Re: FYI: Another round of spear Phishing

[Dean Halter <Dean.Halter () NOTES UDAYTON EDU>]

> One question is which kind of "phish" to use as a model: 1) the
> one that asks for an email password by return email or 2) one
> that directs the user to a look-alike website at a clearly bogus
> URL.  We've been getting a LOT of the email reply variety lately.

We discussed this as well.  Email potentially travels in the clear and,
depending upon how you plan on "catching" the replies, mail forwarding
might cause also problems.  If we can get the go ahead, we'd like to send
our own faculty and staff a spoofed, simple email with a URL redirecting
them to a secure website off-campus modeled to look like our
authentication page and, if a user bit (I purposefully leave this vague),
pop up an educational page.

Dean