Reading this reminds me of a gripe I have; is it possible to use 2-factor authentication on gmail without a phone? You can print a list of OTPs but you can't enable it without also registering a phone number. Given how easy it is to intercept voice and SMS, that seems like a huge security hole.
Cosmo, the God who fell to Earth
11–20 of 42 posts
Re: Cosmo, the God who fell to Earth
#12Reading this reminds me of a gripe I have; is it possible to use 2-factor authentication on gmail without a phone? You can print a list of OTPs but you can't enable it without also registering a phone number. Given how easy it is to intercept voice and SMS, that seems like a huge security hole.
[deleted]
Re: Cosmo, the God who fell to Earth
#13In 2005, I worked support for a company with a mobile offering. At the time, app purchases were handled exclusively by the carrier and were completely opaque. A little while prior, we had partnered with a shady marketing company, netting us a bunch of unintentional signups that I had the displeasure of fixing. Since we didn't handle billing, I had to call AT&T with the customer on the line and talk them both through…
I learned a similar lesson working for RadioShack as a teen except with Sprint phones/service. After handling charges for upset customers I learned the ins and outs of Sprint's phone support and could basically get them to do whatever I wanted.
Needless to say I too carried a Sprint handset at the time.
Re: Cosmo, the God who fell to Earth
#14The trouble is that normal operations are often indistinguishable from social engineering.
I have worked several places where I have been told by management that something needs fixed on a web server, but they can't remember any passwords, so could I call up their ISP and just get it sorted.
In these situations, I have never had to prove anything I couldn't have faked and I usually get asked to provide an email address so they can send me the details.
As this kind of behaviour seems very common, most everything seems to be wide open for social engineering. So given that everything isn't hacked all of the time, people in general must be both much nicer and much lazier than I had otherwise assumed.
Re: Cosmo, the God who fell to Earth
#15>>People Are The Key to Every Lock
Great section title. Here's my favorite bit of "social engineering". Using the term loosely, I know, but it still makes me laugh.
Re: Cosmo, the God who fell to Earth
#16looks like wired got socialed themselves
Re: Cosmo, the God who fell to Earth
#17It's interesting to me how easy it is for some people to circumvent their ethics. This kid is intelligent enough to know what he's done is unethical but I've never been a teenage boy so I consider what would come with that feeling of discovering a sweet hack: a desire to use that knowledge to assert power above all costs.
I guess I'd say that teenagers don't often have a fully developed sense of ethics. I would like to make a gross assumption and make a wild guess that Cosmo is developing ethics, along with his growing up and developing a criminal record. At least that's how the Wired article reads (& suggests) to me.
Re: Cosmo, the God who fell to Earth
#18It's interesting to me how easy it is for some people to circumvent their ethics. This kid is intelligent enough to know what he's done is unethical but I've never been a teenage boy so I consider what would come with that feeling of discovering a sweet hack: a desire to use that knowledge to assert power above all costs.
The mind of a teenage boy can be a dangerous place. They are old enough to realize the possibilities and thrills associated with what they are doing, but not experienced enough to realize the consequences of their actions. I know I was a "knucklehead" from about age 15-20. I never did anything that got me into too much trouble, but I distinctly remember that the line between right and wrong seemed much hazier than it…
Agree. I can remember vividly that same state of flux in my own life.
When my parents dropped our dialup internet (too expensive) I looked for alternative ways to get online. My 'solution' was successful and was really exciting at the time but it was also illegal. After (poorly) emulating what I had done, a friend ended up with an angry sysadmin and some cops at his door.
Obviously what I did was wrong, it was stealing. But at the time it didn't feel wrong. It was exciting, fun and interesting - unlike anything in school or sports. Not only that, but the kid who got busted was our valedictorian a few years later, arguably one of the smartest kids in school.
All of the elation associated with the hack added to the fact that I knew most people couldn't do, or even understand, what I had done, masked any feelings of guilt or culpability in my still-developing conscience.
Now I have a son on the way and I'm wondering what he will have to experience before learning these lessons and what I can do to help with that. The prospect of being a father is the happiest, most exciting thing in my life to date - and also the most terrifying.
Re: Cosmo, the God who fell to Earth
#19This is really interesting. Makes me wonder why I bothered generating those hard-to-crack passwords if they can easily be reset by a bit of sweet-talking.
Re: Cosmo, the God who fell to Earth
#20Oh, Wired... you write an article about a hacker and change his name to "protect" him, but publish a photograph of his neighborhood with readable house numbers and license plates.