Google uncovers major account-hijacking campaign targeting senior US officials

Post by mike-cardwell » Wed, Jun 01, 2011, 10:55 PM UTC

MatthewB wrote: post #20

Does it bother anyone that China continues to hack us? It is very possible that this was a government-backed attack, which wouldn't be the first against Google by the Chinese government. The biggest problem is that these don't seem to be sophisticated attacks. They didn't find a backdoor or install some malicious piece of code...they simply "hacked people" with phishing scams. I think a great place for the US govt (a…

Post by andrewcooke » Wed, Jun 01, 2011, 10:58 PM UTC

yanw wrote: post #13

motters wrote: post #6

Does this have anything to do with the backdoor API, or were the passwords just brute forced?

There are no 'backdoor' shenanigans, they comply with subpoenas like everyone else (they uniquely provide a transparency report) the Schneier claim was speculative and he dismissed it later. In this case it's phishing, read the post.

Post by MatthewB » Wed, Jun 01, 2011, 11:00 PM UTC

ansy wrote: post #30

MatthewB wrote: post #20

Does it bother anyone that China continues to hack us? It is very possible that this was a government-backed attack, which wouldn't be the first against Google by the Chinese government. The biggest problem is that these don't seem to be sophisticated attacks. They didn't find a backdoor or install some malicious piece of code...they simply "hacked people" with phishing scams. I think a great place for the US govt (a…

Yeah, it bothers someone: http://www.bbc.co.uk/news/world-us-canada-13614125 Just today it is widely reported the Pentagon is setting a new policy that cyber attacks can be considered acts of war which lets the Pentagon retaliate with conventional weapons. Hack my email, get an ICBM.

Post by pnathan » Wed, Jun 01, 2011, 11:09 PM UTC

windsurfer wrote: post #9

qjz wrote: post #5

Bad actors take advantage of the fact that most people aren’t that tech savvy—hijacking accounts by using malware and phishing scams that trick users into sharing their passwords, or by using passwords obtained by hacking other websites. Passwords are obsolete. No improvement in storing or transmitting passwords securely will make them easier to remember or less likely to be shared. The approach is fundamentally flaw…

Public key authentication isn't an acceptable alternative? You could have users unlock a keyring using a password containing a single, global public key for each machine they own. You could have them do the same with a thumbdrive or mobile phone. You could authenticate using a number of methods. It's really incrediably flexible. I think the problem is not that there isn't something to replace it, it's that people are…

Post by jonknee » Wed, Jun 01, 2011, 11:23 PM UTC

andrewcooke wrote: post #34

yanw wrote: post #13

Earlier quoted context omitted.

There are no 'backdoor' shenanigans, they comply with subpoenas like everyone else (they uniquely provide a transparency report) the Schneier claim was speculative and he dismissed it later. In this case it's phishing, read the post.

do you know where he dismissed it? the article at http://www.schneier.com/essay-306.html is still up, with no disclaimer or obvious link to a correction.