Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Apple and Amazon Security Flaws Led to My Epic Hacking

wired.com

Post reply on HN
Print view View original

21–30 of 264 posts

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#21

Post by cubicle67 »

My bank and a few other companies I deal with require some sort of pin/password in order to speak to someone over the phone. When I call, the conversation usually goes something like

    "Hello Mr 67, before we start I'll need your pin"
      "I have a pin?"
    "Yes, when you set up this account you were given a pin required for phone access"
      "Really? I have no idea what it is..."
    "That's ok. If you can just answer these other few questions.         
     What's your mother's maiden name"
       [redacted]
    "and your birthdate"
       [also redacted]
    "thankyou Mr 67, now how can I help you today? ..."

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#22

Post by spacemanaki »

irq wrote: post #5
suresk wrote: post #3

Given how central (for better or worse) of a role email plays in safeguarding other accounts, the hassle of 2-factor auth for it is feeling like less and less of an annoyance. About a month ago, one of my credit card accounts got hacked and was used to send money to someone else - the number itself wasn't compromised, it was the actual account. No doubt, the attackers tried to login and change my email password, but…

2-factor auth has been cracked before [1] and will be again until there is a standard on how to implement it. With implementations differing between companies, a cracker can play one org's weakness off another org. Like in this case, using the freely-available trailing 4 digit CC code from Amazon to get into Apple. If both companies agreed to a standard that made it obvious such practices were non-compliant, this wou…

> 2-factor auth has been cracked before

I wish people would stop bandying this about as if there was an actual flaw in the 2-factor app or the protocol or crypto algorithms used. The linked breach was likely due to a social engineering attack on phone company support staff. Yes, it's concerning, and something Google and the phone companies should be investigating, but no, 2-factor auth wasn't "cracked."

Someone who's more informed than I, is there really a weakness in smart-phone based two factor authentication if you choose NOT to use the SMS or voice based backup, out-of-band authentication option? I'm pretty sure that is an optional feature of Google's 2-factor auth, with printed backup codes being the alternative.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#23

Post by pbreit »

mechanical_fish wrote: post #6
brown9-2 wrote: post #2

It turns out, a billing address and the last four digits of a credit card number are the only two pieces of information anyone needs to get into your iCloud account. This is scary.

I have actual work to do, work that I have been putting off too long, so let's try crowdsourcing this question on HN: What should one try to do to protect against this? Hypothetical actions to take: Make sure that an email address that's doing double-duty as a login identifier for a given service is unique to the service and appears nowhere on the web or in outgoing mail. Take particular care to have a "recovery" ema…

I wouldn't do anything too crazy. If you're the 1 in a billion (7 billion, actually) who gets targeted like this, they'll probably still get in so you're just wasting oodles of time and adding a good dose of constant aggravation for essentially nothing.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#24

Post by adgar »

cubicle67 wrote: post #16
suresk wrote: post #3

Given how central (for better or worse) of a role email plays in safeguarding other accounts, the hassle of 2-factor auth for it is feeling like less and less of an annoyance. About a month ago, one of my credit card accounts got hacked and was used to send money to someone else - the number itself wasn't compromised, it was the actual account. No doubt, the attackers tried to login and change my email password, but…

the weakness with 2-factor auth is that almost all of us with a smartphone use that phone for email. And that phone is the same one google sends the sms to...

Don't use SMS, use the Google Authenticator app. It's available on every mobile platform and implements open, RFC-specified OTP algorithms. And obviously works with Google's 2-factor implementation.

Edit: forgot to mention, also open-source.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#25

Post by adgar »

spacemanaki wrote: post #22
irq wrote: post #5

Earlier quoted context omitted.

2-factor auth has been cracked before [1] and will be again until there is a standard on how to implement it. With implementations differing between companies, a cracker can play one org's weakness off another org. Like in this case, using the freely-available trailing 4 digit CC code from Amazon to get into Apple. If both companies agreed to a standard that made it obvious such practices were non-compliant, this wou…

> 2-factor auth has been cracked before I wish people would stop bandying this about as if there was an actual flaw in the 2-factor app or the protocol or crypto algorithms used. The linked breach was likely due to a social engineering attack on phone company support staff. Yes, it's concerning, and something Google and the phone companies should be investigating, but no, 2-factor auth wasn't "cracked." Someone who's…

> I wish people would stop bandying this about as if there was an actual flaw in the 2-factor app or the protocol or crypto algorithms used.

FUD will never go away. Don't let it get to you.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#26

Post by danweber »

prawn wrote: post #12
danweber wrote: post #7

We need people to be able to regain access after losing a password, and we need only the right people to have that. This is a very hard problem. One thing that we should have is a "cool down" period. If you want to regain access to, say, your GMail account, then it will take 48 hours of waiting, and phone calls and emails will go out to your contacts before that is completed, so the real person has a chance to protes…

If you're trying to remote-wipe your computer so that a thief doesn't access your sensitive data, wouldn't you want the data to be lost permanently?

Could be. But that's a very different problem.

Old-school computer security breaks things down into the CIA categories:

Confidentiality is for things you want secret. Integrity is for things you want to not be altered. Accessibility is for things you want to be able to reach.

Honestly, very little of data requires confidentiality. Yet that's what encryption is usually used for. I would, by an order of magnitude, rather have a hacker gain access to my family photos than have them deleted beyond my ability to recover.

I hate whole-disk encryption. In nearly everything in my life, the threat of losing access to my data is vastly worse than someone else accessing it.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#27

Post by pbreit »

modularunit wrote: post #10

Can we please get the entire internet to agree to stop using email addresses as usernames. It's not a user, its an email address!

Probably not. Emails make terrific usernames because they are unique, easy to remember, double as a communication identifier and make registration slightly easier. And I'm not exactly sure how that would help in this situation. Are you suggesting that iCloud and Gmail login with usernames (different from your email address)?

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#28

Post by landr0id »

ghshephard wrote: post #19
suresk wrote: post #3

Given how central (for better or worse) of a role email plays in safeguarding other accounts, the hassle of 2-factor auth for it is feeling like less and less of an annoyance. About a month ago, one of my credit card accounts got hacked and was used to send money to someone else - the number itself wasn't compromised, it was the actual account. No doubt, the attackers tried to login and change my email password, but…

I've been using google two-factor auth for the better part of a year now, and the annoyance comes down to, once every 30 days or so, having to take 5 extra seconds during login to enter a code sent to my cell phone. I can't _think_ of anything less of a hassle.

Google has actually made it even less of a hassle by instead trusting a computer forever instead of having the session last 30 days [1]. This can be seen two ways though: less of a hassle for the user, and less secure. I wonder why Google doesn't give the option for the session lasting 30 days or forever.

[1] http://i.imgur.com/A9Wu5.png

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#29

Post by columbo »

mechanical_fish wrote: post #6
brown9-2 wrote: post #2

It turns out, a billing address and the last four digits of a credit card number are the only two pieces of information anyone needs to get into your iCloud account. This is scary.

I have actual work to do, work that I have been putting off too long, so let's try crowdsourcing this question on HN: What should one try to do to protect against this? Hypothetical actions to take: Make sure that an email address that's doing double-duty as a login identifier for a given service is unique to the service and appears nowhere on the web or in outgoing mail. Take particular care to have a "recovery" ema…

The most surprising thing I see out of this isn't the need for more robust authentication but for services that aren't so damn quick to do whatever you want.

Website: "Hey Bill, glad to see you today, what do you want to do"

Bill: "Delete _everything_ I've ever done on every system I have"

Website: "Of course! Let's get this started... beep boop bip and done!"

What about this:

1 - Kill request sent

2 - 48 hours is set on the clock so you can choose to cancel

3 - You can choose to pay $50 via credit card to have it happen immediately

4 - You are reimbursed $45 after a couple weeks

That might make it a little harder to have such hacks like this happen in the future.

Re: How Apple and Amazon Security Flaws Led to My Epic Hacking

#30

Post by graeme »

landr0id wrote: post #28
ghshephard wrote: post #19

Earlier quoted context omitted.

I've been using google two-factor auth for the better part of a year now, and the annoyance comes down to, once every 30 days or so, having to take 5 extra seconds during login to enter a code sent to my cell phone. I can't _think_ of anything less of a hassle.

Google has actually made it even less of a hassle by instead trusting a computer forever instead of having the session last 30 days [1]. This can be seen two ways though: less of a hassle for the user, and less secure. I wonder why Google doesn't give the option for the session lasting 30 days or forever. [1] http://i.imgur.com/A9Wu5.png

That's horrible. It was already very easy, I don't see the need.
Post reply on HN