Live data from Hacker News

Hackers ship their exploits directly to their target’s mailroom

techcrunch.com

171–172 of 172 posts

Re: Hackers ship their exploits directly to their target’s mailroom

#171
post #169
post #157

Earlier quoted context omitted.

> There are far easier ways to get what you need from a modern office with typical security hygiene. Far easier than looking through a window? I'm curious to know! I've seen banks where it would be possible! I expect most of their software to be internal and accessed through a VPN when outside but still.

Well you'd usually need to work to get access to a room to look through the window, so that's not a given :) I think sending a parcel like in this article, or leaving a USB stick lying around is often an easier task. Even if you window-surf some credentials you most likely can't use them unless you're on the internal network already. At least at my place of work you'd need a VPN token to make any use of my details un…

> Well you'd usually need to work to get access to a room to look through the window, so that's not a given :)

There's plenty of ways to enter in many buildings without "working there". As long as the physical security there is lower (and there's a ton of reason why it could be) or that it's already open to the public.

> I think sending a parcel like in this article,

That only give you physical proximity. Unless they have bad wifi securities like that article said... that won't give much. People don't talk about password regularly ;).

> leaving a USB stick lying around is often an easier task

That's just hoping right there, Windows autorun hasn't been a thing for a long time, an USB keys that open a terminal is freaking obvious and most people know not to plug any random USB keys. That most probably won't works for any high ranking official.

Almost no one talk about making sure windows doesn't see keyboards though... or even screens, and you'll see that usually, people with higher ranks do have windows closeby ;) (the perks of the ranks).

Re: Hackers ship their exploits directly to their target’s mailroom

#172
post #164

Earlier quoted context omitted.

You can't guarantee that, and keep reasonable performance, if humans are generating the PSK

I agree, but you can certainly build a system where humans don't generate the key.

Then how do humans share said key?

QR codes and NFC tags etc. are nice, but not supported everywhere.

Post reply on HN