7 ms·
Are there any indications that the email is even a phishing email? The email is from an internal address. Do they mean to say that their internal email system c
by superseeplus 6y ago
Are there any indications that the email is even a phishing email? The email is from an internal address. Do they mean to say that their internal email system can’t detect fake emails purporting to be from an internal address? This is cruel in multiple ways. Promising a non existent bonus and then blaming employees for failing a phishing test (which is not even a real phishing email or exposes deep seated IT inadequacies). Presumably this goes on their performance report too.
- agotterer 6y agoI was thinking the same thing. You shouldn’t fail by clicking a link sent by an internal email address. If the link took you to an external site and you entered your GoDaddy credentials or provided personal information, that might be a different story.
- vitus 6y ago> You shouldn’t fail by clicking a link sent by an internal email address. I disagree in making this broad of a claim -- insider threats are certainly an issue. And as a sibling commenter points out, email headers are easily spoofed. I'm not condoning GoDaddy's pentest (agreed with everyone else who sees this as a cruel prank), but also, um, why would you click a link if your company is telling you they're going to pay you a bonus? Wouldn't that just go through payroll as with everything else? edit: it looks like the phishing email provided the bonus as an opt-in? yeah, that ought to raise red flags that it's not just being applied across the board, but still, it's been a tough year, so people might not think as hard about it.
- michaelt 6y ago> email headers are easily spoofed. Not if they've properly deployed DKIM and SPF - which, if they have a phishing problem, should have been among their top priorities.
- vitus 6y agoshould have been != was I don't know what the security situation is like at Godaddy, but I'm sure there's some amount of investment needed to roll that out broadly without accidentally breaking existing employee workflows. And my point still stands re: insider attack. At least at Google, anyone could ostensibly register HappyHolidays@google.com (or some variation if it's already taken) as an alias or a mailing list, which removes the need for spoofing.
- deleted 6y ago[deleted]
- chris11 6y agoEntering personal info might also be understandable. My employer gives a Christmas gift. This year they asked us to update a form with our temporary address if we were in a different location.
- vitus 6y agoAbsolutely, in the context of a physical item being shipped to you (especially if they can't just distribute it at the office), if it's not through payroll. (e.g. we had site-specific fun events in lieu of the annual holiday party) But a cash bonus? That's the epitome of something that 1) should go through payroll and 2) should just get direct-deposited into your bank account as is the case with your regular paycheck. There's no reason why you'd need to provide any additional info.
- armada651 6y agoDoes it matter if it's an internal address? Any address can be spoofed and some internal addresses could have leaked. I wouldn't attach any value to the address even with SPF and DCIM, which are often mis-configured.
- iamacyborg 6y agoIf GoDaddy are misconfiguring their DKIM records they’ve got bigger problems.
- michaelt 6y agoThe apex phishing e-mail is indistinguishable from a legitimate e-mail, except by SPF/DKIM. After all, the apex phishing e-mail is based on a byte-for-byte copy of a legitimate e-mail.
- deleted 6y ago[deleted]
- toddh 6y agoUsually there's a corporate email address for internal email. Does all godaddy internal email come from godaddy.com? That would be strange.
- tsimionescu 6y agoThe email in my company all comes from @<company-name>.com. Why would a company keep a separate domain for internal vs external email? Is that common practice?
- deleted 6y ago[deleted]
- michaelt 6y agoIt's rare but not unknown - for example Facebook employees' e-mails are whatever@fb.com rather than whatever@facebook.com and sometimes facebook send e-mails from whatever@facebookmail.com ¯\_(ツ)_/¯
- terinjokes 6y agoFacebook's case is likely because they launched a public email service back in 2010.
- the_jeremy 6y agoIt's not internal vs external, it's employee vs users (e.g., @google.com vs @gmail.com)
- deleted 6y ago[deleted]
- superseeplus 6y agoThat’s an excellent point. Yahoo uses yahoo.com for their public email service. Google uses google.com for their internal (employee) email addresses.
- 6y ago
- xref 6y agoIt was sent from “@gocladdy.com” and tried to trick users with the kerning between “d” and “cl”, where are you seeing it was an internal address?
- tsimionescu 6y agoUnless the pictured email client has an absolutely horrible kerning implementation, it is sent from @Godaddy.com. Where did you get the "@gocladdy.com" information from?
- musingsole 6y agoFrom xref's other post: https://www.wfaa.com/mobile/article/news/godaddyunderfireforfakebonusemail/75-d6ab6d6e-e8bb-4269-a7ad-6d08bbc35ff2 https://www.wfaa.com/mobile/article/news/godaddyunderfirefor... https://imgur.com/a/eqrijWx https://imgur.com/a/eqrijWx
- tsimionescu 6y agoThe photo from the original article is different: https://imgur.com/a/anfsAsa https://imgur.com/a/anfsAsa I can't access wfaa.com ("Access denied" errors even on /), perhaps they are blocking European traffic?
- llacb47 6y agoThat's Tegna for you.
- permo-w 6y agothe second line of the article says it is from happyholidays@godaddy.com. So that’s where
- deleted 6y ago[deleted]
- throwaway3849 6y agoFor phishing test links that contain identifiable query parameters, it's easy enough to write a quick script which finds those emails and moves them into the "phishing tests" folder. For those operating in a system which proxies email links, just not checking email is a valid alternative. Just treat the whole well as poisoned.