-: In this lesson, I'm going to show you how easy it is
to conduct your own phishing campaign
so you can test your users and see if they know
the correct practices and how to avoid a phishing scam.
Now in this campaign what we're going to do
is create our own email,
we're going to send it out to our users
inside our organization,
see if they click on any of those links,
and if they do we're going to provide them remedial training.
To do all of this, it's not complicated at all.
In fact, you can use a free program
that's provided by Trend Micro to do this for you.
This program is called Phish Insights.
To access Phish Insight you simply need to go to
phishinsight.trendmicro.com.
If you've never used it before
you'll have to sign up and create an account.
Again, this is a wonderful free tool.
Next you will log into your account.
So if we want to create a campaign for ourself
we're just going to click on Create a Campaign.
Now I'm going to make a very small campaign here
of just one target.
So I'm just going to key in the recipient
of who I want to send this message to.
And the person I'm going to send it to is Jason.
So I'm just going to call my list name Jason.
And I'm going to put Jason, Dion, Jason@diantraining.com,
and his title which is instructor.
And that should be fine.
And then we'll hit continue.
And you'll see that I now have First Name Jason,
Last Name Dion, Department is Instructor,
and his Email Address.
Go ahead and hit Done.
Next, I'll go down to step 2 which is selecting a template.
What I'm going to do is I'm going to select one
that looks like a LinkedIn connection request
'cause we get those all day long.
And most of those don't think twice about clicking on them.
So if I just click on that here's the
email they're going to get.
It's going to say Jason, please add me to your LinkedIn network
and all these places would add in Jason Dion.
Hi Jason Dion, I'd like to join your LinkedIn network.
And there's the Accept or the View profile,
the update, subscribe, all that kind of good stuff.
And this looks like a very realistic email,
and it's already done for us.
If we wanted to we could customize it
to make it look less like LinkedIn
or more like something else.
But for now we're going to use this default.
Next, we're going to go through and specify
what the email address is going to come from.
In my case it's going to come from invitations@linkein.com.
Notice the email is not actually spelled out linkedin.
They're missing a "d".
This is something that our user should see,
and hopefully flag it as a phishing scam
as opposed to a real one.
And notice that invitations is also spelled wrong.
But if you wanted to make this look very, very realistic
you could actually put the exact correct
invitations@linkedin.com and spell it all correctly.
Next you can set up a schedule and run your campaign
over several weeks or over one week or two weeks
or even a month.
And this is good if you have a larger organization
where you're doing this
with hundreds or thousands of employees.
You want to see if they learn over time.
And so by doing that you can set up a schedule.
You can also, then, decide what happens
if they click on one of the links.
So I can have when the campaign ends
they will get training and be told,
yes, you clicked on a link and you shouldn't have
or no you didn't.
Or you can do it immediately
when they click on a link and they're phished.
They might get something that looks like this.
This is a webpage that would come up
and say, hey, you've been phished.
You need some remedial training.
Click here and you'll get the training.
Something of that nature.
So that's the way you can do that.
And if we go back up here to our invitation,
setting our schedule, or you can do it without notice.
So I'm going to leave it with when phished.
And then you can send yourself a text message
or confirm to start the campaign.
So now you'll see that that campaign is upcoming,
and it will start in about an hour from now.
Once that happens we'll be able to see who gets fooled,
analyze those results, and give those people training.
So let's look at an example phishing email.
I just sent one out that showed it was coming from LinkedIn.
Now this is what the user is going to see.
From all looks it looks like a legitimate email.
If I look at the subject line,
it says Jason, please add me to your LinkedIn network.
If I look at who it came from, it came from invitations.
And if I look at the message it's got the LinkedIn logo,
it's got things that look just like a LinkedIn message.
But it's not.
If I click on any of these links
it's not going to take me to LinkedIn.
Instead, it's going to take me to a phishing website.
And as you see as I hover over it
notice what the link is.
It's not LinkedIn.com.
It's websitefun.club.
Then I go over here to the profile one.
Same thing, it brings me to another area of that website.
Changing the frequency, same thing.
This is a classic phishing scam,
where it looks like one thing,
but when you click on it, it goes to another.
Notice this email is well crafted.
It's crafted to look exactly like LinkedIn.
And it will trick a lot of your users.
So one of the things we want to do with our phishing campaigns
is to train our users that clicking links is bad.
Instead, if I got this as a user what should I do?
I should open up a new web browser.
And I should go to LinkedIn.com, the site I know.
And from there I can accept or reject that friend request.
But just getting an email, you don't want to click
on those links because that is an easy way
to get yourself into trouble because
it can download malware
or it might just collect information from you.
Like you click on it says we need your username
and password to log into LinkedIn.
And they have a website sitting there
that looks just like LinkedIn.
And when you give them that information
they now have your credentials,
and they can take advantage of that for other attacks.