Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snapchat Employee Data Leaks Out Following Phishing Attack

techcrunch.com

Post reply on HN
Print view View original

21–30 of 62 posts

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#21

Post by viraptor »

wickawic wrote: post #15
viraptor wrote: post #10

Earlier quoted context omitted.

But unless you actually break into someone's account, email spoofing should be a solved problem. Sure, you can set the from field to whatever you want, but in a typical company scenario, it will look very different in outlook - it will actually display the sender's email, and if you try to spoof that, you'll just get rejected at the server. Now if you ignore that and respond anyway... well, there's not much anyone ca…

Serious question: what would it look like on a smartphone email client?

No idea. Work email doesn't go anywhere close my smartphone.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#22

Post by dvt »

niij wrote: post #9
dvt wrote: post #2

If the compromised data somehow becomes public, a class-action suit (a la Sony) is not out of the question. At least Snapchat is trying to get ahead of the problem which undoubtedly helps them in the court of public opinion.

The Sony case affected customers, apparently this breach only affects employees. I find it hard to believe the employees would file a class action lawsuit against their own employer.

This is incorrect, the Sony case affected employees[1]: "the exposure revealed personal information for an estimated 3,000 former and current Sony employees."

[1] http://deadline.com/2015/09/sony-hacking-lawsuit-settlement-...

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#23

Post by tshtf »

hayksaakian wrote: post #11
dewitt wrote: post #3

Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us. Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address? I bet I wouldn't, and I'm…

isn't this what DKIM and SPF and all those fancy email security things are for?

An attacker-controlled domain, say snaapchat.com, can pass DKIM, SPF, and DMARC if configured appropriately.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#24

Post by paulddraper »

djcapelis wrote: post #17
duaneb wrote: post #12

Earlier quoted context omitted.

I'd even argue that social engineering has been the primary security problem since the birth of the internet.

Much before the Internet.

But how could you be social before the internet?

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#25

Post by paulddraper »

viraptor wrote: post #21
wickawic wrote: post #15

Earlier quoted context omitted.

Serious question: what would it look like on a smartphone email client?

No idea. Work email doesn't go anywhere close my smartphone.

How do you reply to emails at 11pm? ;)

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#26

Post by zodPod »

escobar wrote: post #4

So this looks like HR or someone from inside snapchat got a phishing email and happily obliged and sent off a bunch of sensitive information without confirming that it should all be shipped over (unsecure) email. I do work for some higher ed institutions, and almost every year without fail we have seen (and dealt with) successful phish attempts of various staff members... it's usually something small like a credit ca…

I have seen so many stores of this on reddit. People's HR departments sending sensitive information to random phishing emails. It seems a little ridiculous that we're still trusting these people with our data.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#30

Post by teddyh »

hayksaakian wrote: post #11
dewitt wrote: post #3

Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us. Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address? I bet I wouldn't, and I'm…

isn't this what DKIM and SPF and all those fancy email security things are for?

No, this is what OpenPGP signed mail is for.
Post reply on HN