The 11 Biggest Things LUCY Phishing Software prepared for 2017

After turning the page on 2016, we take the opportunity to highlight our most impressive new features and other accomplishments of the past 12 months. From awesome new functionality in our Phishing Software to a widely recognized industry report, these are our most beloved achievements. Here come the 11 biggest things what LUCY Phishing Software provides you for this year:

1.) Enhanced Phishing Software Attack Types – USB, CD, DVD

LUCY was mastering already all types of Phishing simulations: Hyperlink based scenarios or Phish with a attachement (with or without harmless trojans), SMiShing Simulations and USB-atttacks as well. But especially for USB attacks we made the handling much easier and we enhanced portable media attack scenarios for the usage with other media.  Now you can not only create Attack Simulations with USB sticks but also create your own ‘bad’ CDs or DVDs as an ISO-Image.

2.) The enhanced version of LUCYs Ransomware Simulation

Contrary to other announcements, it was LUCY who introduced the worlds first Ransomware simulator in January 2016. Since we started with the Ransomware simulator we made several improvements. Now you can run the ransomware simulation using dummy data so that you don’t need to touch real data. In our next post we will describe another invention: The Ransomware screenlocker feature is a more drastic, new educational method.

3.) Powerful recipient and address management

There were massive improvements in the recipient management. While we are still convinced that you should clean-up and prepare adress- or user-data before you load it into LUCY, we worked hard to make the recipient maintenance more convenient. You still can manually add recipients but now there is a possibility to add users on the fly and even adding remote adresses on thy fly by using the LDAP Interface. And that even to running campaigns! Additionally you can filter,  copy recipients or import them from an error log file.  And now it’s even possible that  – after running a phishing campaign – you can quickly identify users who failed the phishing simulation and re-use them for another campaign (e.g. awareness campaign).

4.) Massively improved Scenario Template Management

We were listening to our user base and we made some important changes for working with attack or awareness templates. We extended LUCY in the way that you can develop and maintain your own content. That means that you can store your own templates within LUCY or your IT-Security Awareness provider of choice can store the work he does for you in LUCY. That’s why you see now the version dates of all templates and you can copy,  backup, download or restore templates. The system helps you also to find and to manage duplicate templates.

5.) Multilinguality

Default Languages of LUCY Phishing Software (Dutch, Englisch, French, German, Italian, Portugese, Russian, Spanish, Turkish, Ukrainian)Do you want to run the same campaign in Arabic, Chinese and Greek ? It’s possible with LUCY! Any questions?  LUCY actually provides content (Phishing Templates, Awareness Templates) in Dutch, English, French, German, Italian, Portugese, Russian, Spanish, Turkish and Ukrainian.

6.) Harmless Trojan functionality – New Droppers

We included advanced dropper features: Java Applets or Word macros.  Why? Java applets are executed in a sandbox by most web browsers, preventing them from accessing local data like the clipboard or file system. If the code rquires those rights, the user has to allow it (manually by clicking “run”). The code of the applet is downloaded from a web server, after which the browser either embeds the applet into a web page or opens a new window showing the applet’s user interface.

About Java Exploits: Java exploits represent a common attack vector used by the bad guys to infiltrate vulnerable computers via the web browser. The default security level for Java applets and web start lucy-java-dropperapplications has been increased from “Medium” to “High”. This affects the conditions under which Java web applications can run. Previously, as long as you had the latest secure Java release installed applets and web start applications would continue to run as always. With the “High” setting the user is always warned before any unsigned application is run to prevent silent exploitation. This security enhancement eliminates the risk of silent exploitation using drive-by attacks via unsigned applets, which were possible before Java 7 update 11. This leaves attackers with no choice but to use social engineering techniques to convince users to click the Run button on the security warning dialog. Using this feature you can check if your users will allow such an action and if yes you can ‘inject’ a harmless  malware simulation. These features are mostly used by senior awareness trainers and senior campaign managers.

Word Macro Simulation: LUCY can create a phishing campaign that simulates an attack using a malicious Word document file with a macro. The custom Macro with the according campaign settings is compiled during the campaign. Therefore each Word file for each recipient will have different settings and is hard to detect by intrusion prevention systems.  In order not to compromize the client in the success case you have the possibility to select “Delete Temporary File” in the Macro options. Due to security reasons you can only use the built-in LUCY macros.

7.) Workflows for big organizations

The approval workflow is based on the 4-eyes principle when creating a new campaign. A campaign administrator will be responsible for creating a specific phishing or e-learning campaign. But he will only be able to start the campaign after a different user (the supervisor) reviewed the campaign and approved (or rejected) it.

8.) We made our Phishing Software more secure – LUCY Authentication

We integrated Brute Force Protection, Strong Authentication Option & Password Policy into LUCY.  The login screen now displays a captcha if this option is enabled and you can restrict the admin console to a predefined IP range and a custom port. It means also, that you have the possibility to identify a user, machine or device with the usage of a digital certificate. And it means that you have the possibility to enforce your password policy for the LUCY Phishing Software Server.

9.) Alarming: Users can spot and report phishing attacks and suspicious E-Mails

LUCY-Phish-Report-Button-OutlookThe Phishing Incident Plugin for Microsoft Outlook: It is a simple but powerful feature. A button within Microsoft Outlook allows you to send a suspicious mail to a given recipient for analysis and inspection. Get more details here Outlook Plugin for Phishing Incidents.

10.) Interoperability with 3rd Party Systems – LDAP

LUCY can now interact safely with other systems. Using the LDAP Interface you can integrate LUCY with other Systems. This allows you to import recipients of even to create LUCY users (administors) in the LUCY console.

11.) The big IT-SEC industry report: Top 150+ influencers in the cybersecurity market

Do you want to know who has something to say in the IT security environment? Our widely respected report on the 150+ Top Influencers in the Area has become the “Who is who” for IT-Sec.  It is not only a list, but it also shows the Twitter/Alexa Ranking and it covers:

  • 64 Bloggers
  • 36 Magazines / “Publications”
  • 29 Security Vendor Sites
  • 08 Sites of the SANS Institute
  • 06 Consultancy Firms
  • 04 Government Sites
  • 03 Microsoft Websites and
  • 01 Hybrid Site

Not having LUCY yet? Community Edition comes for free!