Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snapchat Employee Data Leaks Out Following Phishing Attack

techcrunch.com

Post reply on HN
Print view View original

11–20 of 62 posts

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#11

Post by hayksaakian »

dewitt wrote: post #3

Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us. Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address? I bet I wouldn't, and I'm…

isn't this what DKIM and SPF and all those fancy email security things are for?

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#12

Post by duaneb »

mfoy_ wrote: post #5
escobar wrote: post #4

So this looks like HR or someone from inside snapchat got a phishing email and happily obliged and sent off a bunch of sensitive information without confirming that it should all be shipped over (unsecure) email. I do work for some higher ed institutions, and almost every year without fail we have seen (and dealt with) successful phish attempts of various staff members... it's usually something small like a credit ca…

Social engineering attacks will probably be a thorn in security's side for a very long time, if not indefinitely... There's a sort of fundamental disconnect inherent in "Trust the system! It's secure! Except be careful because sometimes something that is not the system will pretend to be the system..."

I'd even argue that social engineering has been the primary security problem since the birth of the internet.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#14

Post by duskwuff »

niij wrote: post #9
dvt wrote: post #2

If the compromised data somehow becomes public, a class-action suit (a la Sony) is not out of the question. At least Snapchat is trying to get ahead of the problem which undoubtedly helps them in the court of public opinion.

The Sony case affected customers, apparently this breach only affects employees. I find it hard to believe the employees would file a class action lawsuit against their own employer.

It's not unheard of for employees to file a class-action suit against their employer, but that typically only occurs in very large companies where there's a significant "divide" between the aggrieved employees and management. That seems rather unlikely in a company as small as Snapchat.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#15

Post by wickawic »

viraptor wrote: post #10
dewitt wrote: post #3

Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us. Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address? I bet I wouldn't, and I'm…

But unless you actually break into someone's account, email spoofing should be a solved problem. Sure, you can set the from field to whatever you want, but in a typical company scenario, it will look very different in outlook - it will actually display the sender's email, and if you try to spoof that, you'll just get rejected at the server. Now if you ignore that and respond anyway... well, there's not much anyone ca…

Serious question: what would it look like on a smartphone email client?

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#16

Post by employeeee »

viraptor wrote: post #10
dewitt wrote: post #3

Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us. Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address? I bet I wouldn't, and I'm…

But unless you actually break into someone's account, email spoofing should be a solved problem. Sure, you can set the from field to whatever you want, but in a typical company scenario, it will look very different in outlook - it will actually display the sender's email, and if you try to spoof that, you'll just get rejected at the server. Now if you ignore that and respond anyway... well, there's not much anyone ca…

We've been a target of this attack previously and it's not as simple as email spoofing as email addresses aren't (in Google Apps at least) displayed prominently, firstname.lastname@gmail.com with a corresponding name and profile picture is how we were targeted. Very easy to fall for (especially in companies that aren't strict about personal/professional email separation).

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#17

Post by djcapelis »

duaneb wrote: post #12
mfoy_ wrote: post #5

Earlier quoted context omitted.

Social engineering attacks will probably be a thorn in security's side for a very long time, if not indefinitely... There's a sort of fundamental disconnect inherent in "Trust the system! It's secure! Except be careful because sometimes something that is not the system will pretend to be the system..."

I'd even argue that social engineering has been the primary security problem since the birth of the internet.

Much before the Internet.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#18

Post by airza »

escobar wrote: post #4

So this looks like HR or someone from inside snapchat got a phishing email and happily obliged and sent off a bunch of sensitive information without confirming that it should all be shipped over (unsecure) email. I do work for some higher ed institutions, and almost every year without fail we have seen (and dealt with) successful phish attempts of various staff members... it's usually something small like a credit ca…

Honestly, given that you can send these kinds of emails out to like 100 people at a time, i'd be more surprised if it didn't work at least once.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#19

Post by jwcrux »

Sadly these spoofed emails from high ups are becoming all too common.

Shameless plug - if anyone is in need of an open source phishing training solution, I recently launched gophish to great feedback so far, and have a new version being dropped early next week: https://getgophish.com.

Everyone should have access to training to prevent this as much as possible.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#20

Post by forgetsusername »

nostromo wrote: post #7

Every company should inform their employees of the email impersonation scams going around. > In the scam, a criminal mimics a chief executive’s email account and directs an employee to wire money to an overseas bank account. By the time the company realises it has been duped, the money is gone. > [This scam] has cost businesses around the globe more than $2bn in little over two years, according to the US Federal Bure…

I'd go a step further and say it's a failing of management and process at said company if any employee felt that the CEO emailing for payroll information was "normal".
Post reply on HN