Testing the depth of user stupidity

Was just thinking - am sure most people in charge of security for any size of network have warned the networks users not to download any attachment they were not expecting or that they havn't checked with the sender to ensure they did indeed send the attachment.

But how many people can be sure that their users are following these guidelines?

I have also warned people at work about the ways in which some virus writers will try and trick users into running attachments.....spoofing the from address (maybe something like [email protected]) so that they think it is from a trusted source.

Well I have decided to put it to the test :)
Have just constructed a small package to email out tomorrow - it contains an installation file which simply copies a .bat file to the HD runs it and then pops up a message saying "Your Tech dept is currently testing users security awareness. You have failed! This could have been a virus"

the .bat file is set to send a net send msg to the IT computer - lets see how many wee pop-up boxes I get tomorrow ;)

v_Ln

I would like a copy of this file. Was it done in C++ or is it just some script you attached to a txt file? anyways if you could show the code on this site I would apperciate it. thanks Ghost_25inf

is not coded is just a simple .bat file placed inside a custom instal package made in paquet builder.

v_Ln

Hah I am curious how this will turn out.

Yeah you gotta defiantly post the updates to this little experiment..
Seems like a brilliant idea Val, but how are you configuring it so that it sends you an email saying whether someone passed or failed?
It sorta sounds some what like how a keylogger would work, but it's not..
Anyhow

cheers
.:front2back:.

Hey Val I would like to see the results of your experiment. But we already know what you are going to find out. Trust me, it's worse then you are going to guess.

End Users will often just open things not really caring what they are or who they are from. I swear if I had a nickle for everytime someone at my job did, I would have enought nickles to buy a keyboard that sends an electrical shock to the person that opens just anyfile.

Let me see your results I am going to have to look this over.

Good Idea! Although I shudder at the thought of the sheer amount of pop-up boxes you are going to receive. I look forward to seeing the results.

User stupidity, don't even get me started on this one.........

If your company is large enough then there will always be a small percentage that's just so incredibly stupid, you just can't believe some of the things they do or try.

luser: "I have a problem with my computer"
me: "Ah. Ok. Are you sitting behind it?"
luser: "Yes. I am"
me: "Ok. What do you see?"
luser: "Lots of cables..."
me: "Argh!..."

somenewguy: "Is this network operations?"
me: "Yes, it is."
somenewguy: "My boss wanted to get something and the guys downstairs said I should ask here"
me: "Well, what do you need?"
somenewguy: "My boss told me to get a box of landscape paper."
me: "Doh!"

This is also the reason why we have huge content-scanners and a really strict policy. This means nobody is allowed to download and/or email any "dangerous" files.

To parody an old adage: A user can only be as stupid as the admin lets them. :)

I would love to see the results of your experiment. I reckon that for every 20 users you will get at least 25 popups as some users will open it twice just to make sure they understood.

Quote:

---

To parody an old adage: A user can only be as stupid as the admin lets them

---

Hate to say chsh but that is not always true. example :
my direct line rings.
hello.
Hello this is Mr. XXX (director of the acconting departement). I have been told by the head accountant in our fraud section that there is a bad smell of something burning coming from one of our printers .
Ok I said I would go and look rather than send one of my techs.
I took the stairs armed with a pliers to pull the half melted transparency from the laser printer. The week before we had someone on the same floor wipe out five laser printers with transparencys he brought from home. The first printer melted the transparency so he tried the second printer.That one melted it also but it seem be almost printed so he tried the third printer. He then decided the first three must have been too small so he went for our 2 group printers.
anyway got to the office where the printer was and there was in effect a heavy oily smell but no smoke. All the accountants were waiting outside at the coffe machine just in case. Called in the head accountant and explained that to solve the problem all he had to do was keep the windows shut while the workmen were resurfacing the road in front of our building. Tarmac stinks while it is still hot.
:D

Hehe cool idea...

How did you get the boss to buy in on the idea...might look bad if he or she were to click on it..and find out your the one to set it up...lol

Unless you are the boss. then your all good :-)

Any chance you can post it in the tools archive, or send me a copy on email? be good to have in the tool box :-)

Thanks!!

I have done this before and tricked about 50% of the people in the office into opening the attachment. (Bat file that did a net send to my computer)

Quote:

---

I took the stairs armed with a pliers to pull the half melted transparency from the laser printer. The week before we had someone on the same floor wipe out five laser printers with transparencys he brought from home. The first printer melted the transparency so he tried the second printer.That one melted it also but it seem be almost printed so he tried the third printer. He then decided the first three must have been too small so he went for our 2 group printers.

---

Had this same problem with one of our users trying to print on envelopes. It would melt the plastic on the envelope window and then harden in the printer. Well the user did not tell me and sure enough, later that day I got a call to come fix the printer. We had to buy a rebuild kit to get ti working again.

Users : You can't beat 'em ----------------------------- Mores the pity !!!

I think thats a great idea. I'm my Dad's unoffical tech guy for his small accouting firm. They never listen does not matter how many times they have to call me. Even my Dad who just downloads every attachment on his work comp. I can't wait to see your result.

bad news guys - just got home.....we spent all day testing EVERY area of ALL the servers in the building as no-one could get/send email or view web >_<

the amount of times i was down in the coms room fiddling with the firewall ARGGGGG!

only to find out it is the company who suplies us with our net connection that went down and not us -_-

am gonna do it tomorrow though when i aint so preoccupied - lol

as for the whole "how did boss clear it?" he hasn't am doing it off my own back - but am semi-head of tech so is my duty to check these things ;)

v_Ln

I remember that in my first two weeks in my first support role I biult 11 stand alone AV scanning pc's for floppies I personally went to all 11 offices across England to set thesse up and demonstrate gow they work ("Yes I know but they, would never have been able to turn the monitor on if they had not been shown first") Two weeks later I had to go back to our office in Sheffield ("Thats a long trip from London to Sheffield, by train") only to find that not only was the Stand Alone off, but it was also in the storage cupboard......

They then had the nerve to complain that they had been sent a disk and they think that the current virus came from that disk.

After to speaking to my Line manager I prompty went around and removed all the floppy drives.............

Kind of reminds me of the user, phoning tech supp and stating that the coffee holder broke off..

Nowadays virii can come through the CD as well I guess, since people use rewritables to transport work home and back to work sometimes. And since they are prone to do the same mistake at home [of openning all the files they receive] then it can be safely assumed that one needs to completely block any media access to the computers.

Well, tech support must be a great job! And all the 'idiots' call the tech people geeks. But they depends on these geeks as much as they depends on their morning coffee, or their sleep. Little do they know of the power of the tech guys!

Quote:

---

Originally posted here by MURACU
Hate to say chsh but that is not always true.

---

I know it doesn't apply to every situation, however in terms of opening viruses, and allowing them to infect the machine, a lot can be done by the sysadmin to lock the box down.

Quote:

---

I took the stairs armed with a pliers to pull the half melted transparency from the laser printer. The week before we had someone on the same floor wipe out five laser printers with transparencys he brought from home. The first printer melted the transparency so he tried the second printer.That one melted it also but it seem be almost printed so he tried the third printer. He then decided the first three must have been too small so he went for our 2 group printers.

---

It seems everyone has an issue with transparencies and lasers. The COO at the company I used to work for who ruined a perfectly useable $7500 networked colour laser printer from canon doing that. Apparently transparencies can do a lot of damage to the laser, and it really gummed up the bloody works. I'm no expert on printer hardware, but basically, I didn't really question it when the canon rep. told me it was pretty well FUBARed.

Quote:

---

anyway got to the office where the printer was and there was in effect a heavy oily smell but no smoke. All the accountants were waiting outside at the coffe machine just in case. Called in the head accountant and explained that to solve the problem all he had to do was keep the windows shut while the workmen were resurfacing the road in front of our building. Tarmac stinks while it is still hot.
:D

---

Hahahaha. A colleague of mine described a similar experience with an old place he worked at. Only it was the marketing person complaining of the stench of toner from the printer, and it turned out to be the repainting going on in an adjacent office...

Quote:

---

I know it doesn't apply to every situation, however in terms of opening viruses, and allowing them to infect the machine, a lot can be done by the sysadmin to lock the box down.

---

Chsh I agree totaly with that. I wouldn't blame a user for a virus that came through the network either by mail or by the lan while in a normal woking enviroment. In that case it is the IT departements fault that the virus got through not his.
I only get annoyed when your are a couple of hours into an attack, you have sent out warnings to everyone not to do such and such till they get the all clear. Things are just getting under control then someone somewhere does exactly what he was told not to do.
The hardest part IMHO of the admins job is not locking down the hardware and software. The information is out there and easy enough to find. The hardest part is keeping the users security conscious in the time between security alerts.

Anyway I still reckon valhallen will have some users who open the mail twice just to make sure they really understood. Then a couple more will open it just to see the message.

This, couple with the fact that my users don't seem to be able to "cotton on" to the fact that a file with a single .txt extension is safe to open no matter how many times I tell them is why I have started stripping every file with a potentially harmful extension in SMTP mail at the firewall. During the recent spate of Netsky, Mydoom and Bagle the variants were coming more quickly than the defs were even though my mailserver updates it's defs hourly we had 8 new variants get as far a a (l)user..... Only one clicked on it fortunately and I was alerted by other systems. The big pain was that I made the _stupid_ mistake, (knowing that the AV removes infected files and replaces them with an attachment, (duh), telling the recipient what it did), of telling the users that if it doesn't have a single .txt extension to forward it to me....... Well, let me tell you how quickly an inbox can fill up during a major virus attack with useless friggin' text files forwarded by 650 odd users who are too scared to even look to see what the extension is..... :(

Once the firewall was stripping _everything_ I sent out an email that said "there are no longer _any_ attachments you _can't_ click on - have at it". My inbox has since returned to normal size..... :cool:

I think that whether or not you blame the individual is dependent upon the critera defining the situation. Normally I would agree that the admin is at fault. However, think back to the I Love You! virus. No virus definitions were quickly available to detect the virus and we were forced to depend on e-mail warnings and employee training. I was of the opinion that if you received 30 copies of an e-mail all with the same subject line, then anyone with the lick of since equal to a doorknob should have suspected that this might be a virus. Unfortunately our employees seem to conviently forget this. I even had one employee to open that particular virus 3 times, before the updated detection files were released. What do you do?

I been reading this as it develops, and I would just like to say that it is not the user who is at fault, neither is it the Admin's or the rest of the IT Dept. In fact it is a combination, of everyone, from my point of view as tech support, I found it in valuable just to spend time as oftern as possible with my users just to help EDUCATE them, the biggest threat to Security is the uneducated, yes I know that there are users out there who no matter what will not and quite possibly can not be educated, it falls on us all to do the best we can.

Like the age old argument which is the better OS, neither! its what ever does the job best, the more we can educated and get it to sink in, the more time we can spend of other issues that everyone one can benefit from.

Is this not true!!

Not just the poor ? users, I've just started a new job, desk top support, repair and reimage, with some tech assist to the field engineers. One engineer ? called to say that the base unit was 'clunking'when it was shaken ??? When asked to open and check ? he said that they had a 'no open box policy' on that customers premises ??? when the offending unit was returned, I found the CPU fan / heatsink had fallen off !!!!! I've only been working for a MONTH, and I want that guys job. No responsibility, and if it doesn't work, straight back to depot. Also had other 'engineers' asking how to FIND BIOS !!!!!!!!!!!!! Still; made me laffff !!!! :D

Just remember...... For the masses......

If you can drop to a command prompt you are GOD.....

Some of the "masses" are employers in the "computer" business..... :rolleyes:

OverdueSpy
I was thinking of the I love you virus when i made my previous post. We were getting e-mail floods for days after we got things under control because users were opening the mails that they had save in their archives. I will admit that our users are getting better security wise but it took a couple of serious virus attacks and a lot of sweat on our side to educate them before they got the message.
In my experiance the users that cause the most problems are normally in the IT departement itself. They know that all the security rules apply only to the basic users who know nothing about computers....... :)

Sorry for the late update - what can i say it was a friday night ;)

well as expected within 30mins of sending the email i started to recieve pop-ups not a great amount but some - averging about 1 or 2 every 10mins

but then they just stopped.....but after going to speak to some of the people who had sent me pop-ups i discovered why they stopped....turns out word travels faster than email - those who got them had said to other people so of course they didn't run it - so wasn't quite a fair test

v_Ln

.....but after going to speak to some of the people who had sent me pop-ups i discovered why they stopped....turns out word travels faster than email

The above from v_Ln, I would suspect that the real reason is not that your users are getting more security savvy ?
But that the fastest travelling words would be the law according to your goodself!
It appears they are definitely getting v_Ln savvy :D

/off topic

Transparencies/slides in laser printers

I have had this problem as well, the point is that the standard OHP material will not work in a laser............you have to pay the extra money for the correct media?

A slightly cheaper solution is to print the slides then take them to the photocopier and use photocopy film.

Or there is always "powerpoint" (or similar) and a data projector?

Just a few thoughts............good office printers are rather expensive? and it would be cheaper to leave the correct stationery in the cupboard?

Cheers

Maybe you should have done it more like what a virus writer would do,
where nothing pops-up on their screen when clicked,
I have known users I have services where they clicked it multiple times
trying to get it to do something.
Then maybe it would give a more realistic result.

Just a thought....

At my job, we have it set so that it will strip all attachments that are exe pif scr bat etc. The only attachments it will allow are images. So far, so good.

I agree with wyverspur. If you could some how cut out the word of mouth factor then you would get a more realistic sample. Although it could be considered a good thing that they talk to each other about it.