Hacker, Hack Thyself

Post by kqr » Fri, Jun 02, 2017, 1:35 PM UTC

mike-cardwell wrote: post #10

g_sch wrote: post #7

I saw a very interesting talk last year from someone who, as part of a company's security team, had set up a system that continually attacked the hashes of every employee's Active Directory passwords. If one was cracked, the employee would receive an automated email with a note containing the last few characters of their password and a suggestion to change it. I recall they also spoke on some security aspects of the…

I used to work at a University in the UK. One of my responsibilities was the email system. We constantly suffered targeted phishing attacks where the sender pretended to be from the IT department and required the recipient to respond with their password, for various made up reasons. Our spam filters captured most of these on the way in, but some still got through. And people replied. People replied all the time. Stud…

Post by JoshTriplett » Fri, Jun 02, 2017, 1:55 PM UTC

peterwwillis wrote: post #14

g_sch wrote: post #7

I saw a very interesting talk last year from someone who, as part of a company's security team, had set up a system that continually attacked the hashes of every employee's Active Directory passwords. If one was cracked, the employee would receive an automated email with a note containing the last few characters of their password and a suggestion to change it. I recall they also spoke on some security aspects of the…

Where you use this is important, too. Accounts that can provide remote access or admin rights should be scrutinized heavily, whereas an office temp with an email address (and no access from the outside world) isn't much of a threat.

Post by toomuchtodo » Fri, Jun 02, 2017, 2:21 PM UTC

mike-cardwell wrote: post #10

g_sch wrote: post #7

I saw a very interesting talk last year from someone who, as part of a company's security team, had set up a system that continually attacked the hashes of every employee's Active Directory passwords. If one was cracked, the employee would receive an automated email with a note containing the last few characters of their password and a suggestion to change it. I recall they also spoke on some security aspects of the…

I used to work at a University in the UK. One of my responsibilities was the email system. We constantly suffered targeted phishing attacks where the sender pretended to be from the IT department and required the recipient to respond with their password, for various made up reasons. Our spam filters captured most of these on the way in, but some still got through. And people replied. People replied all the time. Stud…

Post by swsieber » Fri, Jun 02, 2017, 2:36 PM UTC

dzdt wrote: post #16

What this shows is that even with best practices passwords are a fairly weak security control. We need a standardised second factor id. The FCC or corresponding body elsewhere should mandate that phone networks and phones support a secure messenging protocol which could guarantee that a message could be sent to a phone number and only be received by that device. Password-only authentication is like locks on luggage,…

Post by criddell » Fri, Jun 02, 2017, 2:57 PM UTC

dzdt wrote: post #16

What this shows is that even with best practices passwords are a fairly weak security control. We need a standardised second factor id. The FCC or corresponding body elsewhere should mandate that phone networks and phones support a secure messenging protocol which could guarantee that a message could be sent to a phone number and only be received by that device. Password-only authentication is like locks on luggage,…