211–220 of 358 posts
Earlier quoted context omitted.
You type in http://yourbank.com , your bank respomds with a 301 to https, but this helpful router instead takes you to its phishing site. Lots of people wouldn't notice.
Or it redirects you to https:// yöurbank .com/, and you see the green padlock and think nothing more of it. Edit: made HN not mangle the link.
Here is the list of pinned domains [1] in Chrome: Chrome Pinsets https://cs.chromium.org/chromium/src/net/http/transport_secu... [1] https://www.chromium.org/sts https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
Earlier quoted context omitted.
How?
https://gmail.com.inbox-redirect.pro This will seem like a valid website, especially if the phishing site is done well. Not just non-technical users, I'd wager some tech familiar users would be fooled too. The focus always being on the lock icon might not always cover it. Safari will prevent this though.
Earlier quoted context omitted.
At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.
So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…
Sorry for mixing windows and Linux but conceptually something like this should work on windows if you don't require password in your UAC prompts.
Earlier quoted context omitted.
This is why, as much as I hate it most of the time, it's a good idea not to have your devs with access to your network setup. If your a small shop, limit the access as much as reasonably possible.
Emphasis on reasonable. If you limit workers' access too much for them to do their jobs they will find creative workarounds. Some of those can be more dangerous than just giving them the access that they need in a way that you control. Examples being if you make it so that the only way developers can debug a system is by adding in backdoors, or if you lock down the network so much that they need to use an unsecured p…
This.
Earlier quoted context omitted.
Trouble is that the same corporation has the following additional policies: * A ban on mail attachments of certain types (excel, zip files...) * mailbox limits from the 1990’s (100MB or so) * a ban on Dropbox, Gdrive or any other file sharing service * No public facing sftp or similar * A web site so mired in red tape that it takes 6 months and a dozen approvals to get anything uploaded. Often the USB drive or someth…
It seems the problem is bad corporate file sharing policies that are incorrectly validated as successful because the employees are using workarounds rather than pointing out its inadequacies.
This is overblown, isn't it? That thing can't do anything that a public wifi couldn't, and yet everyone connects their laptops to those without hassle. SSL is nearly everywhere now...
Earlier quoted context omitted.
I don't think I've ever heard of a company that actually does this in practice. I suspect it ends up simply being more trouble than it's actually worth. I know at that company the list of approved device would probably end up being dozens of pages long... and yeah, thumb drives and USB hard drives were used a decent amount, especially outside of IT.
Maybe someone needs to invent a USB-based thumb drive reader that only allows generic mass storage devices to be attached but does not work as a hub, rather as a proxy device. Bonus points: don't mount the drive directly, instead connect it to a centralised server on the corporate network that scans for threats and mounts a sanitised version of the drive's contents as a network share. Triple word score: audit everyth…