Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snapchat Employee Data Leaks Out Following Phishing Attack

techcrunch.com

Post reply on HN
Print view View original

51–60 of 62 posts

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#51

Post by tomjen3 »

lazaroclapp wrote: post #39
mfoy_ wrote: post #5

Earlier quoted context omitted.

Social engineering attacks will probably be a thorn in security's side for a very long time, if not indefinitely... There's a sort of fundamental disconnect inherent in "Trust the system! It's secure! Except be careful because sometimes something that is not the system will pretend to be the system..."

We keep treating falling for phishing emails as a user error. But, perhaps, having our most "official" means of communicating online (email) be a protocol that has no identity verification, no authentication and no encryption, is actually a technical bug, not a human one. I mean, you would expect that we should at least be able to tell that if you get a x@snapchat.com email in your y@snapchat.com inbox, it actually c…

Adopt PGP signatures as a requirement on emails that include sensitive data. It should be easy enough to have an internal key server and a company key that counter signs all valid company keys. Require the key only be used for signing and kept on a usb stick.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#52

Post by rkeene2 »

tomjen3 wrote: post #51
lazaroclapp wrote: post #39

Earlier quoted context omitted.

We keep treating falling for phishing emails as a user error. But, perhaps, having our most "official" means of communicating online (email) be a protocol that has no identity verification, no authentication and no encryption, is actually a technical bug, not a human one. I mean, you would expect that we should at least be able to tell that if you get a x@snapchat.com email in your y@snapchat.com inbox, it actually c…

Adopt PGP signatures as a requirement on emails that include sensitive data. It should be easy enough to have an internal key server and a company key that counter signs all valid company keys. Require the key only be used for signing and kept on a usb stick.

S/MIME and X.509 is a lot more common than PGP signatures -- support for it is built in to most MUAs. Also, typically the keys are on smartcards rather than USB devices where the private key could be accessed.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#53

Post by tomjen3 »

jetsnoc wrote: post #49

I manage a small Security team where I work. We have a very good security awareness training program we've built out over the years. I'm biased, of course. I helped build it. We may never solve the human aspect of security entirely. However, we have one thing in particular that works well. The most effective part of our program is the internal phishing attempts. They aren't annually or quarterly but almost monthly an…

That's one way to do it. The problem, and that happened to me was writing lol phishing in a reply when it really was the person who sent the information request.

These days I just delete such emails sight unseen. Also I block external images or at least used to just because.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#54

Post by tomjen3 »

dewitt wrote: post #3

Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us. Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address? I bet I wouldn't, and I'm…

I would post it on slack. Figure I know who my manager is there and even if i didn't, at must it would end up somewhere in the company.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#55

Post by cyphar »

tomjen3 wrote: post #51
lazaroclapp wrote: post #39

Earlier quoted context omitted.

We keep treating falling for phishing emails as a user error. But, perhaps, having our most "official" means of communicating online (email) be a protocol that has no identity verification, no authentication and no encryption, is actually a technical bug, not a human one. I mean, you would expect that we should at least be able to tell that if you get a x@snapchat.com email in your y@snapchat.com inbox, it actually c…

Adopt PGP signatures as a requirement on emails that include sensitive data. It should be easy enough to have an internal key server and a company key that counter signs all valid company keys. Require the key only be used for signing and kept on a usb stick.

Or just buy everyone in your company a yubikey that is already set up and ready to go?

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#56

Post by jcrawfordor »

eli wrote: post #33
tshtf wrote: post #23

Earlier quoted context omitted.

An attacker-controlled domain, say snaapchat.com, can pass DKIM, SPF, and DMARC if configured appropriately.

Better solution is to append a warning to any message that originates outside the domain.

This is actually a really good idea in corporate environments, and I would encourage everyone to think about doing it. It is a simple thing to push a rule to Outlook that e.g. displays emails from outside the corporate domain with a red tinted background in the email list. This helps people to think twice. It also compliments an email classification system well, although unfortunately most classification systems I've seen with good MUA integration are very expensive.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#57

Post by jcrawfordor »

mercora wrote: post #50

I previously worked for a large Bank and they had authenticated email using Lotus Notes. While i would not recommend using that, it was nice to see them taking this serious. It was required to use it for every internal communication and actually made it seriously easy to use without knowing much about how it really works. Its much easier to teach people to access their emails using a particullar application then it i…

Microsoft Exchange allows for implementation of S/MIME encryption and signing that more or less "just works." There are some naggles (I've run into people before whose Outlook was S/MIME signing emails to external uses, and my Outlook would be upset about showing them since the external user's cert was signed by some internal CA I didn't trust - if I didn't know what was going on that have lead to a frustrating helpdesk call). But, overall, it's nearly transparent when everything is as it should be.

Unfortunately, outside of the world of these internal corporate email products the situation looks a lot worse. Reliably secure delivery of email to external users is a hard problem and most of the current solutions being used are really, really terrible.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#58

Post by darkr »

lazaroclapp wrote: post #39
mfoy_ wrote: post #5

Earlier quoted context omitted.

Social engineering attacks will probably be a thorn in security's side for a very long time, if not indefinitely... There's a sort of fundamental disconnect inherent in "Trust the system! It's secure! Except be careful because sometimes something that is not the system will pretend to be the system..."

We keep treating falling for phishing emails as a user error. But, perhaps, having our most "official" means of communicating online (email) be a protocol that has no identity verification, no authentication and no encryption, is actually a technical bug, not a human one. I mean, you would expect that we should at least be able to tell that if you get a x@snapchat.com email in your y@snapchat.com inbox, it actually c…

Non-envelope headers on emails are arbitrary. "From" (as opposed to Envelope-From) is one of these. Some mail clients looking at you, Outlook) just display the minimum amount of data including From, and make it non-obvious that this is not really where the mail was from. You only see this difference in address when you hit reply.

We had a phishing attack on an employee in accounting that was stopped in progress and just in time before a bank transfer took place. The emails in question passed SPF as they weren't actually from another user in our domain.

Re: Snapchat Employee Data Leaks Out Following Phishing Attack

#60

Post by cm2187 »

lazaroclapp wrote: post #39
mfoy_ wrote: post #5

Earlier quoted context omitted.

Social engineering attacks will probably be a thorn in security's side for a very long time, if not indefinitely... There's a sort of fundamental disconnect inherent in "Trust the system! It's secure! Except be careful because sometimes something that is not the system will pretend to be the system..."

We keep treating falling for phishing emails as a user error. But, perhaps, having our most "official" means of communicating online (email) be a protocol that has no identity verification, no authentication and no encryption, is actually a technical bug, not a human one. I mean, you would expect that we should at least be able to tell that if you get a x@snapchat.com email in your y@snapchat.com inbox, it actually c…

In fact in my experience 99% of users are unaware that anyone can post an email on behalf of someone else's email address, even users under 30.
Post reply on HN