Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

121–130 of 498 posts

Re: We all dodged a bullet

#121

Post by paradite »

sebstefan wrote: post #48

Dodged a bullet indeed I find it insane that someone would get access to a package like this, then just push a shitty crypto stealer. You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? You can exfiltrate API keys, add your SSH public key to the server then exfiltrate the server's IP address so you can snoop in there manually, if you're on a dev…

Because it's North Korea and crypto currency is the best assets they can get for pragmatic reasons.

For anything else you need a fiat market, which is hard to deal with remotely.

Re: We all dodged a bullet

#122

Post by amysox »

viraptor wrote: post #26
Dilettante_ wrote: post #7

Earlier quoted context omitted.

This is the Way. To minimize attack surface, the senders of authentic messages should straight-up avoid putting links to "do the thing" in the message. Just tell the user to update their credentials via the website.

That's what the Australian Tax Office does. Just a plaintext message that's effectively "you've got a new message. Go to the website to read it."

My doctor's office does the same thing. So do some financial services companies.

Re: We all dodged a bullet

#123

Post by zahlman »

cataflam wrote: post #35

Besides the ecosystem issues, for the phishing part, I'll repost what I responded somewhere in the other related post, for awareness --- I figure you aren't about to get fooled by phishing anytime soon, but based on some of your remarks and remarks of others, a PSA: TRUSTING YOUR OWN SENSES to "check" that a domain is right, or an email is right, or the wording has some urgency or whatever is BOUND TO FAIL often enou…

> U2F/Webauthn key as second factor is phishing-proof. TOTP is not.

Last I checked, we're still in a world where the large majority of people with important online accounts (like, say, at their bank, where they might not have the option to disable online banking entirely) wouldn't be able to tell you what any of those things are, and don't have the option to use anything but SMS-based TOTP for most online services and maybe "app"-based (maybe even a desktop program in rare cases!) TOTP for most of the rest. If they even have 2FA at all.

Re: We all dodged a bullet

#124

Post by procaryote »

dsff3f3f3f wrote: post #5

> These kinds of dependencies are everywhere and nobody would even think that they could be harmful. Tons of people think these kind of micro dependencies are harmful and many of them have been saying it for years.

I've nixed javascript in the backend in several places, partly because of the weird culture around dependencies. Having to audit that for compliance, or keeping it actually secure, is a nightmare.

Nixing javascript in the frontend is a harder sell, sadly

Re: We all dodged a bullet

#125

Post by dghlsakjg »

bob1029 wrote: post #113

"Batteries included" ecosystems are the ultimate defense against the dark arts. Your F100 first party vendor might get it wrong every now and then, but they have so much more to lose than a random 3rd party asshole who decides to deploy malicious packages. The worst thing I can recall from the enterprisey ecosystems is the log4j exploit, which was easily one of the most attended to security problems I am aware of. Ev…

Solarwinds?

Re: We all dodged a bullet

#126

Post by zahlman »

zargon wrote: post #73
macintux wrote: post #55

Earlier quoted context omitted.

> 1. NEVER EVER login from an email link. I receive Google Doc links periodically via email; fortunately they're almost never important enough for me to actually log in and see what's behind them. My point, though, is that there's no real alternative when someone sends you a doc link. Either you follow the link or you have to reach out to them and ask for some alternative distribution channel. (Or, I suppose, leave y…

> leave yourself logged into the platform all the time Or only log in when you need to open a google link. Or better yet, use a multi-account container for google.

> Or better yet, use a multi-account container for google.

Pardon; a what? Got any reference links?

Re: We all dodged a bullet

#127

Post by wongarsu »

zahlman wrote: post #104
pluto_modadic wrote: post #89

Earlier quoted context omitted.

"found out right away"... by people with time to review security bulletins. There's loads of places I could see this slipping through the cracks for months.

Yes, but this is an ecosystem large enough to include people who have that time (and inclination and ability); and once they have reported a problem, everyone is on high alert.

If you steal the cookies from dev machines or steal ssh keys along with a list of recent ssh connections or do any other credential theft there are going to be lots of people left impacted. Yes, lots of people reading tech news or security bulletins is going to check if they were compromised and preemptively revoke those credentials. But that's work, meaning even among those informed there will be many who just assume they weren't impacted. Lots of people/organisations are going to be complacent and leave you with valid credentials

Re: We all dodged a bullet

#128

Post by cyphar »

simoncion wrote: post #81
quectophoton wrote: post #62

Earlier quoted context omitted.

Then you have companies like AWS, they were sending invoices from `no-reply-aws@amazon.com` but last month they changed it to `no-reply@tax-and-invoicing.us-east-1.amazonaws.com`. That looks like a phishing attempt from someone using a random EC2 instance or something, but apparently it's legit. I think . Even the "heads-up" email they sent beforehand looked like phishing, so I was waiting for the actual invoice to s…

> These companies tell customers to be suspicious of phishing attempts, and then they pull these stunts. Yep. At every BigCo I've worked at, nearly all of the emails from Corporate have been indistinguishable from phishing. Sometimes, they're actual spam! Do the executives and directors responsible for sending these messages care? No. They never do, and get super defensive and self-righteous when you show them exactl…

A few years ago our annual corporate phishing training was initiated by an email sent from a random address asking us to log in with our internal credentials on a random website.

A week later some executive pushing the training emailed the entire company saying that it was unacceptable that nobody from engineering had logged into the training site and spun some story about regulatory requirements. After lots of back and forth they still wouldn't accept that it obviously looked like a phishing email.

Eventually when we actually did the training, it literally told us to check the From address of emails. I sometimes wonder if it was some weird kind of performance art.

Re: We all dodged a bullet

#129

Post by blamestross »

mikewarot wrote: post #28

>Saved by procrastination! Seriously, this is one of my key survival mechanisms. By the time I became system administrator for a small services company, I had learned to let other people beta test things. We ran Microsoft Office 2000 for 12 years, and saved soooo many upgrade headaches. We had a decade without the need to retrain. That, and like other have said... never clicking links in emails.

"Just wait 2 weeks to use new versions by default" is an amazing defense method against supply chain attacks.

Re: We all dodged a bullet

#130

Post by duxup »

viraptor wrote: post #26
Dilettante_ wrote: post #7

Earlier quoted context omitted.

This is the Way. To minimize attack surface, the senders of authentic messages should straight-up avoid putting links to "do the thing" in the message. Just tell the user to update their credentials via the website.

That's what the Australian Tax Office does. Just a plaintext message that's effectively "you've got a new message. Go to the website to read it."

All my medical places I use do that, with the note that you can also use their app. Good system.
Post reply on HN