Phish5 sample campaign report

Your Company - Linkedin 2014
Issued to: secadmin@yourcompany.com
Report date: 2014-04-16

Your Company - Linkedin 2014 2014-04-16
Table of Contents
Overview 3
Summary 3
Findings 4
User Activities 5
Over time 5
Activity bands 5
Activity following campaign launch 6
Browser data 7
Browsers, platform and plugins distributions 7
Vulnerable browsers and plugins 9
Comparing vulnerable and safe users 11
Appendices 13
User lists 13
Opened Mail Users 13
Remote Images Enabled Users 14
Clicked Link Users 14
Credentials Submitted Users 15
Vulnerable Users 16
Repeat Offenders 16
Per User Reports 18

3 of 32
Overview
This is an automatically generated report for the Phish5 campaign "Your Company - Linkedin
2014" using live data. The report begins with a summary of the campaign, then provides
descriptive graphs and statistics related to the campaign. In the appendices are listed full
records for all users affected by the campaign.
Summary
Name: Your Company - Linkedin 2014
Description: Your Company - Linkedin campaign
ID: 764
x
Report date: 2014-04-16 12:00
Campaign created: 2014-03-19 15:36
Campaign ends: 2014-03-28 13:15
Mailing started: 2014-03-19 15:59
Mailing ended: 2014-03-19 16:00
x
Options
Include in aggregate stats: Yes
Browser security: Yes
Notify mailbox: secadmin@yourcompany.com
Notify on: open post
x
State
Campaign state: Ended
Targets: 108
Mails sent: 108
Phishing website
URL: linkedin.com.server-a.net
Landing page: Yes
Auth page: Yes

4 of 32
Findings
39 users opened the mail (36.1%)
17 users had enabled remote loading in their clients (15.7%)
32 users browser the phishing page (29.6%)
13 users gave away credentials (12.0%)
2 users had been previously phished (1.9%)
1. The number of mails opened exceeds the Phish5 average across all customers by 6.1%.
This campaign's targets had a response of 36.1% and the average is 30.0%.
2. The number of phishing links clicked exceeds the Phish5 average across all customers by
8.6%. This campaign's targets had a response of 29.6% and the average is 21.0%.
3. The number of credentials posted is much higher than the Phish5 average, 6.0% more than
the average. This campaign's targets had a response of 12.0% and the average is 6.0%.
4. 17 users had remote images enabled, which lets phishers or other scammers detect when
emails have been opened. Consider disabling remote image loads across your
organisation's mail clients.
5. 32 users clicked on links and browsed the site. Merely browsing the site opens the user up
to potential drive-by attacks, and there were targets in this campaign that had vulnerable
browsers or plugins.
6. 13 users provided credentials. This is concerning since even a single set of credentials can
provide a foothold that is widened to further access.
7. 24 users were vulnerable to browser or plugins issues. This is concerning since even a
single compromised browser can provide a foothold that is widened to further access.
Vulnerable browsers and plugins should be subjected to mandatory automatic updates.
8. 2 users had been previously phished.
9. The first phished credentials were collected 8m after the campaign launch.

5 of 32
User Activities
Each campaign is centered on a target list of potential victims. Once the campaign is
launched, we record each activity by every victims.
Over time
This graph shows user activity over the lifespan of the campaign and helps determine what
happened at each point in time that the campaign was running. All activities are shown, even
repeated events. It is very typical to see a flurry of activity early in the campaign, and as time
goes on the counts' rate of increase slows.
User Activities
Activity bands
This table shows the time taken for a given percentage of users to have performed an activity
since the start of the campaign (the 'First' column shows the time to the very first recorded
instance of that activity.)
First 20% 40% 60% 80% 100%
Remotes 5m Never Never Never Never Never
Clicks 69s 43.5hr Never Never Never Never
Posts 8m Never Never Never Never Never

6 of 32
Activity following campaign launch
These two graphs shows three types of user actions recorded over the first 24 hours of the
campaign, and over the entire campaign. Only the first action per user is displayed, as
subsequent repeats by them don't significantly change their risk profile. Time 0 is when the
campaign was launched.
Activity in First 24 Hours Activity in Entire Campaign
This graph shows when users were active each day, and indicates those times that users
appear to be most susceptible to attacks.
Time of Day Activity (UTC)

7 of 32
Browser data
As users react to the phishing mails by opening the mails and visiting your phishing website,
we record information about their browsers.
Browsers, platform and plugins distributions
The graphs below show the breakdown of browser vendors and platforms amongst your
victims who visited the phishing site.
Browser Distribution
Platform Distribution

8 of 32
The graph below shows the total split of plugins amongst all users.
Plugin Distribution

9 of 32
Vulnerable browsers and plugins
Narrowing the data further, we come to vulnerable browsers and plugins.
The pie charts and tables below show how the population of users with vulnerable browsers and
plugins are made up.
Vulnerable Browser Distribution
Name Count Pct
Safari 7 58.3 %
Internet Explorer 4 33.3 %
Firefox 1 8.3 %
Total 12 100 %

10 of 32
Vulnerable Plugin Distribution
Name Count Pct
Silverlight 16 42.1 %
AdobeReader 8 21.1 %
Java 6 15.8 %
Flash 3 7.9 %
Shockwave 2 5.3 %
VLC 2 5.3 %
WindowsMediaPlayer 1 2.6 %
Total 38 100 %

11 of 32
Comparing vulnerable and safe users
The bar graphs below compare the vulnerable browser and plugin groups to their safe population
equivalents.
Browser Comparison Plugin Comparison

12 of 32
Conclusion
This is an autmated report generated by secadmin@yourcompany.com for the Phish5
campaign "Your Company - Linkedin 2014".
If you have questions, comments or suggestions please contact humans@phish5.com.

13 of 32
Appendices
User lists
Opened Mail Users
• user100@yourcompany.com

14 of 32
Remote Images Enabled Users
Clicked Link Users

15 of 32
Credentials Submitted Users

16 of 32
Vulnerable Users
Repeat Offenders

17 of 32

18 of 32
Per User Reports
user1@yourcompany.com
No records for user.
Actions:
• Remote Images: 1 (Last at 2014-03-19 15:41:59)
• Clicks: 2 (Last at 2014-03-22 15:22:52)
Client side technology:
• Safari 7.0.0.0 (Version detected is vulnerable.)
• Javascript (Javascript was enabled.)
Actions:
• Clicks: 1 (Last at 2014-03-19 15:41:47)
• Credentials: 1 (Last at 2014-03-19 15:41:56)
Actions:
• Clicks: 2 (Last at 2014-03-20 12:59:20)
Actions:

19 of 32
• Clicks: 2 (Last at 2014-03-19 15:53:23)
• Flash 12.0.0.77 (Version detected does not have known vulnerabilities.)
• Chrome 33.0.1750.154 (Version detected does not have known vulnerabilities.)
• AdobeReader 11.0.3 (Version detected is vulnerable.)
• VLC 2.0.6.0 (Version detected is vulnerable.)
• Silverlight 5.1.10411.0 (Version detected is vulnerable.)
• Java 1.7.0.25 (Version detected is vulnerable.)
Actions:
Actions:
• Clicks: 1 (Last at 2014-03-19 16:28:37)
• VBScript (VBScript was enabled.)
• ActiveX (ActiveX was enabled, without filtering.)
• WindowsMediaPlayer 12.0.7601.18150 (Version detected does not have known vulnerabilities.)
• AdobeReader 11.?.? (Could not determine whether the version was vulnerable.)
• IE 10.0.9200.16798 (Version detected does not have known vulnerabilities.)

20 of 32
Actions:
• Clicks: 1 (Last at 2014-03-20 14:33:06)
• AdobeReader 10.1.9 (Version detected does not have known vulnerabilities.)
• Java 1.7.0.51 (Version detected does not have known vulnerabilities.)
Actions:
• Clicks: 2 (Last at 2014-03-20 10:34:35)
• QuickTime 7.7.5 (Version detected does not have known vulnerabilities.)
• Silverlight 5.1.20913.0 (Version detected does not have known vulnerabilities.)
Actions:

21 of 32
Actions:
• Clicks: 3 (Last at 2014-03-21 09:24:26)
Actions:
• Clicks: 2 (Last at 2014-03-19 15:51:06)

22 of 32
Actions:
• Clicks: 4 (Last at 2014-03-20 16:09:20)
• VLC 2.1.3.0 (Version detected does not have known vulnerabilities.)
Actions:
• Clicks: 1 (Last at 2014-03-19 15:52:54)
Actions:

23 of 32
• Clicks: 2 (Last at 2014-03-21 11:26:01)
Actions:
• Clicks: 1 (Last at 2014-03-19 16:14:55)
Actions:
• Clicks: 1 (Last at 2014-03-19 15:44:02)
Actions:
Actions:

24 of 32
Actions:
• Clicks: 20 (Last at 2014-03-19 19:14:13)
• Shockwave 11.6.8.638 (Version detected is vulnerable.)
• Shockwave 11.6.8.638 (Version detected is vulnerable.)
• AdobeReader 11.0.6 (Version detected does not have known vulnerabilities.)
• IE 7.0.5730.13 (No safe or vulnerable version numbers matched)
• Flash 11.7.700.224 (Version detected is vulnerable.)
• WindowsMediaPlayer 11.0.5721.5280 (Version detected is vulnerable.)

25 of 32
Actions:
• Clicks: 1 (Last at 2014-03-19 15:46:14)
• IE 9.0.8112.16421 (Version detected is vulnerable.)
Actions:
• Clicks: 2 (Last at 2014-03-19 17:07:48)
• safari 534.30 (Version detected does not have known vulnerabilities.)
Actions:
• Clicks: 2 (Last at 2014-03-20 14:08:20)

26 of 32
• safari 534.30 (Version detected does not have known vulnerabilities.)
Actions:
Actions:
• Clicks: 2 (Last at 2014-03-21 11:30:27)
• Firefox 26.0 (Version detected is vulnerable.)
• PDFjs ? (PDFjs was enabled.)
Actions:
• Clicks: 13 (Last at 2014-03-20 19:55:59)

27 of 32
Actions:
• Clicks: 1 (Last at 2014-03-20 10:46:58)
Actions:
• Clicks: 1 (Last at 2014-03-19 15:45:25)
Actions:

28 of 32
Actions:
• Clicks: 2 (Last at 2014-03-19 20:09:36)

29 of 32
Actions:
Actions:
• Clicks: 2 (Last at 2014-03-20 12:19:29)
Actions:
• Clicks: 2 (Last at 2014-03-21 13:17:25)
Actions:

30 of 32
• Clicks: 7 (Last at 2014-03-20 06:20:23)
Actions:
• Clicks: 2 (Last at 2014-03-26 15:48:02)
Actions:
• Clicks: 7 (Last at 2014-03-20 13:54:11)
Actions:
• Clicks: 5 (Last at 2014-03-19 18:34:56)

31 of 32
Actions:
• Clicks: 1 (Last at 2014-03-19 15:51:12)
Actions:
• Clicks: 1 (Last at 2014-03-19 16:00:54)
• VLC 2.0.6.0 (Version detected is vulnerable.)

32 of 32
Actions:
• Clicks: 2 (Last at 2014-03-31 13:50:43)

Phish5 sample campaign report

Recommended

Recommended

More Related Content

Similar to Phish5 sample campaign report

Similar to Phish5 sample campaign report (20)

Recently uploaded

Recently uploaded (20)

Phish5 sample campaign report