Have I Been Pwned owner, pwned.
- A jetlagged Troy Hunt accidentally clicked a link and logged into an account only to realise he had been phished.
- Despite reacting quickly, attackers were able to export a mailing list for Hunt’s personal blog.
- Hunt has detailed the attack and warned his subscribers in a timely fashion.
I've clicked an obvious phishing link once in an isolated environment with a hardened browser on purpose. It had a tracking link and all and the URL was just ever so slightly off. Nothing happened on the target page though. No attempted script execution, no iframes, no cross site shenanigans, no weird popups or a fake login UI urging me to enter my credentials asap.
Someone from my company's security department called me shortly, telling me how I've failed the obvious phishing exercise and I had to undergo a half hour long mandatory awareness training. Wasn't getting out of that one.
If you look at the headers, you can tell which ones are fake phishing and real phishing.
Please explain
Most companies add an email header like "X-PHISHTEST" to the phishing tests (and a corresponding spam filter rule) to ensure they don't get caught by spam filters. If you look at the headers of a spam email, the company test emails will have that header.
Any company that does that needs to be sent on a mandatory awareness training for failing an obvious fake phishing exercise. It's far too easy to whitelist that and send it to an "ignore" folder.
Is there anything bad that can happen if you just click a link without logging in or anything? How is it different from opening up a random search result?
Not all phishing links are related to credential theft or trying to get you to download something malicious. Zero-day vulnerabilities in web browsers are revealed constantly. A malicious website (or malicious content embedded into an otherwise benign website) can leverage these or other unpatched vulnerabilities when visited.
You should never follow a known or suspected phishing link unless it's your job and you are using the appropriate tools and techniques. Just report it to the security department or delete it and move on with your day.
Does that also mean I should not browse any websites I don’t already know? That’s very limiting.
I never said that. I said do not follow known or suspected phishing links. It takes practice and skill, and it is not always simple. But if you know if it is a risk, you should consider avoiding the risk.
"This looks like it might be phishing. Let me check it out and see what's on the other side." <--- That's what I am suggesting to avoid.
Security is an onion: layered. Patched software. Good, unique passwords. MFA. Various security defense tools. But technology can have gaps, flaws, or be circumvented. It's important to keep in mind that us as individuals are also a security layer, and are often the first or last line of defense.
I’m no expert, but as I understand it, there are several things that can go wrong just by clicking. This depends somewhat on your browser settings and how you use it.
Visiting a compromised site may allow the attacker to access data from other tabs and windows in the same browser session. Some sites warn you to close the whole browser when logging out because of this.
Sometimes bugs in a browser can allow a site to run arbitrary code on your machine. These hopefully get patched quickly.
If the link was unique to the email, then it could be a signal to the phisher that is a valid address for further targeting.
