Well that's fine; my school did the same thing and other than feeling wasteful there was no-

> All normal ports were open - ssh, http(s), you name it. It was the OG zero trust architecture.

Oh. Yeah, open ports by default is... and interesting life choice.

Yes, but also it's an impressive digital Jedi mind trick on a website.

signs a question mark with hand

"This is the support number you're looking for."

And the victim is extra primed here because so many companies make it nearly impossible to talk to a human. Yikes!

Almost seems like there's room here for a grey hat to come in and use this trick to do a good faith job trying to help the customer through their problem. Then tell them at the end that a recent anti-trust suit requires them to tell the customer about alternate independent venues in their area where they can support live music.

Here's a real example from the same thing happening on FB (don't call that number) https://i.redd.it/w9htjqflgjle1.jpeg

If only the Ticketmaster team could show ads on that domain, all these ads would have to go through their marketing team (and use ticketmaster's budget, with all the accounting and invoicing this requires), which would massively slow things down.

Instead, it seems that Google has some kind of protection where ads mentioning Ticketmaster must link to their official domain, to prevent things like this from happening. The scammers just found a way for that domain to display arbitrary text.

After some people started publicly naming and shaming on LinkedIn and tagging ENISA, the issue got some exposure, but still was not fixed. It only made it more evident that several people independently reported these issues, and they became aware of peers stumbling over the issue. Still nothing happened.

ENISA is supposed to act as a CNA and expects to be notified of data breaches from EU based orgs for PSIRT / CSIRT as part of the Cybersec Resiliance Act and other laws.

Would I trust that vulnerability data that gets reported as a CVE, or a breach notification is safe with ENSIA ?

... feck no!

Would I trust that documents that europa.eu hosts on its infra are authentic? (such as security-compliance documents telling orgs how to properly implement security, but literally any public communication under one of the domains)

... hecking heck no!

... At this stage I think everyone else except ENISA has control over their infrastructure.

I don't know what the state of big corps netsec is today but these guys had it somewhat easy. They got initial access through weak wifi then pivoted with SQL injects and such.