What We Missed: Knicks Phishing Test Goes Out of Bounds

In this video conversation, Dark Reading editors discuss some of the news they didn’t get a chance to cover, from an ill-conceived phishing simulation to a hacktivist attack on a US government agency.

Phishing tests can be an important part of cybersecurity awareness training. But as the NBA champion New York Knicks recently showed, they can also go awry.

According to a recent report in The Athletic, Madison Square Garden (MSG) Sports, which owns the Knicks, deployed a poorly timed and ill-conceived phishing simulation ahead of its banner-raising ceremony on Oct. 20. MSG Sports sent out emails to employees with offers of free championship rings commemorating the team’s historic NBA Finals victory in June.

Team employees often receive championship rings at the start of the following season. However, the emails in this case were part of a phishing simulation, and when employees clicked on the links to select their rings, they were informed they failed the test and had to attend mandatory cybersecurity training. And they didn’t get the rings, either.

Dark Reading senior writer Alex Culafi and senior news director Rob Wright discuss the situation on this episode. Also on tap: a hacktivist group breached the Department of Homeland Security (DHS) and published personnel records for more than 40,000 employees, and it’s unclear how the agency was compromised; and a New York Times report claims a NVIDIA CEO Jensen Huang was targeted by a Chinese intelligence asset.

For all of our Dark Reading news videos, please check out our YouTube channel and our curated video articles; and, sign up for the Dark Reading newsletter!

What We Missed With Rob Wright & Alex Culafi: Full Transcript

This transcript has been edited for clarity and length by Informa TechTarget’s internal AI assistant. For the full experience, please watch the video.

Dark Reading’s Rob Wright: Hi, I’m Rob Wright with Dark Reading.

Dark Reading’s Alex Culafi: And I’m Alex Culafi with Dark Reading.

DR’s Rob Wright: And this is “What We Missed.” This is a discussion about some of the news stories that we didn’t get a chance to cover in the pages, pods, and videos of Dark Reading. And Alex, first up, we’ve got a doozy.

DR’s Alex Culafi: Yeah.

DR’s Rob Wright: So this one was pretty interesting, and in the spirit of Cybersecurity Awareness Month, I think it’s extremely relevant. The story came out from The Athletic about a week and a half ago, two weeks now almost, that the NBA champion New York Knicks — credit to them, I’m a Celtics fan, I hate the Knicks but, you know, good for them, they won the championship last year — that employees from the team apparently got a phishing test email saying your employee championship ring is here and that they could choose, you know, from different types of championship rings no cost to the employees, and when the employees clicked on the link they were informed that they had failed a phishing test and that they would have to attend a mandatory cybersecurity class.

I just want to point out, before we discuss this, that the employees traditionally do get championship rings. And this story is made worse by the fact that apparently the owner, James Dolan, did not give out rings to a lot of employees. So that makes it extra worse. But Alex, what’d you think of this story?

DR’s Alex Culafi: From just your description alone, I have two opinions. The first is, phishing tests should be appealing to click on, right? That’s one thing.

DR’s Rob Wright: Yes, right.

DR’s Alex Culafi: My other opinion is it shouldn’t lean on the desperation of your employees or the economic or rewarding of your employees —

DR’s Rob Wright: Yep.

DR’s Alex Culafi: — at such a basic level, cause that comes across as cruel. What do you think?

DR’s Rob Wright: Yeah, well an MSG, Madison Square Garden, spokesperson said this was “an unfortunate mistake,” quote unquote. And I think that sums it up, because I get it. You do want relevant phishing tests. You want to basically anticipate what threat actors are going to do. And if any knowledgeable threat actor was hoping to phish MSG, New York Knicks, the entire organization, phishing email about a championship ring on ring day or banner day at the start of the season, that’s not a bad way to do it. I think what is bad here is that, number one, a lot of employees apparently were not getting rings.

And number two, it just seems like that, seems to your point, kind of cruel that they would do that around a time when they’re fully expecting to get something. And I just think this really went awry for them. And it’s a bad look for a team that should be celebrating something, that should be, you know, raising the banner and getting their rings. It was a fun day, and they kind of ruined it. They really stepped in it on this one. So don’t do this kind of thing for cybersecurity war this month in the future, I would say.

DR’s Alex Culafi: Right, don’t do a security test that highlights the idea that you might not be taking good care of your employees as well as you should.

DR’s Rob Wright: Yeah, that they’re not getting rings. Sad. All right. What else we got this week?

DR’s Alex Culafi: Yeah, another weird story. I think we have three weird stories this week.

DR’s Rob Wright: Yes we do.

DR’s Alex Culafi: There’s this DHS reported “Icepick” leak. This this started on October 28. A transparency group called Distributed Denial of Secrets, DDoSecrets. They published a data set called Icepick after receiving it from a hacktivist group calling itself the Department of Peace.

It contains records for roughly 41,000 DHS employees and contractors across agencies, including ICE [Immigration and Customs Enforcement], CBP [US Customs and Border Protection], USCIS [United States Citizenship and Immigration Services]. Both of those are our border protection and immigration sort of services enforcement, and CISA, which is sort of an interesting one to get swept up in this, but I guess they are sort of tied into the DHS banner.

The attackers claim the data came from a DHS Okta-based identity system, which Okta currently denies or kind of denies; they said Okta is secure and we have no evidence our data or systems were compromised. What is also interesting is that rather than denying that a breach occurred, the DHS said that it’s looking into and doing incident response for what it calls a potential breach, which is — it’s a little short of a full confirmation. But those who reviewed the data say that it seems to be legit, it includes employee names, work emails, work phone numbers, and office locations allegedly, including reporting structure, managers, and more than 55,000 internal permissions groups, references to investigative surveillance, intelligence, AI, and undercover operations programs. What do you think of this? I have thoughts, but I’m curious what yours are.

DR’s Rob Wright: I know I may be setting the bar a little high. I would think that this would be confirmed yes or no pretty soon after a breach of this magnitude with the sensitivity of the employee records and information out there and not only like this is a little different for me because it’s not just that the data was stolen, data’s been obtained. The data’s out there, and a threat actor could just go and grab this information from DDoSecrets and you know, setting aside the politics of the activist goals aside, I mean, this isn’t good for DHS. I think that’s putting it lightly.

DR’s Alex Culafi: Yeah. It’s embarrassing.

DR’s Rob Wright: And if there was some way that’s repeatable to get that information, to get in, whether it’s Okta or something else, you would think that DHS would want that confirmed, addressed, and to be able to say immediately or as soon as possible that this has been resolved. You know, that “We have figured out how they got in, they can’t get back in, we’re dealing with the situation, we’re mitigating the threat.” And that doesn’t seem like it’s happened, which is a little concerning.

DR’s Alex Culafi: Yeah. I think it’s interesting. I don’t know the origin of Department of Peace. It could always be a Russian actor trying to throw a wrench in things.

DR’s Rob Wright: Sure. Yeah.

DR’s Alex Culafi: But assuming or presuming that this entity is US based, I think it’s very unusual to see hacktivism at this scale by or against a US entity. I think that’s unusual. And I think as the barrier for threat actor, hacker entry gets lower and lower through LLMs, through kits, through all these well documented practices of how to how to break into to cloud infrastructure and whatnot. I wonder if we’re going to see more of this.

DR’s Rob Wright: Could be.

DR’s Alex Culafi: From a security journalist standpoint, that’s the part that stands out to me is why didn’t this happen sooner and could this be the start of a lot more? Especially in a US government with a lot of its cybersecurity aspects seemingly still gutted, you know?

DR’s Rob Wright: Right. Yeah, good point. All right. Last up, real interesting story. I’m just gonna read the headline because I want to make sure I get this right. So the New York Times had a pretty big report that came out recently. The headline is “NVIDIA Chief Seen as Target of Chinese Spy Plot.”

I’ll try to run through this quickly, but apparently a CEO, an executive, high-ranking executive for a Chinese company had quote unquote “a close relationship” with Jensen Huang, CEO of NVIDIA. NVIDIA, obviously huge right now, huge part of the AI industry, AI growth in the United States. And this story, this Times exclusive, basically charts how the US government found out that this executive, Alice Huang, no relation to Jensen Huang, but that this person was a Chinese asset. This woman was allegedly working for the Chinese government and cozied up to NVIDIA’s CEO to presumably figure out what the US policy was going to be about NVIDIA chip sales to companies and countries abroad, to China, whether there was going to be a block on that, also get intelligence about AI policy in general. Pretty interesting, Alex, pretty interesting. And apparently Jensen Huang did not know this was happening at the time, that she was being surveilled. So it’s a very thorny story. I have a lot of thoughts on this, but Alex, what did you think?

DR’s Alex Culafi: This AI stuff is crazy.

DR’s Rob Wright: Ha!

DR’s Alex Culafi: This spy stuff is crazy. We I just covered, I don’t know, a couple weeks ago that story about the OpenAI engineer, former, who was arrested after, you know, planting secret recording devices at HQ, possibly at the behest of Saudi royalty. These reports about OpenAI teaching employees not to be seduced, like humanly seduced in order to give up trade secrets.

DR’s Rob Wright: Yeah.

DR’s Alex Culafi: This Jensen Huang business — I don’t know. What else is there to say other than this is nuts? Do you have something more technical and constructive?

DR’s Rob Wright: Well, yeah, to your point about Google or OpenAI or — this was OpenAI, right?

DR’s Alex Culafi: This was OpenAI, the Saudi stuff.

DR’s Rob Wright: So there’s that. There’s physical security concerns here with infiltration of foreign agents, foreign assets trying to get in, steal trade secrets, steal intelligence, steal policy, developing policy moves and get ahead of them, etc.

I think the thing that’s interesting here is that I know NVIDIA came out and said, this is normal. Like, he meets with a lot of CEOs and stuff like that. And there’s nothing salacious in this story. It doesn’t say that they had a romantic relationship or like intimate relationship of any kind. It just says close relationship.

But to me, if I were them — if I were NVIDIA, and if I were the US government — I would try to come out with a little bit more information about this to qualify, you know, what steps were taken to warn him, what steps were taken to, if any, to get ahead of this, to mitigate the threat, and to move away from this person who’s been identified as a Chinese asset. And there really isn’t a lot of information in the story about what they did to address it. So I think that’s a little concerning, like they maybe are not totally up for the challenge here of dealing with foreign tradecraft, spy craft here. And they should, because they should know that they’re a target, to your point. OpenAI, Anthropic, Google, like everyone is a target now for in the AI industry for this stuff. This is an arms race. Plain and simple.

DR’s Alex Culafi: Yeah, and social engineering remains robust, well-fortified, integral, vital to the hacker ecosystem. No matter what technologies get introduced, the only thing it seems to do is make social engineering more powerful. Maybe that’s kind of a running trend, at least with the first and third stories we talk about this week.

DR’s Rob Wright: Yeah, for real. Yeah. Interesting week of stories. But that’s it for this episode of “What We Missed.” Thanks, Alex. I appreciate the time.

DR’s Alex Culafi: Thanks, Rob.