Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

theverge.com

Post reply on HN
Print view View original

121–130 of 140 posts

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#121

Post by koliber »

codetrotter wrote: post #104
solatic wrote: post #86

A lot of people advise ways of locking down name changes, but this doesn't really solve the problem. I'm sure there's someone out there whose first name is actually Jira. I worked for $company where customer dashboards were set up on a wildcard - https://*.$company.com , e.g. https://foo.$company.com . Guess what happens when someone picks a dashboard slug that conflicts with an actual record, like `www` or `blog`? T…

Zendesk for example puts their customer dashboards on a direct subdomain of their own main domain. They allow people to use their own domains as well. To use your own domain you have to make it a CNAME for the subdomain that they gave you. https://support.zendesk.com/hc/en-us/articles/4408838571930-... I think it’s better to do like GitHub and Shopify and many others do. Have a separate domain at least that customer…

Also if you set cookies in your app with the scope of your main domain with the hope that they are visible to all of the subdomains you provide for your customers, these cookies are also accessible by 3rd party services that use your subdomains.

So if you run acme.com and give our subdomain to your clients you could end up with client1.acme.com and client2.acme.com. You decide to store cookies on acme.com. The. You decide that you will use SupportCorp’s helpdesk software and host it on support.acme.com. If a logged in user goes to support.acme.com they will send their cookies to SupportCorp’s servers. This might include session ids and other highly sensitive info.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#122

Post by ceejayoz »

mikehollinger wrote: post #112
Prcmaker wrote: post #91

Earlier quoted context omitted.

My partners work has an employee named 'Admin'. IT struggles with what to do thee.

I’ve worked with someone named True, who, when I went to go add her to some event or another, something along the way helpfully changed it to “TRUE.” I also worked with a guy whose last name was Null. His email was null@ for a period of time.

Radiolab did an episode about people in this pickle. https://radiolab.org/podcast/null

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#123

Post by fragmede »

i_am_jl wrote: post #116
lupire wrote: post #107

Earlier quoted context omitted.

What happens if you put on a police costume and go policing? Intentionally deceovit about your identity, in order to obtain access to a something of value that you are forbidden to access, is a clear crime, as it should be.

Being deceptive about your identity during the commission of a crime is illegal? If I dress up as a Best Buy employee and drag a television out of a loading dock and into the bed of a truck, that's definitely illegal, but I don't think it's any more illegal than if I did it in jeans and a T-shirt.

Impersonating a police officer is its own charge though, so while impersonating a best buy employee isn't going to get an extra charge applied, impersonating a cop, is.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#124

Post by monocasa »

stefan_ wrote: post #95
brunosutic wrote: post #85

Replacing ascii with similar-looking unicode characters is an old trick. There's a bunch of these characters out there. You can use it in the code to prank your colleague developers - April 1st is nearing! I even made a vim plugin that highlights these "dangerous" characters: https://github.com/vim-utils/vim-troll-stopper I've never been pranked with unicode characters, but I've had a situation at work where a consul…

Lots of apps have helpfully started turning two dashes (—-) into some sort of Unicode long dash that is more aesthetically pleasing, while also breaking command line tools.

Known as an 'em dash'.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#126

Post by vanc_cefepime »

justanother wrote: post #10

I knew an ex-employee back in the day (not me I swear) who created a dialup/ISDN provisioning profile called 'Ringing' in the modem rack controller module (not the Radius server, that would be too obvious), such that a glance at the modem rack status page showed everyone who was connected, and one that was 'Ringing', just like any other incoming call that hadn't been picked up yet. It went completely undetected, yiel…

What’s the story about cfaa and boogers? My google-fu is failing me and can’t find a reference on it.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#127

Post by cosmodisk »

kej wrote: post #40
rokkitmensch wrote: post #9

This reminds me of a glorious day at my consulting company ca. 2016 when we discovered that we could change each other's names on Slack. At one point everyone was just named dad.

This sounds a lot like when my kids realized anyone can edit Netflix/Disney+ profile names and pictures.

I've been playing this for a while now with our daughter. She wakes up in the morning and finds some absurdity written on my account,then she changes it and the cycle repeats on the following day:)

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#128

Post by gwern »

solatic wrote: post #86

A lot of people advise ways of locking down name changes, but this doesn't really solve the problem. I'm sure there's someone out there whose first name is actually Jira. I worked for $company where customer dashboards were set up on a wildcard - https://*.$company.com , e.g. https://foo.$company.com . Guess what happens when someone picks a dashboard slug that conflicts with an actual record, like `www` or `blog`? T…

You're really going to make excuses for Slack here? 'o'/'о' is just about the easiest possible homograph attack (https://en.wikipedia.org/wiki/IDN_homograph_attack) that there is:

> When it was his time to leave, McKay swapped out his existing profile picture for one that resembled an angrier version of Slackbot’s actual icon. He also changed his name to “Slackbot.” You can’t just change your name on Slack to “Slackbot,” by the way, as the service will tell you that name’s already been taken. It does work if you use a special character that resembles one of the letters inside Slackbot, though, such as replacing “o” with the Unicode character “о.”

And in fact, this exact pair of English/Cyrillic was used in one of the first published homoglyph attacks: https://web.archive.org/web/20200102175251/http://www.cs.tec... back in 2001!

In 2022, Slack had a valuation of something like $20b and had been in operation for almost a decade. And their business is username-based software for people who need security ie. organizations/businesses.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#129

Post by vrosas »

thecupisblue wrote: post #89

Admins not killing old accounts is a security hole that I'd say 50% of companies I worked with had/have. I can still log into the google workspace, slack, check out confidential documents on drive (not because of transparency, but because they dont know how to share properly). I can check out what is happening in nearly any of their projects by peeking at the channel and if I want to know more, I just take a look at…

One manager asked for my personal email so they could add me to all the relevant google groups and whatnot so day 1 I could hit the ground running and wouldn’t need to wait for my company email to be provisioned. Needless to say, 8 years and 2 jobs later it’s still in there.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#130

Post by reactordev »

newdee wrote: post #101
reactordev wrote: post #50

Earlier quoted context omitted.

It is correct, your company just messed up somewhere...

Eh, that’s a matter of opinion on policy. Technically (at least with Slack) it is possible to require SSO for users and control over which profile attributes they can change themselves, including display name. Although they may get clobbered at login as part of reading the SAML doc.

Just because you can, doesn’t mean you should - and in fact is a security hole if you do. We don’t allow security holes where I work so all attributes are copied over and nothing can be changed. No hidden employees. No unknown guests.
Post reply on HN