Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers shoveled snow for company, were rewarded with network admin access

theregister.com

Post reply on HN
Print view View original

61–70 of 81 posts

Re: Hackers shoveled snow for company, were rewarded with network admin access

#61

Post by lima »

Symbiote wrote: post #14
lima wrote: post #6

The company also should have restricted network access to the port in the conference room so that an unknown device like a Raspberry Pi could not make an Ethernet connection from that spot Bad take - the actual problem is that there was a trusted network in the first place. This kind of network access control is trivial to bypass, and trusted devices can get compromised.

It's not my field, but at least at my work the network can somehow tell the difference between an authorized user and not. It is not simply using the MAC address. A guest device connected to the ethernet port in the conference room has the same access as a device connected to the guest wifi, a staff laptop has it's usual access.

Probably 802.1x, but it's easy to bypass if you have access to an authorized device. This kind of authentication has to be done at the application level, treating the network as a perimeter doesn't work.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#62

Post by lima »

lokar wrote: post #33
z3ugma wrote: post #10

What always gets me about these red team attacks is the same thing that gets me about internal phishing test emails. My company sent an internal phishing test last week. Several people immediately reported it to a cybersecurity engineer, posted about it in Slack, saying they were surprised that such a sophisticated phishing attack was happening. I too was surprised - Google is usually much better about catching these…

I remember at some point Google disallowed more phishing attacks from red teams. Nothing new was being learned. They always work.

Google solved credential phishing a long time ago using hardware tokens (gnubby - the predecessor to FIDO/U2F/Passkeys...).

There's other types of social engineering, but phishing is mostly an engineering issue.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#63

Post by kaikai »

wpm wrote: post #29
alt227 wrote: post #24

Earlier quoted context omitted.

Expiring passwords are one of my biggest gripes, and I still see them everywhere

My company does it to our phone passcodes. 90 days.

Well, I’ve only got 10 fingers, so looks like my time there would be limited to 900 days.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#64

Post by perching_aix »

grg0 wrote: post #28
alt227 wrote: post #24

Earlier quoted context omitted.

Expiring passwords are one of my biggest gripes, and I still see them everywhere

Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?

Unbounded length anything is a denial of service vector, even if they do hash. I can assure you that even if your password manager doesn't impose limits, you can most certainly hit some if you try hard enough. It is also completely pointless. Two dozen or so ASCII letters and numerals will let you encode all the entropy you could possibly want.

Expiration is self-evident. Long lived tokens you can just whip around will whip around. The number one group of people who are hurt by expiration are those not using a password manager anyways. Autogenerated and autofilled passwords can expire all they want, it's a non-issue.

Special characters are dumb and unnecessary. They also pose a fun challenge when you happen to run into a situation where you can't input them anymore all of a sudden.

People cannot participate in cryptographic schemes, only machines can. These gimmicks do not help fix that. It's "theatre", as they say.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#65

Post by daledavies »

NopIdoN wrote: post #22
raffraffraff wrote: post #8

Earlier quoted context omitted.

How about mixing up band names? Take the end of "Florence and the machine" and mix it with the start of "Rage against the machine" and you now have the totally unguessable "Rage sharing the machine". It's a different machine see?! Nobody would know that!

The The but the first The is from The Who

That's crazy! Imagine what The The and The Who would sound like? Not The The and The Who, but the The The and the The Who your comment alludes to. Or would the original ones be called The The The and The The Who?

Re: Hackers shoveled snow for company, were rewarded with network admin access

#66

Post by antonkochubey »

Xeoncross wrote: post #18
chopin wrote: post #11

Earlier quoted context omitted.

I loathe two things in password requirements: special characters and not allowing spaces. C'mon, it's 2026. Require 20 characters and call it a day.

"password is to long, max length..." (╯°□°）╯︵ ┻━┻

Alibaba Cloud in 2026 lol

Re: Hackers shoveled snow for company, were rewarded with network admin access

#67

Post by ndsipa_pomu »

nickweb wrote: post #43
ChrisRR wrote: post #4

Earlier quoted context omitted.

I like the last line of your comment My password is now password

That's cool. Yours comes up as stars (*). Must be a HN thing.

hunter2

doesnt look like stars to me

Re: Hackers shoveled snow for company, were rewarded with network admin access

#68

Post by jkrejcha »

grg0 wrote: post #28
alt227 wrote: post #24

Earlier quoted context omitted.

Expiring passwords are one of my biggest gripes, and I still see them everywhere

Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?

Good security policies should have an upper bound on password length, but also those upper bounds should maybe be like 100 characters or so. There's a couple reasons for this. First being is that hashing does take some compute resources, second being that there is some security/usability tradeoffs here, etc, and third being that after like 30 characters or so, the effective (key phrase here) security gains become marginal.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#69

Post by shalmanese »

grg0 wrote: post #28
alt227 wrote: post #24

Earlier quoted context omitted.

Expiring passwords are one of my biggest gripes, and I still see them everywhere

Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?

> Why can't my password be a 5KB long

Because that opens you up to an entirely new class of attack. You have to set the limit somewhere and if you set it at INT_MAX, then a malicious user could find a O(n^2) path in your password validator and input a 4GB password that locks up the machine. Or they could create 1000 users in a row with 4GB passwords and fill up your storage.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#70

Post by jkrejcha »

ChrisRR wrote: post #4
Xeoncross wrote: post #3

Earlier quoted context omitted.

1. Open a web browser and do a search 2. Read until you find a sentence that you like. 3. Use it as your password

I like the last line of your comment My password is now password

"That's the best password ever!"
Post reply on HN