<story><title>How I Hacked a Router</title><url>http://disconnected.io/2014/03/18/how-i-hacked-your-router/</url></story><parent_chain><item><author>siliconc0w</author><text>Everything is feasible except the faked linkedin email - it wouldn&amp;#x27;t pass SPF and so I&amp;#x27;m pretty sure gmail would junk it.</text></item></parent_chain><comment><author>vxNsr</author><text>He addresses this in the comments of the article[0]:&lt;p&gt;&amp;gt;Aaron says:&lt;p&gt;&amp;gt;April 5, 2014 at 3:52 pm&lt;p&gt;&amp;gt;So how’d you sucker Bill into clicking your exploit link? Since you hadn’t yet hijacked his DNS, I presume the link didn’t (couldn’t) actually point to linkedin.&amp;gt;com — shouldn’t his mail client have warned him? (Mine would.)&lt;p&gt;&amp;gt;&amp;gt;Reply&lt;p&gt;&amp;gt;&amp;gt;Phikshun says:&lt;p&gt;&amp;gt;&amp;gt;April 5, 2014 at 5:35 pm&lt;p&gt;&amp;gt;&amp;gt;See this video by Raphael Mudge[1]. He does a much better job of explaining it than I would. I also had another advantage — Bill and I worked for the same company at the &amp;gt;&amp;gt;time, so I could send the phish to myself to make sure it passed all the filters. This isn&amp;#x27;t so unrealistic though. An advanced adversary will scour RFPs, public records and &amp;gt;&amp;gt;job postings to learn what protection technologies a company has and attempt to duplicate their environment for testing.&lt;p&gt;[0]&lt;a href=&quot;http://disconnected.io/2014/03/18/how-i-hacked-your-router/comment-page-1/#comment-4&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;disconnected.io&amp;#x2F;2014&amp;#x2F;03&amp;#x2F;18&amp;#x2F;how-i-hacked-your-router&amp;#x2F;c...&lt;/a&gt;
[1]&lt;a href=&quot;http://www.youtube.com/watch?v=OO_A8NHNBj8&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=OO_A8NHNBj8&lt;/a&gt;</text></comment>
<story><title>How I Hacked a Router</title><url>http://disconnected.io/2014/03/18/how-i-hacked-your-router/</url></story><parent_chain><item><author>siliconc0w</author><text>Everything is feasible except the faked linkedin email - it wouldn&amp;#x27;t pass SPF and so I&amp;#x27;m pretty sure gmail would junk it.</text></item></parent_chain><comment><author>thaumaturgy</author><text>Well, I was all set to explain that SPF only checks the envelope sender, not the from: address header that is displayed to the user.&lt;p&gt;Then I decided to test it, and in fact Gmail does seem to be doing more than that. I ran a two-line script as root from my mail server to send a message with an envelope-sender from my domain (which has a basic SPF txt record in its DNS) and a from: header from LinkedIn, and Gmail spit it back at my return address a moment later saying that it smelled like spam. So, good for Gmail!&lt;p&gt;But, I don&amp;#x27;t think this is common behavior, and the article doesn&amp;#x27;t actually say that the target has a Gmail account.</text></comment>