In this lesson,
I'm going to show you how easy it is
to conduct your own phishing campaign,
so you can test your users
and see if they know the correct practices
and how to avoid a phishing scam.
Now, in this campaign,
what we're going to do is create our own email,
we're going to send it out to our users
inside our organization,
see if they click on any of those links,
and if they do,
we're going to provide them remedial training.
To do all of this,
it's not complicated at all.
In fact, you can use a free program
that's provided by Trend Micro to do this for you.
This program is called Phish Insights.
To access Phish Insight, you simply need to go
to phishinsight.trendmicro.com.
If you've never used it before, you'll have
to sign up and create an account.
Again, this is a wonderful free tool.
Next, it'll log into your account.
So if we want to create a campaign for ourself,
we're just going to click on create a campaign.
Now I'm going to make a very small campaign here
of just one target, so I'm just going to key in the recipient
of who I want to send this message to.
And the person I'm going to send it to is Jason.
So I'm just going to call my list name Jason.
And I'm going to put Jason comma Dion, jason@diontraining.com
and his title, which is Instructor and that should be fine.
And then we'll hit continue.
And you'll see that I now have first name Jason,
last name Dion, department as instructor,
and his email address.
Go ahead and hit done.
Next, I'll go down to step two,
which is selecting a template.
What I'm going to do is I'm going to select one
that looks like a LinkedIn connection request.
'cause we get those all day long
and most of us don't think twice
about clicking on them.
So if I just click on that,
this is the email they're going to get.
It's going to say, Jason, please add me
to your LinkedIn network.
And all these places would add in Jason Dion.
Hi Jason Dion, I'd like to join your LinkedIn network.
And there's the accept or the view profile,
the subscribe, all that kind of good stuff.
And this looks like a very realistic email
and it's already done for us.
If we wanted to, we could customize it
to make it look less like LinkedIn
or more like something else.
But for now we're going to use this default.
Next, we're going to go through
and specify what the email address is going to come from.
In my case, it's going to come from invitations@linkedin.com.
Notice the email is not actually spelled out LinkedIn,
they're missing a D.
This is something that our user should see
and hopefully flag it as a phishing scam
as opposed to a real one.
And notice that invitations is also spelled wrong.
But if you wanted to make this look very, very realistic,
you could actually put the exact correct
invitations@linkedin.com and spell it all correctly.
Next, you can set up a schedule
and run your campaign over several weeks or over one week
or two weeks or even a month.
And this is good if you have a large organization
where you're doing this with hundreds
or thousands of employees,
you want to see if they learn over time.
And so by doing that, you can set up a schedule.
You can also then decide
what happens if they click on one of the links.
So I can have, when the campaign ends,
they will get training and be told, yes,
you clicked on a link and you shouldn't have,
or no you didn't.
Or you can do it immediately.
When they click on a link and they're phished,
they might get something that looks like this.
This is a webpage that would come up
and say, "Hey, you've been phished.
You need some remedial training.
Click here and you'll get the training."
Something of that nature. So that's the way you can do that.
And if we go back up here to our invitation setting
or schedule, where you can do it without notice,
so I'm going to leave it with When Phished.
And then you can send yourself a text message
or confirm to start the campaign.
So now you'll see that that campaign is upcoming
and it will start in about an hour from now.
Once that happens, we'll be able to see who gets fooled,
analyze those results and give those people training.
So let's look at an example phishing email.
I just sent one out that showed it was coming from LinkedIn.
Now this is what the user is going to see.
From all looks, it looks like a legitimate email.
If I look at the subject line, it says,
"Jason, please add me your LinkedIn network."
If I look at who it came from, it came from Invitations.
And if I look at the message, it's got the LinkedIn logo,
it's got things that look just like a LinkedIn message,
but it's not.
If I click on any of these links,
it's not going to take me to LinkedIn.
Instead it's going to take me to a phishing website.
And as you see, as I hover over it, notice what the link is,
it's not linkedin.com, it's websitefun.club.
If I go over here to the profile one, same thing.
It brings me to another area of that website.
Changing the frequency, same thing.
This is a classic phishing scam
where it looks like one thing,
but when you click on it, it goes to another.
Notice, this email is well crafted.
It's crafted to look exactly like LinkedIn,
and it will trick a lot of your users.
So one of the things we want to do
with our phishing campaigns is to train our users
that clicking links is bad.
Instead, if I got this as a user, what should I do?
I should open up a new web browser
and I should go to linkedin.com, the site I know.
And from there I can accept or reject that friend request.
But just getting an email,
you don't want to click on those links
because that is an easy way to get yourself into trouble
because it can download malware
or it might just collect information from you.
Like you click on it, it says, we need your username
and password to log into LinkedIn.
And they have a website sitting there
that looks just like LinkedIn.