Want to piss off your IT department? Are the links not malicious looking enough?

https://phishyurl.com/

by jordigh • 10 months ago

1127 320 10 months ago

phishyurl.com

OrvalWintermute• 10 months ago

The person that created this has a wonderful sense of humor!

yoz-y• 10 months ago

Great. Since shadyurl seems to have died

tetrisgm• 10 months ago

I used to use it to redirect our links at work, back when the web was less paranoid. It was such silly fun. Surprised its dead

Terr_7• 10 months ago

It may be possible to make a more-limited system without redirects, by abusing stuff like user:pass@host URL schemes, or #anchor suffixes... although it would be less reliable, some hosts/URLs would have problems.

xorvoid• 10 months ago

Chaotic Neutral

qwertytyyuu• 10 months ago

This hilarious

johnecheck• 10 months ago

Imagine if they later update these links to actually phish people. That'd be pretty funny.

Johnny555• 10 months ago

That's what I was thinking -- eventually he'll stop paying for those domains and they'll go up for sale, and a domain taster may find that they are still active enough to use for real phishing.

SMAAART• 10 months ago

Not bad!

https://carnalflicks.online/var/lib/systemd/coredump/logging...

jcims3• 10 months ago

Why is that so satisfying to click on while it's at the top of the page?

MarsIronPI2• 10 months ago

Not going to lie, I was expecting this[1]. Maybe it's just not done on HN.

1: https://pc-helper.xyz/scanner-snatcher/session-snatcher/cred...

joemazerino• 10 months ago

Fantastic link, very educational.

wbl• 10 months ago

You innocent young being. There are some gaping holes in your Internet lore knowledge, but it's been eons since that's been seen in the wild.

fragmede3• 10 months ago

Oh I figured it was gonna be this one: https://cam-xxx.live/rootkit-injector/evil-controller/payloa...

wiseowise• 10 months ago

I’m surprised I had to travel this far to find it.

0x3444ac534• 10 months ago

I'm sorry, what exactly is this?

turkishdelight• 10 months ago

Seems shady, NoScript is giving me an XSS warning <_<.

arjvik• 10 months ago

You should totally not click this one:

https://match-heaven.club/trojan/malware_dropper.exe?id=0416...

0x3444ac534• 10 months ago

Ngl I really want to

alabhyajindal• 10 months ago

Beautiful. I got my joy back

cwicklein• 10 months ago

Bravo!

non_aligned• 10 months ago

I know it's a joke and I had a sensible chuckle, but if you want to routinely use it at work, just keep in mind that it's probably gonna make things worse.

Since you can't exhaustively enumerate every good thing or every bad thing on the internet, a lot of security detection mechanisms are based on heuristics. These heuristics produce a fair number of false positives as it is. If you bring the rate up, it just increases the likelihood that your security folks will miss bad things down the line.

Aeolun• 10 months ago

I think the lesson here is that any link in an email is bad. We should just block all of them.

DrJokepu• 10 months ago

Why not address the problem at its real source and just block emails entirely?

deadbabe• 10 months ago

Come on man, don’t be so uptight. We can’t just be 100% max security all the time or no one will want to do business. A little bit of risk for clicking a link is worth the convenience.

whatevaa• 10 months ago

What is an alternative?

red3694• 10 months ago

I think you raise a good point, and I want to agree, but my knee-jerk feeling is that it's such a mess right now that it's just like a kid peeing in the ocean. Your point has convinced me to work on that.

In the meantime, does anyone else get a kick out of receiving emails from quarantine@messaging.microsoft.com where they quarantine their own emails?

Edit: I see other people said things that are similar to a more mature version of my feeling. We need to address this in a way that addresses the threat of email links properly, not throw machine learning at guessing which are OK to click. BTW, I'm not implying that you're saying that is what should be done to solve the issue, but I'm sure it's behind the silly MS quarantine I mentioned, and when an email from the one person I email the most, who is also in my contacts, going to spam in iCloud.

cobbal• 10 months ago

Nice. Suggestion: default to https instead of http. Wouldn't want the links to lead somewhere malicious by accident.

flir• 10 months ago

With a self-signed, expired, TLS 1.0 cert?

(For a different domain).

Skullfurious• 10 months ago

After half a decade on discord... What are the odds of me being banned for sending a ragebait google redirect to my buddies?

ashtakeaway• 10 months ago

If you come up with an idea to piss others off, you'll succeed 90% of the time.

The other 10% are people who are just like you and know better.

artursapek• 10 months ago

That is fucking hilarious

ungreased0675• 10 months ago

I laughed really hard, this is fantastic.

virtualcharles• 10 months ago

A whole new generation of rickrolling is about to begin.

https://cam-xxx.live/trojan-hunter/evil-snatcher/malware_cry...

jader201• 10 months ago

This feels like the opposite of rickrolling, though.

Instead of naively trusting the link, only to click it and get rickrolled, you’re naively distrusting the link, so you’ll never know the link was fine all along.

ykonstant• 10 months ago

Nice try, jader201. You're not snatching MY cookies!

yrds96• 10 months ago

Rickrolling doesn't feel the same with this bunch of ads. Sadly

abtinf• 10 months ago

Or just report their mandatory compliance emails as phishing attempts.

I’ve worked for multiple large companies where the annual IT security signoffs look exactly like malicious emails: weird formatting; originates from weird external url that includes suspicious words; urgent call to action; and threats of discipline for non-compliance.

All this money being spent on training, only to immediately lull users into accept threats.

grimgrin• 10 months ago

you may or may not add a condition for emails with X-PHISH in its headers

unlikelytomato• 10 months ago

They block this and force it to show up in my inbox

0x3444ac534• 10 months ago

The company I work at hired a vendor for their call center software, and said vendor spammed out all kinds of emails to everyone in the org on a daily basis. It was annoying and entirely useless. I just kept reporting them as phishing attempts and encouraged my coworkers to do the same. It worked.

leptons4• 10 months ago

The phishing-emails-as-a-test emails were so frequent that I started flagging all emails from our company that had a link in them as phishing emails and let the IT staff tell me which ones were real. They didn't enjoy that so they stopped sending the phishing emails as often. They still send them though, from time to time.

I ended up creating my own browser extension for gmail that blocks clicking on any link unless the domain is whitelisted. Now if I click any link and it's not in the whitelist, it shows a popup that displays the domain name, and I can then choose to whitelist it and then it opens the link, or just keep blocking it. I haven't had to re-take any phishing compliance tests in a long time.

venusenvy47• 10 months ago

Aside from the test emails, many emails from contractors that our corporate IT works with have the appearance of phishing. I'm not shy about reporting any of these. Most of the time they say "that's a real email". I like to educate them that their contractors are sending poorly-crafted emails to the whole company.

Zerot• 10 months ago

Seems that the url validation is broken. It says that `http://test.example` is not a valid url

initramfs• 10 months ago

https://cheap-bitcoin.online/packet-storm/backdoor-hunter/ke...

OptionOfT2• 10 months ago

Reminds me of working at a company blocking access to eBay because their URL had .dll in there.

Also, we were thought to inspect the URL before clicking on it.

Except that the spam system they use completely mangles the URL...

Terr_7• 10 months ago

Except that the spam system they use completely mangles the URL...

I hate this trend. Like an overused pool of the same "Secret Questions" every company asks, it needs to be on some "X considered harmful" list.

eru18• 10 months ago

I usually just ask my password generator to generate another random password for the secret question's answer.

supriyo-biswas3• 10 months ago

All of this reminds me of a hilarious situation at a previous employer. As is standard corporate practice, they used to tell people to inspect links by hovering over them to confirm that they lead to the official website of the sender.

People kept falling for phishing links though, so they got a Trend Micro device to scan emails, which also rewrote every link in it to point to their URL scanning service, which means every link now looks like https://ca-1234.check.trendmicro.com/?url=...; I guess no one would be allowed to click on any link in an email at that company.

Of course, their URL rewrites also broke a good number of links, so you'd wake up to a production incident, and then have to get your laptop, log in manually to Pagerduty/Sentry or what have you, and look up the incident details from the email...

thinkingtoilet2• 10 months ago

I had the opposite funny experience. When I worked for Global MegaCorp, they would occasionally send out phishing emails and if you clicked on a link it would be recorded and you would have to do trainings if you got fooled a couple times. Eventually everyone learned to stop clicking on links on emails. That's good. However, they sent out a yearly survey to get feedback from all the employees and no one clicked the link so they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them.

illusive4080• 10 months ago

I’m designing a new phishing campaign that sends a pre-email telling the user they’re getting a legitimate email with <subject> then sending the phishing test email with that subject.

My company does this too by the way. Usually for external things like surveys they send a pre-email.

shawn_w• 10 months ago

... they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them.

Sounds like something a phisher would do. Better not click.

supriyo-biswas3• 10 months ago

The way they used to handle that at a FAANG I worked for was they had this app installed on each machine issued by IT, that would ask you a question daily about some aspect of your workplace.

Handles all the phishing concerns, except that participation was either low or the feedback was negative, which would lead to the leaders issuing subtle threats to the team about how they'd find out the involved folks and fire them. If you tried to uninstall it, it'd be back in a few hours through policy management software (jamf and its ilk). On the internal discussion forums, they'd nuke threads talking about how to disable that software.

So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. I never really needed those threads, all I needed was tcpdump and then blocking its domain in the hosts file :)

red3694• 10 months ago

In New Zealand, there is a long list of companies who need to reach out to a large number of current and former employees, and try to convince them to go to a website and enter sensitive information to receive some money (1). Where I'm working, we found it hard, even for current employees, to convince them that it's not either phishing, or a phishing test.

This is getting off-topic, but I found it interesting so I'll include more details anyway.

In a lot of cases, all the fuss is to return amounts that are tiny, and yet the companies need to keep reaching out and trying to convince people. I got $0.06 (2) from my current employer. Because I've moved countries with them, I ended up falling in the category of needing to provide some bank/tax details. Of course, I wanted to log in with the silliest OS I could think of to test/mess with the tracking dashboard, and so somehow I managed to enter my DOB wrong, which even further increased the back-and-forward and emails involved (I was in the project, so the Payroll peeps involved probably didn't hold it against me).

The re-calculation which led to the payment actually worked out that I had been underpaid in come calculations, but overpaid by far more (although still very, very little) in others. The company believed they couldn't offset, so all the fuss was for a tiny amount, which I felt I really wasn't owed anyway. Also unfortunate, was that if any former employee didn't bother to claim the amount because it's so small it's not worth the fuss, it just leads to more work in follow-ups.

New Zealand Holidays Act is quite an interesting area in general, in a how-can-it-possibly-be-this-hard kind of way. I think it contributes to the reputation of NZ payroll being one of the trickiest in the world.

1) https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-wha...

bryanrasmussen• 10 months ago

noted for my phishing business: track first phishing attempt, send follow up email two days later saying the first one was legit.

noduerme3• 10 months ago

This is hilarious. I wish I'd thought or doing it to my 85 year old father. Maybe I could have saved him the last 10 years of following spam email links into hellish conspiracy holes and identity scams. It didn't matter how many times I told him never to click on an email.

There should be a white hat phishing service you can hire to target your elders. Then when they give up their social security number, someone shows up at their door with a big cake with all their personal details in frosting.

ozim• 10 months ago

That's actually super funny and it is not first time I see quite the same story.

They train people not to click links and then someone in management is fucking stupid enough to pull "just send an email with a link" kind of crap instead of properly planning the communication in advance by telling people that there will be a survey, what will be the company that is sending it, when they should expect it - but that just "too much work".

I would fire that kind of clown ass on the spot for not doing their job.

janc_• 10 months ago

Doesn't help that most surveys are on external unknown domains, and look very suspicious (tracking codes, etc.). I get such links to surveys & other commercial bullshit from my bank too, like they want to train you to click fishing links…

maccard• 10 months ago

I had a similar experience. I got pulled up for not completing my anti phishing training. It had been sent from a third party contractor with a random domain, but apparently I was supposed to know that was safe but the other external links were bad.

JustExAWS2• 10 months ago

I got this email from AWS regarding my personal account.

Greetings from AWS,

There are upcoming changes in how you will be receiving your AWS Invoices starting 9/18/2025. As of 9/18/2025, you will receive all AWS invoices from “no-reply@tax-and-invoicing.us-east-1.amazonaws.com”. If you have automated rules configured to process invoice emails, please update the email address to “no-reply@tax-and-invoicing.us-east-1.amazonaws.com”.

This was brain dead. If I saw an email with that sender, I would think it was a scam. They had to walk it back.

For context, I get random other emails about things like Lambda runtime deprecation from “no-reply-aws@amazon.com” which looks a lot more official.

And “aws-marketing-email-replies@amazon.com”

noduerme3• 10 months ago

Funny, I got an email today from them saying that so many people had protested against this change, they were going to pause it for review. I don't think I've ever seen them respond to criticism like that before.

kimixa• 10 months ago

The company I used to work for had the same thing - everything was a rewritten URL (this was a Microsoft shop so it was rewritten to something like "safe.protected.outlook.com/?random_spew". From what I remember, yo)u couldn't even see the original URL in that (or it might have just been long enough random arguments to be completely impossible to find).

Nothing raises my suspicions quite like something calling itself "safe".

blauditore• 10 months ago

Nothing raises my suspicions quite like something calling itself "safe".

Ah yes, it's like a country having "democratic republic" in it's name - if you have to say it, it's probably not true.

OscarCunningham• 10 months ago

I had the opposite problem at my last company. When you hover over a link Apple's Mail app opens a preview of the page. So if you try to see the URL then you automatically visit the link and get sent for more training.

javcasas• 10 months ago

I learnt that all those emails were sent through some relay. I blacklisted the relay. And then, some real training email notifications were sent through the same relay. But that relay is used for phising, so I just refuse to open the training email. Win-win.

prmoustache2• 10 months ago

Isn't that behavior desactivable?

varenc3• 10 months ago

I registered the "very-secure-no-viruses.email" domain to use for burner emails. I was trying to make one that sounded maximally sketchy. It has lead to some confusing interactions with support though...

isoprophlex2• 10 months ago

I have firstname@lastname.email... people keep telling me that can't be right and don't i mean it ends with email.com?

bl4ckneon• 10 months ago

I have had a .xyz email for like 10 years at this point. It's 50/50 of people saying "is that really a email address" and people acting completely normal.

Never going to know what reaction I'm going to get.

engrefoobiz• 10 months ago

I have a .ninja email and get the same a lot to the extend where I explicitly say "it ends in .ninja with no .com or anything".

Usually use company-i-buy-from@mydomain.ninja whenever I make online purchases, and I had a guy from a small shop call me up and ask why I had an email with his company name on. Took some good fifteen minutes to explain him that I was legit and owned the domain. He was still reluctant in the end, but eventually ended the conversation with something along the lines of "it's your problem, not mine, if the parcel won't reach you for using a fake email" :)

mrklol• 10 months ago

I have a .co domain and noticed that some people think it’s a typo and adjust it to .com

juped2• 10 months ago

Oh, you must mean firstnamelastname@gmail.com.

bigfishrunning4• 10 months ago

i have a .dev domain and i get the same thing all the time

efreak• 10 months ago

I have first@last.family. I've had that issue and my family doesn't want to use it; mostly they'd rather have first.last@Gmail.com, and my dad thinks it should be @firstlast.com or first@last.com (never mind that last.com is in use)

leptons4• 10 months ago

I use [vendor name]@[mycustomdomain].com which is a catch-all email, [anything]@[mycustomdomain].com goes to my inbox, so if I use something like disney@[mycustomdomain].com and then I have to talk to someone on the phone about an order and they ask for my email address, they invariably get confused and think I work for the company or something like that. Then I have to explain that I use the company's name in the email address so I can track who is selling my email. They don't understand it but I'll keep explaining it until they just accept it and move on.

Terr_7• 10 months ago

Real evil would be a kind of reverse-psychology:

1. Make a site like this.

2. Wait for people to try it out with an URL that goes to a significant site (bank, social media, email, etc.)

3. Allow a bit of normal use, then secretly switch the link so that further visitors land on a corresponding phishing site.

4. Having just dismissed a bunch of "obviously fake" warning signs, people may be less alert when real ones arrive.

cyanydeez5• 10 months ago

Im sure in tge nect 5 years a blackhat model will exist that clone any website into a phishing site.

lionkor• 10 months ago

You can just use SingleFile to download the login page of any website and serve it with a webserver

Etheryte• 10 months ago

What do you mean next five years? Tools like this have existed nearly as long as phishing has been a thing. You don't need a model and whatnot, this is old, boring tech.

Groxx• 10 months ago

finally, a worthy successor to shadyurl

sawirricardo• 10 months ago

Interesting, just yesterday i also made url shortener too, focusing on privacy first https://sawirly.com

waterproof• 10 months ago

If you want to be privacy focused, include a way to reverse a shortened URL without visiting it

edm0nd4• 10 months ago

Thanks, I needed something new to cloak my pornhub urls with

BubbleRings• 10 months ago

I put in my own domain name, and got a link on the https://cheap-bitcoin.online domain. Then I sent the full url it gave me to VirusTotal, and one site reported it as malware!

Hilarious, this is great.

cyanydeez5• 10 months ago

There might be mpre falllout

gblargg• 10 months ago

This site needs a way to type in one of those URLs and see the target link.

eru18• 10 months ago

Most browsers have this functionality built in already.

bmacho• 10 months ago

Where/how?

itake• 10 months ago

Doesnt work. IT blocked fresh domain names

JumpCrisscross• 10 months ago

@dang is going to hate me for a few weeks...

EDIT: hehe got one https://news.ycombinator.com/item?id=45297475

spacebacon• 10 months ago

Vouched lmao

nicman23• 10 months ago

https://cheap-bitcoin.online/virus-loader/botnet/worm_encode...

that is just binance.com lol

Manouchehri• 10 months ago

I used to own spyware.tk until I forgot to renew it and the registrar disappeared. Sad I had to let that one go.

Lio• 10 months ago

Ha! Great minds think alike.

We have something that makes genuine links look malicious at work too.

I think it’s called Microsoft Safelink or something. Its purpose is to go through your Outlook inbox and obscure the origin of every link because, obviously, being able to understand what you’re clicking on is bad.

Remember kids, no one ever gets fired for buying Microsoft. ;)

edm0nd4• 10 months ago

this hits so hard hahaha

also ProofPoint filtered links

disiplus• 10 months ago

hahaha yes, a couple of months ago some microsoft servers where down or really slow so no links from emails worked.

hennell• 10 months ago

Safe links also likes to visit sites to check what the link is, so way too many sites will not let you reset your password because you've already used the link now.

Not sure if that's really a safe links problem, but it's super annoying.

lancewiggs• 10 months ago

Fun but scammy.

If you copy the generated url and put it into the entry field (and repeat) then you end up at a bitcoin site. As Bubblerings has pointed out that has malware.

jacobgkau• 10 months ago

If you copy the generated url and put it into the entry field (and repeat) then you end up at a bitcoin site.

Uh, what? I just tried it a few times, and it seems to just follow the redirect each time, always ending up back at the original target URL I entered. How many times did you have to "repeat" to make that happen?

As Bubblerings has pointed out that has malware.

No, that's not what BubbleRings said. BubbleRings said one site on VirusTotal reported it was malware. That sounds like a false positive because the URL is fishy, which is the entire point of the joke here.

cobbaut2• 10 months ago

Nice! Can the generated link please include 'safelinks.protection.outlook' somewhere?

nesk_• 10 months ago

Unfortunately it's not possible to add custom query parameters

rurban• 10 months ago

My browser (Fennec) blocked the phishy URL, great.

p0w3n3d• 10 months ago

In a big enough corpo this is how to get fired quick and hard

srcoder• 10 months ago

I think they should have used an malicious looking URL instead to get to the website

https://pc-helper.xyz/root-exploit/virus_loader_tool.exe?id=...

jari_mustonen• 10 months ago

Stuff like this is good for infinite loops: https://gonephishing.me/shell-jacker/shell-jacker/worm_launc...

SoKamil• 10 months ago

Am I the only one who thinks .xyz domains are sketchy?

Google uses it for its Alphabet Investor Relations site: http://abc.xyz

victorbjorklund• 10 months ago

This is perfect. I love it.

jonathrg• 10 months ago

It's a nice touch that the buttons are styled like ads.

Fokamul• 10 months ago

Is there pizza index tracker for Calcutta?

And this madlad posts this at Friday.

GG HF, SOC people :D

amelius• 10 months ago

Great for pen-testing your parents and grandparents.

mogoman• 10 months ago

Around 2001 I worked for one of the big dot com news outlets. In our reception we had a PC with a browser set up where people could "use the internet" while they waited. One day the receptionist asked me to fix the PC as it wasn't connected to the internet and no one from IT was available. So I messed around a bit (think in the end I just reset the DCHP lease) and to test I opened the browser to surf the net.

Of course with the millions of websites available I couldn't think of one specific one, so I just held down the "x" key and then pressed CTRL+ENTER (which automatically added "www" and ".com" to your entry - typing this on a mac I see it still works with Firefox).

Of course www.x(and a few more x).com was a porn site.

Of course there were a bunch of people (including customers) sitting in reception (and the receptionist herself) who could directly see the screen.

Of course the PC was running nothing else, so a quick alt+tab didn't hide anything.

I announced that all was fine and ran for my desk.

LtdJorge• 10 months ago

Lol, in that situation, the best combination would have been Win+D, I guess.

ale42• 10 months ago

Alt+F4

hdbsbdbd• 10 months ago

Thank you for that anecdote, it lightened my breakfast Pause :)

cobbaut2• 10 months ago

I remember typing whitehouse.com (hoping that was safe) in the early days of Internet... nope, it was not the same as whitehouse.gov!

arghwhat5• 10 months ago

Ah no need, corporate IT already make all URLs malicious looking through some microsoft "secure link" service, and constantly shows everyone shady looking prompts that constantly change and have cmd.exe windows flash in at random.

A phone call from Microsoft about my Norton anti-virus subscription putting me into debt that can only be settled with Nintendo gift cards bought in cash across 16 specific gas stations seem much more legitimate in comparison.

cedilla• 10 months ago

All that anti-phishing training that taught us to look closely at the URL and now it's all just safelinks.protection.outlook.com

fp64• 10 months ago

I find it very difficult to inspect the email headers in Outlook, I think for the iOS app it's not even possible. It's almost like they want to make it less transparent and secure

syllogism• 10 months ago

In Europe there are legitimate and extremely established services that require you to input your bank login details into something other than your bank's website. It's madness.

devoutsalsa• 10 months ago

I recently reported an email with “glint.email.microsoft” as a phishing attempt, but it turned out to be a corporate survey.

jcims3• 10 months ago

Outlook has a rule filter for header content.

Just saying I haven't failed a phishing test in ~10 years.

Workaccount22• 10 months ago

My It department does mandatory phishing training every year, and then for the "test" e-mails, they spoof a domain and whitelist the DMARC on their side so it goes through.

So we get e-mails from @microsoft.com and it's only if you dig in the metadata that you see it failed authentication. The only tell in the e-mail is checking the URL, which doesn't tell you much because tons of regular e-mails use tracker redirects too. They even send emails from our own domain or the domain of our payroll company.

I won't type out my rant, but our IT department is a few guys who couldn't figure out what to do when their competitive xbox FIFA 2006 dreams failed, heard IT pays a lot with not much work, and then sat through the certs.

beanjuiceII• 10 months ago

we must work at the same enterprise

omh• 10 months ago

And Microsoft own the client, so they are the one company who don't need to do this!

If you really want to check every time someone clicks on a link then you can do this in the client and keep the visible link the same for the end user.

But instead there are different teams working on this in Outlook, Teams, Exchange, Defender and god knows where else.

(I'm one of the people in corporate IT trying to turn this off and often struggling)

fphilipe• 10 months ago

In addition to making the link look shady, it adds considerable lag to opening the link.

I'm using Finicky[1] on Mac to rewrite the URL by extracting the original URL from the query params[2].

1: https://github.com/johnste/finicky

2: https://github.com/fphilipe/dotfiles/blob/31e3d18fe5f51b2fd8...

touristtam• 10 months ago

Nice, I use finicky as well, but now and again I have to change a rule or even add a new one. pisses me right off. Anyway thank you for sharing your dotfiles.

btbuildem• 10 months ago

My little hobby is reporting any and all emails about compliance, training, etc (basically anything with actions in them) as phishing and then escalating their responses as "social engineering". It's fun!

dogleash• 10 months ago

Im in the security alias and that happens unironically every time the company rolls out a new external service.

Now sketchy emails are preceded by an equally sketchy “it’s ok” email from IT.

cameronh903• 10 months ago

It’s a trade-off.

Most people are never going to check the links no matter how much you ask them to, and even if they did they wouldn’t know what to check for. But the tool Microsoft give you to check a link before opening it is that awful URL rewriter, which prevents the small minority who would check from being able to.

Similarly those flashing cmd windows are usually automatic update processes that Windows has no way to hide. Even some drivers that MS distribute through Windows Update do it. We could turn automatic updates off, but then nobody would update their software.

IT is rough because you’re often stuck between a rock and a hard place. On the one side you have users who don’t want to change their behaviour, on the other side you have industry leading vendors, that the SLT insist on using, that make it impossible to do the right thing or put the right thing on an Enterprise plan that the budget won’t permit. Then to top it off, there are usually compliance and insurance breathing down your neck forcing you to implement questionable best practices from the 90s, so you just have to do your best to limit the damage.

mobiuscog• 10 months ago

There is an easy answer. Give employees two computers.

One is the 'business' one. Mostly locked down, with checks in place.

The other is on a different network, isolated from all business functions, and they can do what they want but must never use it for work data, just like their phones (that everyone knows they use for social media etc. in the day).

Sure, you still have to deal with copying from one to the other (but there are solutions for that if critical, and much easier to secure).

It sounds crazy, but air-gaps are largely proven and it also means that employees feel less oppressed.

Now I realise, even ignoring the cost, businesses won't want this, as perish the thought their employees may do anything other than work. But I suspect it would actually stop more attacks and issues than otherwise and maybe... just maybe.. employees feel as if they're actually human.

arghwhat5• 10 months ago

I do not believe this is a trade-off, I believe this behavior from corporate IT is a primary cause of the problem. I do agree that dealing with users is awful, but that doesn't justify solutions that only make things worse.

The flashing cmd.exe windows are not drivers from Windows Update - this could have been the case as drivers shipped with Windows Update is a total security nightmare running arbitrary code with administrative privileges upon hotplug - but in this context of managed devices, commonly from HP or Lenovo's corporate portfolio, it's usually additional products and changes pushed by group policy or random management software.

The often changing user prompts, looking like they were from some early 2000's hello world example, come from obscure and overlapping management software they remotely deploy which they change at will. You don't need a proprietary solution to remotely upgrade Google Chrome, just specify an enterprise policy with auto-update. You don't need a proprietary solution to prompt users and manage Windows Update, because you have... Windows Update.

The URL checker has no valid benefit, and makes it so people can never learn how to do it themselves. The browser performs the exact same checks with the exact same capabilities through its safe browsing stuff, and corporate IT often has network-level solutions too.

Corporate IT uses emails services that spoof domains and look suspicious, reversing all the phishing training they paid for.

Not to mention that Corporate IT might deploy network-wide solutions like Cisco Umbrella, which is a TLS Man-in-the-Middle attack where you install their root CA on all machines and let them control DNS to randomly redirect all traffic to their servers, effectively undermining the basis of all modern web security for the entire organization.

In general there's a fetish for buying products that has significant negative impact to security, user experience and possibility of training users, usually for the purpose of feigning progress and meeting some targets. Say, they had a ransomware incident, and now they're buying every ransomware product for a few years. Stuff with such buggy kernel code that it deadlocks and makes it impossible to create new processes until you hard reboot. I'm sure that's not a security problem!

Den_VR• 10 months ago

I sure do miss the days before browser makers conspired to make it near impossible to check the certs when there’s a certificate related error. “Most people are never going to check properly” is a poor excuse.

b800h• 10 months ago

Very funny, but this could be used for both intentional and unintentional Black-hat SEO. My theory goes:

    1. Create dodgy looking URL
    2. AI in Gmail spots link, blocks it.
    3. Blocked link is spidered for more information automatically
    4. Link resolves to website
    5. Website black-listed

So I'm not going to use it!

nedt• 10 months ago

Yeah none of them are working in my corporate network. That's not the way to piss of the IT department.

southernplaces7• 10 months ago

This was the best damn belly laugh I've had all week. Ahh. Thanks for that.

"Just fuck me up fam!"

You had me spraying coffee by that point

All the funnier trying it with links to community church services (baptist no less).

QQQQQQQQQQQQQM• 10 months ago

I got an email the other day saying I had a new voicemail. The content of the email was regarding a new voicemail I received, and I should click the attachment to listen to it. The header and info was from some service that I had never heard of and we definitely don't use. Also, the entire message was a screenshot of an actual email, so there was no text, just one image. The attachment was a .html file.

I reported it for phishing and I kid you not, less than 30 seconds later I got a response "Email is not suspicious"

What do you MEAN email is not suspicious? This is the most suspicious email I have ever received!

Arch-TK• 10 months ago

safelinks keeps getting mentioned.

Here:

    #!/usr/bin/env python3
    from urllib.parse import urlparse, parse_qs
    from sys import argv
    print(parse_qs(urlparse(argv[1]).query)['url'][0])

This is unsafelinks. Pass it a safelinks url, and it will print the original URL. Very important when you have a one-time-use link which safelinks can break.

bArray• 10 months ago

No need, my IT already do this by running the MimeCast email filter [1]. Links to non-whitelist sites are expressed in the format:

    https://url.uk.m.mimecastprotect.com/s/<random_string>?domain=<domain_name>

Maybe I can tell the link is from Google, but not what is likely to be in the URL. It's a complete surprise as to whether I will be looking at a web page or downloading something.

[1] https://www.mimecast.com/

andrewblossom• 10 months ago

My favorite part of mimecast is that their servers apparently can't handle normal volume and regularly time out before redirecting to the destination URL.

747fulloftapes• 10 months ago

That's a feature, not a bug. If the user can't load the redirection, they can't get phished! Problem solved.

If anyone complains, refer them to the security department to be audited. It's really rather suspicious when someone values doing their job above security.

hobs• 10 months ago

Now you just need a browser plugin to extract the domain name and fix it, problem solved.

smoovb• 10 months ago

Somewhat tangential - devious unsolvable captchas use to infuriate phone scammers. https://youtu.be/TOzEnwl7LkA?si=ZG5DJXAjUDCNaAuL

kittikitti• 10 months ago

This is really funny and gave me a great laugh. Thank you for sharing and making this tool.

bethekidyouwant• 10 months ago

www.shadyurl.com was around 15 years ago. I guess its gone now.

dsr_• 10 months ago

IF your national security recommendations have an eight point plan where one point is exclusively concerned with Microsoft, maybe you should stop using Microsoft.

https://www.cyber.gov.au/business-government/asds-cyber-secu...

xyst• 10 months ago

I had a coworker that would "prank" others by sending out of band messages from other colleagues when they leave their laptop open.

I think that guy would get a kick out of using this for his pranks.

https://pc-helper.xyz/usr/libexec/gnome-session/binary/etc/p...

Although I suspect some IT drone would be less enthusiastic when reviewing the chat logs when it’s picked up on heuristics

PLMUV9A4UP27D• 10 months ago

Oh, this can be used as a fun twist in our company's internal security education. A rickrolling link!

basscomm• 10 months ago

That site is trying to tell me that http://localhost is not a valid URL

dyauspitr• 10 months ago

Ha I wish there were a less over the top mode though. Make them subtly sketchy.

mig4ng• 10 months ago

This is hilarious! Make the accordion of selection always open please.

roguas• 10 months ago

i seriously hate my it dept attempts, they send you a link, you click, boom you have to enroll to a training

im sry, did i miss the part on how you can hack someone by simply sending them the link? is the web seriously that bad? honestly at least do full job and create some phishing website that goes along, otherwise wtf?

Want to piss off your IT department? Are the links not malicious looking enough?

Related Stories