Phish Bait

4:20 PM -- Yet another phish tale.

And this one may be a sneak-peak of things to come: What if a phishing exploit came from within your network?

Consilium1, which performs white-hat attacks and penetration tests, is about to try that exploit on one of its clients, with a twist.

Using its penetration tool, the firm will send an official-looking email which appears to be from an actual company administrator or executive but contains a potentially deadly link. But if users click on this link, it doesn't send them to some infected Website or grab their browser settings. No, this phish plops them right onto the "attacker's" laptop and deploys an agent that automatically gives the attacker administrative privileges on the user's workstation, according to Sean Kelly, business technology consultant for Consilium1.

The good (and bad) news is this exploit only works from within the same subnet on a LAN, so it won't be some Eastern European phishing gang attacking your organization. It will be someone from within the company, or a crafty social engineer who gets past the receptionist.

What made did Consilium1 come up with such a creepy phishing concept? Curiosity.

"We generally just attack servers or do a vulnerability scan to see if there are any missing patches or holes, and we try to run exploits to crack them," Kelly says. Or the firm performs sneaky acts of social engineering, like impersonating a telecommunications company to see if they can get access to the server room.

This time around, Consilium1 wanted to test-run a socially engineered phishing attack to see if its client's users will take the bait. If they do -- which is likely, since a spoofed internal email can be pretty convincing -- it could open up a whole new can of phishing worms.

— Kelly Jackson Higgins, Senior Editor, Dark Reading