Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Namecheap live chat social engineering leads to loss of 2 VPS

postphp.com

Post reply on HN
Print view View original

131–140 of 426 posts

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#131

Post by beeboop »

matthewdrussell wrote: post #102
kelukelugames wrote: post #65

Earlier quoted context omitted.

I love namecheap but 5 sounds like victim blaming. Come on. EDIT: My use of the term is a bit strong. I feel frustrated that company execs cannot explicitly admit a mistake or apologize. I should have worded it differently. EDIT2: just for Tamar. By explicit I mean literally using the words "sorry", "apologize", or "mistake". What we have is the standard corporate nonapology. EDIT3: congrats to Tamar for being promot…

Everyone should practice a good backup routine and take responsibility for backups.

I am not sure why you would respond to an accusation about victim blaming by reiterating the exact thing that caused the accusation. You might want to reconsider continuing this particular aspect of discussion for PR reasons. It's not an argument you're going to win.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#132

Post by toomuchtodo »

arviewer wrote: post #76
r1ch wrote: post #50

I had my 2FA at Singlehop bypassed by social engineering attack. They helpfully changed the entire account contact info without any notice to me, presumably from a phone call. The attacker didn't even have any information to go off other than the IP address. I only found out when I saw the server rebooting into rescue mode and luckily I still had an active management portal cookie (changing the password doesn't log y…

We have had this at Amazon AWS. We had 2FA, one phone call was enough to disable 2FA. The only thing they asked were the last four digits of our credit card.

Too bad you can't ask for the CVV code, and run a dummy $1 transaction. Anyone could have the last four of the card number, but the person is much more likely to have the card itself with the CVV.

Disclaimer: I use AWS extensively. Please do this.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#134

Post by detaro »

koolba wrote: post #18

What's this crowd think of this idea for solving this problem? 1) Offer an option to opt-out of all automated account recovery. If set, no more email resets, support PINs, or similar. This would be targeted at people truly care about security and have no issue with "forgetting passwords" (i.e. you use a password manager and you're not an idiot about backups). 2) Offer in-person, manual recovery. To participate in thi…

weaker form of #2 would be a "send a registered letter" reset mode, in various forms (e.g. here in Germany there is a type of letter where you have to go to the post office and show matching ID to send it). Or require a (possibly named) notary to validate the request, or something along those lines.

If you announce sending the reset letter there is also time for the account owner to prevent the reset unless an attacker manages to isolate them from all notification channels.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#135

Post by coalescence »

matthewdrussell wrote: post #21

Disclaimer: I'm CIO @ Namecheap 1. The credentials were resent to an already compromised email account 2. This is an isolated case 3. Established procedure was not followed 4. With thissaid, we've used this as a learning example and additional training has been provided to the individual involved 5. Anyone with any self-managed server with ANY provider should always keep their own multiple backups

With #3 - ideally your systems should not allow you to break established procedure. Mitigate the risk by not giving the support staff tools to shoot yourself in the foot so easily. This could be achieved with peer verification or some other mechanism (lots of ways if you think it through).

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#136

Post by infinite8s »

stephenr wrote: post #87
ToastyMallows wrote: post #10

Earlier quoted context omitted.

It depends on how its implemented. If it's "Whats your mother's maiden name?" and they let you reset it in the browser, it's a bug. But if they send you an email (in my case to Gmail, that has 2FA turned on), then it is a feature, because then you'd be required to either 1) intercept the recovery email (and get the password reset URL) or 2) know the format of the password reset URL and just happen to guess mine after…

I had an interesting thought (literally as I was reading your comment) about improving "forgot password" emails, albeit only likely useful for the technically minded: Have the customer provide an SSH/GPG public key, and store it with the account. When a password reset is requested, encrypt a random string using said public key, and email it to the email for the account. An attacker who may have breached your webmail…

That's basically what TOTP/HOTP authentication tokens are, which many sites (including Google, AWS, Github) etc use for 2FA - https://en.wikipedia.org/wiki/Google_Authenticator. When you set it up, the service provider creates an 80 bit secret key, which you enter into your local device (or some implementations create a QR code) and then whenever you log in you need to provide a 1-time password from the app.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#137

Post by mindcrime »

beeboop wrote: post #131
matthewdrussell wrote: post #102

Earlier quoted context omitted.

Everyone should practice a good backup routine and take responsibility for backups.

I am not sure why you would respond to an accusation about victim blaming by reiterating the exact thing that caused the accusation. You might want to reconsider continuing this particular aspect of discussion for PR reasons. It's not an argument you're going to win.

It's not an argument you're going to win.

Unless you sign up for a managed service that claims to include backups or whatever, you are responsible for your own backups. What's controversial about that?

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#138

Post by ashitlerferad »

oaktowner wrote: post #123
rev_null wrote: post #91

Earlier quoted context omitted.

I once tried to log into a site only to discover that the security question I left for myself was "What is blue?". I never figured it out.

AT&T has a security code which is "What is your favorite restaurant?" that we set a decade ago when signing up for internet service. My wife and I have made, I don't know, 10 guesses over the years and have never been able to figure out what our response was back then. Questions with fact-based answers are much better. But...I once had a site ask me for my best man's first name (Good! This probably won't change over…

Security questions should be treated as secondary password fields, since they are that. Use Diceware for a good tradeoff between entropy and memorability/pronounceability or more complex random passwords and store them in a safe place.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#139

Post by extrapickles »

jqueryin wrote: post #101

As someone in the domain registrar industry, are there any features beyond 2FA that you would like to see implemented by registrars? More bluntly, what is it that you think your current registrar is lacking? I read a few comments on Gandi and support of GPG keys. I'm guessing this is what you're referring to: https://wiki.gandi.net/en/gandi/documents

I would like to see something where a postcard is mailed and a phone call, each with half of the code needed for a reset. Postcard should not be sent using a method that supports forwarding so an attacker cannot setup a mail forward.

Customer support should not be able to see anything about these accounts except for a reset button. I do expect to be charge a fee for a reset if I need to use it. This would need to be rate limited to prevent people from dosing an account through it.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#140

Post by Someone1234 »

pfarnsworth wrote: post #130

Social engineering in tech has been around since before Kevin Mitnick publicized it and went to jail (unjustly). Why do we keep making the same mistakes over and over again as an industry? We NEED UNIFORM security standards with ALL trusted companies with customer support, where we have tiers of support, and 1st tier doesn't have any access that could compromised security. Similar to ISO standards. This means there c…

> Kevin Mitnick publicized it and went to jail (unjustly)

You're joking right? He even fully admits that he did what they accused him of doing.

Post reply on HN