311–320 of 327 posts
Earlier quoted context omitted.
How is that false? Name a single example where SMS 2FA is worse than none. And just because it will always come up: 2FA, not treating the second factor as only factor.
> Name a single example where SMS 2FA is worse than none. SMS is terrible because it is so easy to lose account access. Phone broken/stolen? Completely locked out. Or, I have this one financial institution that insists on sending SMS 2FA to the phone number on file, which is a 20+ year old landline which obviously can't receive SMS. Completely locked out. Someday I'll have to find out some way to get my money out of…
I hate TOTP, can handle SMS 2FA (sim-swapping is super rare here) and love FIDO/U2F/Webauthn (or whatever it’s called today). I have one with NFC on my keychain, and a backup device in the drawer. No off-site backup key, but encrypted backup codes.
Earlier quoted context omitted.
the cute answer to all this is always: how do people think your service accesses the secret vault? its anlther credential. the real issues are tougher, like why does this one cred have access to all these other creds, and how or if they were auditing usage of that cred from authorized client devices.. but all of these problems take a lot of effort and care to solve. and as history has shown, you only have to mess up…
I agree but an api key for a PAM service will get you constrained access (ideally) to a specific resource instead of a kerberos ticket you can take with you as part of your ticket collection. It's supposed to be better but granting the resource permission like GCP does is probably better (but messier too).
ideally, there would be a warning for identities with access to too many secrets.
Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powe…
There’s a trend of storing MFAs in password managers like 1Password. If the password manager is compromised then what was the point in having MFA…
Unconfirmed method of breach: https://twitter.com/hacker_/status/1570582547415068672 - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) - Once on VPN, scan their intranet and find a network share - Network share has powershell scripts with admin credentials for their PAM vendor, Thycotic - From there can get full access to all systems
Former Uber employee. I'm not a fan of the company. But don't shit on the efforts of the security team please. They were actually quite thorough. We used online MFA (you had to respond to MFA requests on your phone). Not even sure why this is a discussion as the hacker confirmed it was a case of social engineering. No MFA protects against social engineering (no, not even ____ - don't try to convince me). And yes, at…
Don't you know that sh*tting on everyone else and saying that how you could do it with only 5 people are the traditions of HN...
Earlier quoted context omitted.
And as other people have already written, that's the main issue. Not that someone got compromised, but that passwords for admin accounts to all those services were stored on a network share.
I'm still confused. Why did people have username/password logins to the AWS console? Either require SSO login, or require HW tokens to get in as an AWS user. Then it doesn't matter if someone finds the password file, it's useless.
At this point it appears that they found more credentials on the internal network and owned SSO, MFA and AD giving admin access to everything.
Why are people talking about MFA on this thread. Look, as someone whose day job is responding to such incidents, someone targeting Uber and is persistent will get in, MFA or not. Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) and that's all it takes to steal cookies and tokens post-mfa, or why even bother with that, if you're running code just make it a reverse shell. The big screw up here is powe…
There’s a trend of storing MFAs in password managers like 1Password. If the password manager is compromised then what was the point in having MFA…
Then I was like "1Password will sync these to my new phone so I never lose access to everything again? Fine."
I also started to get questions from my wife around how she could access things in the event of my death and it seemed having a 1Password printout in a safe deposit box she could access - and having that include the MFA too - was a good idea.
My master password in 1Password is quite secure (A long obscure sentence and with special characters etc.), I have it auto-lock pretty quickly (thanks TouchID!) and I guess that will have to be enough unless I shift to something like a Yubikey on my keychain for things down the road...
Earlier quoted context omitted.
I'm still confused. Why did people have username/password logins to the AWS console? Either require SSO login, or require HW tokens to get in as an AWS user. Then it doesn't matter if someone finds the password file, it's useless.
From information floating around on Twitter it looks like they had the password to the SSO account of an employee and then social engineered their way to get the employee to accept the push MFA prompt to add a new device. At this point it appears that they found more credentials on the internal network and owned SSO, MFA and AD giving admin access to everything.
That's my hangup. The fact that admin/root level accounts can be accessed with "credentials" alone, rather than only via SSO/MFA/Yubikey. Were these service accounts, what happened to least privilege?
Earlier quoted context omitted.
From information floating around on Twitter it looks like they had the password to the SSO account of an employee and then social engineered their way to get the employee to accept the push MFA prompt to add a new device. At this point it appears that they found more credentials on the internal network and owned SSO, MFA and AD giving admin access to everything.
> found more credentials on the internal network ... giving admin access to everything That's my hangup. The fact that admin/root level accounts can be accessed with "credentials" alone, rather than only via SSO/MFA/Yubikey. Were these service accounts, what happened to least privilege?
SSO can go down or get owned so having break glass credentials isn't unheard of. The last place I worked at had them on paper in a safe in their headquarters. The Twitter threads show that they were stored in a password manager but the hacker was able to find credentials to access it which could have been one of the responsiblities of the employee which was targeted.
If you have your password manager on SSO it will be even easier.