A few days ago I received a LinkedIn invitation email from some other employee of the company. I clicked the email link to check this person LinkedIn profile, I logged in with my personal account into LinkedIn and, voilà, it turned out it was a phishing test from my company to test how prone employees were to phishing attacks.
I did not check the URL domain of the link, thing that I do most of the time, but that email totally caught me by surprise.
There are several things that should be changed on this test:
- My employer -that hired the services of a 3rd party company similar to PishMe- effectively hacked a personal account that had nothing to do with the company account. They extracted me the email address and password associated with my LinkedIn account.
- At no moment of this test the victim is advised to immediately reset the password (in case credentials are stolen). They do not tell you either that the credentials captured are actually not sent and the form does not work. Other basic security prevention measures like checking the domain in URL link are never suggested. This puts in doubt the educational and awareness raise purpose of these tests.
The fake LinkedIn form did not use HTTPS connection. Credentials were sent to the outsourced phishing test company in bare plain text.See bulletpoint 2.
- Does LinkedIn authorise the use of its image and trust for such kind of tests?
This test is a factual successful phishing attack were personal credentials not related with the company are leaked to 3rd parties. Is this legal even when it has a paradoxical security purpose?
Edit: my LinkedIn account had an unique password (different to other personal accounts) and was not associated with any other external service or account. I changed LinkedIn password straight away once the phishing message was shown.
Edit 2: (1) my concern is not about the test itself but about the liberties they have taken to carry it out. I do not want a company to test CORPORATE phishing awareness with PERSONAL accounts to the point they effectively stole my credentials. (2)
They do store email and password typed. The phishing company sells this fact as an amazing feature of its phishing platform. See bulletpoint 2. The phishing company only stores the times and the corporate user who accessed the form.