due respect, I think you are missing the point here... you say you "fell" for a security test/check coming from your HR email, by attempting to fill forms online or doing some insecure action, and thus gave you some security training...

Blocking this email will not solve the core problem, as it will not help you learn from this nor undo the (simulated) threat you opened and fell for. This is why taking this approach would be ineffective, at best, or even result in you missing relevant information coming from within your company.

The best you can do is to learn from all this situation. Try to be more aware of the emails you get, both from your company and from outside, so you can avoid falling into simulated or real traps seeking to compromise your information. Fortunately for you this time it was simulated...

  • 1
    Just to add on this: they can just use different email addresses for their new phishing tests and your approach will be ineffective. In our company we spoofed (en.wikipedia.org/wiki/Spoofing_attack) the CEOs email address in our latest test. Are you going to block this as well? – Caroline Oct 3 '18 at 8:07
  • 1
    @Caroline exactly, denying or bypassing this would hardly be effective, could put OP in trouble, and misses the things to be learned here – DarkCygnus Oct 3 '18 at 16:02
1

Nearly every company has this scheme set up. Where they send fake phishing emails then see how many clicks on links or attachments. These generally take you to a training page or flag your manager.

With that said at my company I simply forward it as an attachment to the spam account. It's actually favorable behavior by the company. I even send them emails from high CEO who sends me a survey monkey link which I consider junk as well. It doesn't sound like bad behavior to me, and should be considered good behavior to block known aliases of things you know are spam. I would take it a step further and email every single one of them to the spam account your company has if they set one up.

Edit: After re-reading your question I realize you may have clicked on a spam email. You should go ahead and do the training to comply then in the future, forward such emails to the spam alias for investigation as well as deleting it/report to spam. You shouldn't treat it as a big deal and simply learn from it. Never click on links in emails and never open attachments.

  • Upvote for "I even send them emails from high CEO" – Mawg Oct 3 '18 at 6:28
1

Thus always constant vigilance is important regardless of sender, and I'm not practicing my "security mindfulness" if I just block my known encountered honeypots.

Exactly. Your strategy is unwise because you are denying yourself the opportunity to learn the types of emails and strategies used by potential real cybercriminals. As someone who works in cybersecurity profession, I have seen how subtle and advanced phishing attempts have become such as by substituting lookalike characters that are easy to confuse (0 vs O , l vs 1 etc).

In the past at my company, I have assisted management in designing phishing / social engineering defense strategies using simulated malicious emails containing website links with subtle differences such as the examples names above, compared to legitimate websites and results have been telling. Whether its targeted attacks (spear phishing / whaling) or general attacks, the failure rate was almost always inversely correlated to the amount of end user education and awareness. Successful phishing scams rely on the ignorance of the end user, making awareness training essential - section 6.4. Take the training opportunity offered by your company seriously.

The answer from @DarkCygnus rightly states to be more aware the types of email you receive. While you have not asked for this, there are certain characteristics of emails that more often than not tells you that the email is malicious. However, by no means should this list be interpreted absolutely or exhaustively. The answers to this question from the Information Security SE site lists other common characteristics of phishing emails.

  • Emails with wording indicating urgent action is required or threatening negative action if not responded to in a certain amount of time. E.g: IMMEDIATE , URGENT etc.

  • Emails sent with lots of grammatical or spelling errors

  • Emails requesting you to send money or confirm your sensitive information such as passwords

  • Emails sent at unusual times of the day

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.