Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kurt Got Got

fly.io

Post reply on HN
Print view View original

161–170 of 256 posts

Re: Kurt Got Got

#161

Post by taneq »

liquidgecka wrote: post #124
Aeolun wrote: post #116

Earlier quoted context omitted.

Our company does regular phishing attacks against our own team, which apparently gets us a noteworthy 90% ‘not-click’ rate (don’t quote me on numbers). Never mind that that 10% is still 1500 people xD It’s gone so far that they’re now sending them from our internal domains, so when the banner to warn me it was an external email wasn’t there, I also got got.

My former company would send out rewards as a thank you to employees. It was basically a “click here to receive your free gift!” email. I kept telling the security team that this was a TERRIBLE president but it continued none the less. The first time I got one I didn’t open it for ages, even after confirming the company was real. It was only after like the 5th nagging email that I asked security about it and they con…

There are SO MANY terrible practices like this carried out by companies big enough to know better. From registering new domains for email addresses (for a while a BigCorp customer of ours had a mix of @bigcorp.com and @bigcorp2.com email addresses, how the hell is any user meant to guess that MediumCorp hasn't also spun up a mediumcorp2.com mail server?!) to FedEx sending "click this link to pay import duties" texts from random unaffiliated (probably personal?) mobile numbers as their primary method of contacting recipients for import duties... The internet (like credit cards) is built on and around trust, and it shouldn't be.

Congrats on the loot, though! Your former company can't be all bad. ;)

Re: Kurt Got Got

#162

Post by taneq »

riffraff wrote: post #142
liquidgecka wrote: post #124

Earlier quoted context omitted.

My former company would send out rewards as a thank you to employees. It was basically a “click here to receive your free gift!” email. I kept telling the security team that this was a TERRIBLE president but it continued none the less. The first time I got one I didn’t open it for ages, even after confirming the company was real. It was only after like the 5th nagging email that I asked security about it and they con…

I'm pretty sure you meant "terrible precedent" but I giggled a bit thinking "yeah the company president is pretty bad for forcing this".

I kinda want to start using "setting a terrible president" now and see who calls me out on it. :D

Re: Kurt Got Got

#163

Post by classified »

tptacek wrote: post #122
giarc wrote: post #121

Earlier quoted context omitted.

I'm sorry but the imagecontent-x.com url should throw red flags for anyone.

This is exactly how not to defend against phishing. The meaningful defense is to foreclose on it entirely, not to just get super good at spotting fakes.

> The meaningful defense is to foreclose on it entirely

Sounds easy enough in theory. How do you do that in practice?

Re: Kurt Got Got

#164

Post by jopsen »

akerl_ wrote: post #54
otterley wrote: post #47

Earlier quoted context omitted.

Precisely. 1Password's browser integration would have noticed a domain mismatch and refused to autofill the password -- but in a panic, Kurt apparently opened 1Password and then copied/pasted the credentials manually.

Which is why a properly working password manager is not a strong defense against phishing.

Not a strong defense, but it helps.

But it's also why sites that don't work well with a password manager are actively setting their users up to be phished.

Same with every site that uses sketchy domains, or worse redirects you to xyz.auth0.com to sign in.

Re: Kurt Got Got

#166

Post by mr_mitm »

Amorymeltzer wrote: post #111
bradgessler wrote: post #13

When we did annual pen testing audits for my last company, the security audit company always offered to do phishing or social engineering attacks, but advised against it because they said it worked every single time. One of the most memorable things they shared is they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on…

>they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on it and get p0wned. One of my favorite quotes is from an unnamed architect of the plan in a 2012 article about Stuxnet/the cyber attacks on Iran's nuclear program: "It turns out there is always an idiot around who doesn't think much about the thumb drive in their…

I don't think we should be calling the users idiots when we failed to make our systems secure by design. If a simple act like plugging in a thumb drive by a well-meaning user undermines the security of an entire operation, then why do we allow such a thing to happen?

Relevant: https://www.schneier.com/blog/archives/2016/10/security_desi...

Re: Kurt Got Got

#167

Post by mr_mitm »

tialaramex wrote: post #94
amenghra wrote: post #57

Earlier quoted context omitted.

If you are getting powned by running random executables found on usb drives, passkeys aren’t going to save you. Same if the social engineering is going to get you to install random executables.

If you're getting pwned a physical Security Key still means bad guys don't have the actual credential (there's no way to get that), and they have to work relatively hard to even create a situation where maybe you to let them use the credential you do have (inside the Security Key) while they're in position to exploit you. These devices want a physical interaction (this is called "User present") for most operations, t…

All your 2FA apps, token, security keys, certificates and what not only protect the authentication (and in the case of online banking, a few other actions like transferring money). After that, a single bearer token authenticates each request. If your endpoint is compromised, the attackers will simply steal the bearer token after you authenticate.

Re: Kurt Got Got

#168

Post by karel-3d »

KingOfCoders wrote: post #146

Phishing training does not work. "Understanding the Efficacy of Phishing Training in Practice" https://arianamirian.com/docs/ieee-25.pdf

"Don't put your password into the website that you shouldn't and put it only to website that you should" is a circular advice.

It's like those 2FA SMS that say "don't tell this token to anyone!" while you literally share it with the website that you login to. I am always so frustrated when I receive those

Re: Kurt Got Got

#169

Post by kstenerud »

bradgessler wrote: post #13

When we did annual pen testing audits for my last company, the security audit company always offered to do phishing or social engineering attacks, but advised against it because they said it worked every single time. One of the most memorable things they shared is they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on…

These audits are infuriating. At one company I was at it got so bad that I eventually stopped reading email and told people "If it's important, ping me on Slack"

Re: Kurt Got Got

#170

Post by typpilol »

reassess_blind wrote: post #129

Is there an anti-phishing extension that detects whether the domain is close to, but not exactly the popular legitimate domain? Would probably need to use a local LLM for the detection. If not I might look into making one.

Edge has some basic typo squat protection
Post reply on HN