Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers ship their exploits directly to their target’s mailroom

techcrunch.com

Post reply on HN
Print view View original

151–160 of 172 posts

Re: Hackers ship their exploits directly to their target’s mailroom

#151

Post by 2sk21 »

ChuckMcM wrote: post #117

One of my favorite security stories came from a well known security researcher who was asked to try to penetrate the computer system of a national research lab. On the day of the test he came in and logged in using his own credential and had full system access. Leaving everyone in the room stunned. The system was made by DEC and DEC had the process of sending software updates by magnetic tape. This researcher had mad…

Interesting - I too heard this story from Paul Karger (a noted security expert, sadly deceased). Paul's office was next to mine at IBM research and by talking to him, I realized I lacked the necessary level of paranoia to ever become a security expert :-)

Re: Hackers ship their exploits directly to their target’s mailroom

#153

Post by croh »

rhcom2 wrote: post #142
gvb wrote: post #30

Earlier quoted context omitted.

Agreed: this is an IBM "offensive operations unit" publicity piece. Key items from TFA: * TFA quotes Charles Henderson, " who heads up the IBM offensive operations unit. " * "This newly named technique — dubbed “warshipping” — is not a new concept." * "All of this could be done covertly without anyone noticing — so long as nobody opens the parcel. " A much more practical implementation of this attack vector is the "M…

That hackaday article has a great comment at the bottom > One time I had a colony of ants build up inside an APC UPS. Every day, the system would make a little popping sound, then switch to battery inversion for about two seconds, then switch back to mains. For the longest time I was baffled. > Then one day I noticed some ants making a trail and investigated. It was crazy how many ants were living inside it. Apparent…

Haha

Re: Hackers ship their exploits directly to their target’s mailroom

#154

Post by julian_t »

hinkley wrote: post #99
fortran77 wrote: post #25

Find someone who's out on leave for a while (just look for who's having a baby on IG) and ship the package to him/her! They won't discover it for weeks and you'll have plenty of time for your package to sit in the mailroom or on someone's desk. The danger is when the package is opened, the company may realize they've been hacked. Or have it there permanently: Ship an executive a fancy illuminated globe or desk clock…

One of the first pen testers I ever read pointed out that companies do (sometimes excessive) background checks on their staff all the time and then they outsource the cleaning crew. When I'm there during the day, there's only so much I could do without other people noticing. But here's a group with full access to an empty building full of your equipment for 10 hours a day. People are going to come at you from your bl…

A small company I once worked for employed a new firm of cleaners. Very good and conscientious for several months, right up to the night they loaded all the computer gear they could find on the premises into their van and disappeared. (After, of course, doing the cleaning and making sure they locked up afterwards)

Re: Hackers ship their exploits directly to their target’s mailroom

#155

Post by philpem »

swish_bob wrote: post #150
hinkley wrote: post #99

Earlier quoted context omitted.

One of the first pen testers I ever read pointed out that companies do (sometimes excessive) background checks on their staff all the time and then they outsource the cleaning crew. When I'm there during the day, there's only so much I could do without other people noticing. But here's a group with full access to an empty building full of your equipment for 10 hours a day. People are going to come at you from your bl…

I left my iPod on the desk overnight once while working at a large international investment bank. It vanished, presumably lifted by the cleaners. Security were remarkably uninterested in this, refused to do anything whatsoever (including checking the CCTV) although they did ask me to give them the crime number if I reported it.

That's easy enough to explain...

First off, lying to office security carries fewer repercussions than lying to the police to get a crime number. The office security guys won't want to be party to someone else's vendetta (would you?)

Secondly - if you care enough to waste hours of your time filing a police report, then you must give a damn about your shiny-thing. If not... well you clearly don't care enough and it's not a problem, so goodbye.

Read that how you will...

Re: Hackers ship their exploits directly to their target’s mailroom

#156

Post by Retr0spectrum »

jki275 wrote: post #50
Retr0spectrum wrote: post #21

Earlier quoted context omitted.

No, any hash will be crackable, it just depends on how fast. A well designed authentication protocol shouldn't expose any hashes to be cracked in the first place.

Sure -- if you define the heat death of the universe as "how fast".

You can't guarantee that, and keep reasonable performance, if humans are generating the PSK

Re: Hackers ship their exploits directly to their target’s mailroom

#157

Post by dwild »

hnick wrote: post #129
dwild wrote: post #118

Earlier quoted context omitted.

I'm always amaze at how many computer screens/keyboards are visible from windows. It would be so easy to plant a webcam with some good optics on an opposite building and just get the passwords of the victim quite easily. you could have easily a few dozens of victims on a single company with a single camera.

I notice these things too, but at the end of the day the sad news is nothing so exotic is necessary. There are far easier ways to get what you need from a modern office with typical security hygiene.

> There are far easier ways to get what you need from a modern office with typical security hygiene.

Far easier than looking through a window? I'm curious to know! I've seen banks where it would be possible! I expect most of their software to be internal and accessed through a VPN when outside but still.

Re: Hackers ship their exploits directly to their target’s mailroom

#158

Post by [deleted] »

gabrielblack wrote: post #45

Why an attacker should spend 100$ , sending hardware to the target that could be potentially tracked following the path between the resellers, could transport evidences like fingerprints or DNA, using a telephone connection that could also be tracked when the same thing could be done with a good radio equipment and more discretion ? Anyway, I am the kind of guy that inspects the ATM praying to find out a skimmer to d…

[deleted]

Re: Hackers ship their exploits directly to their target’s mailroom

#159

Post by jandrese »

hanniabu wrote: post #146
comboy wrote: post #103

Earlier quoted context omitted.

I very much doubt you could discover anything with X-rays. You can place whole device inside a screw or the circuit can be very thin with little to no metal etc. I would assume it's becoming a a software war. You monitor all frequencies with SDR and try to shield as much as possible while on the offending side you try to push information on different frequencies and making it look a like like stuff that's already in…

So sounds like you'd also want a room that can give off emp pulses to fry electronics that you can't see as a failsafe

Also discourages workers from bringing their phones into the office. Or their pacemakers.

Re: Hackers ship their exploits directly to their target’s mailroom

#160

Post by jandrese »

arcboii92 wrote: post #115
zcrackerz wrote: post #113

Earlier quoted context omitted.

I once stayed late and noticed a cleaner was wearing a polo from the company I used to work for. I asked him about it and it turned out he was an engineer and was filling in for his girlfriend who owned the cleaning business. Holy red flag! I made some noise and that cleaning company was let go.

Pro-tip for anyone that finds themselves in this situation when trying to steal another company's data - say you bought the shirt for 50c at a second hand store. That, or don't wear your company polo on an espionage mission.

Or just wear a boring flat grey shirt like all of the rest of the cleaning staff.
Post reply on HN