Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When MFA isn't MFA, or how we got phished

retool.com

Post reply on HN
Print view View original

171–180 of 287 posts

Re: When MFA isn't MFA, or how we got phished

#171

Post by rainsford »

hn_throwaway_99 wrote: post #38
rolobio wrote: post #22

Very sophisticated attack, I would bet most people would fall for this. I'm surprised Google encourages syncing the codes to the cloud... kind of defeats the purpose. I sync my TOTP between devices using an encrypted backup, even if someone got that file they could not use the codes. FIDO2 would go a long way to help with this issue. There is no code to share over the phone. FIDO2 can also detect the domain making th…

> Very sophisticated attack, I would bet most people would fall for this. No. If you think people at your company would fall for this, then IMO you have bad security training. The simple mantra of "Hang up, lookup, call back" ( https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... ) would have prevented this. Literally like 99% of social engineering attacks would be prevented this way. Seriously, make a lit…

But aside from beating employees over the head with it, how many companies actually operate in a way that encourages and reinforces such an approach? I'd bet it's not many, and honestly if it's a non-zero number I'd be at least a bit surprised.

You can have all the security training in the world, but every time IT or HR or whoever legitimately reaches out to an employee, especially when it's not based on something initiated by the employee, the company is training exactly the opposite behavior Krebs is suggesting. Hanging up and calling back will likely at minimum annoy the caller and inconvenience the employee. Is the company culture accepting of that, or even better are company policies and systems designed to avoid such a scenario? If a C-suite person calls you asking for some information and you hang up and call them back, are they going to congratulate you on how diligently you are following your security training?

You're not wrong that the Krebs advice would help prevent most phishing, but I'd argue it has to be an idea you design your company around, not just a matter of security training. Otherwise you're putting the burden on employees to compensate for an insecure company, often at their own cost.

Re: When MFA isn't MFA, or how we got phished

#172

Post by ketzo »

rmbyrro wrote: post #169
macNchz wrote: post #100

Beyond having hardware keys, this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information. It's always okay to say, "actually, let me get back to you in a minute" and hang up, calling back on a known phone number from the employee directory, or…

> someone starts asking for information Especially OTP codes. I can't understand how someone works at a tech company and is clueless to the point of sharing an auth code over the phone. My grandma, sure, but a Retool employee? C'mon, haven't we all read enough of these stories?

You can't understand at all how someone with your coworker's voice might lull you into a false sense of urgency and safety?

Security is a weak-link problem, not a strong-link one. You have to plan for the least security-minded people, the tired and stressed employee.

Re: When MFA isn't MFA, or how we got phished

#173

Post by Terretta »

crabbone wrote: post #170

MFA is a scam resulting from Google first, and then others wanting to get users' phone numbers associated with more data they collect on them. It provides no tangible security benefits, creates a lot of headache for IT department, creates big gaps in developer's productivity (if used in a programming company) and, actually, creates a new attack vector (phones are lost or stolen a lot more often than any other means o…

I don't understand:

> Google first, and then others wanting to get users' phone numbers associated with more data they collect on them

Perhaps you mean SMS 2FA, instead of a non phone number related MFA such as T-OTP?

Re: When MFA isn't MFA, or how we got phished

#174

Post by Terretta »

codebje wrote: post #158
macNchz wrote: post #100

Beyond having hardware keys, this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information. It's always okay to say, "actually, let me get back to you in a minute" and hang up, calling back on a known phone number from the employee directory, or…

I've had a wide range of responses from people calling me when I tell them I won't give personal details out based on a cold call. A few understand immediately and are good about it. Most have absolutely no idea why I would even be bothered about an unexpected caller asking me for personal information. A few are practically hostile about it. None, to date, have worked for a company that has a process established for…

> None, to date, have worked for a company that has a process established for safely establishing identity of the person they're calling

What's fun here is, the moment they ask you for anything, flip the script and start to try to establish a trust identity for the caller.

Tell them you need to verify them, and then ask how they propose you do that.

Choose your own adventure from there.

Re: When MFA isn't MFA, or how we got phished

#175

Post by acegopher »

crabbone wrote: post #170

MFA is a scam resulting from Google first, and then others wanting to get users' phone numbers associated with more data they collect on them. It provides no tangible security benefits, creates a lot of headache for IT department, creates big gaps in developer's productivity (if used in a programming company) and, actually, creates a new attack vector (phones are lost or stolen a lot more often than any other means o…

I use 1Password's authenticator, so no-one needs my phone number, and I don't have to worry about losing my phone, as there is a Linux CLI, a browser extension, etc.

Re: When MFA isn't MFA, or how we got phished

#176

Post by [deleted] »

ketzo wrote: post #172
rmbyrro wrote: post #169

Earlier quoted context omitted.

> someone starts asking for information Especially OTP codes. I can't understand how someone works at a tech company and is clueless to the point of sharing an auth code over the phone. My grandma, sure, but a Retool employee? C'mon, haven't we all read enough of these stories?

You can't understand at all how someone with your coworker's voice might lull you into a false sense of urgency and safety? Security is a weak-link problem, not a strong-link one. You have to plan for the least security-minded people, the tired and stressed employee.

[deleted]

Re: When MFA isn't MFA, or how we got phished

#177

Post by tptacek »

We use OTPs extensively at Retool: it’s how we authenticate into Google and Okta, how we authenticate into our internal VPN, and how we authenticate into our own internal instances of Retool

They should stop using OTPs. OTPs are obsolete. For the past decade, the industry has been migrating from OTPs to phishing-proof authenticators: U2F, then WebAuthn, and now Passkeys†. The entire motivation for these new 2FA schemes is that OTPs are susceptible to phishing, and it is practically impossible to prevent phishing attacks with real user populations, even (as Google discovered with internal studies) with ultra-technical user bases.

TOTP is dead. SMS is whatever "past dead" is. Whatever your system of record is for authentication (Okta, Google, what have you), it needs to require phishing-resistant authentication.

I'm not high-horsing this; until recently, it would have been complicated to do something other than TOTP with our service as well (though not internally). My only concern is the present tense in this post about OTPs, and the diagnosis of the problem this post reached. The problem here isn't software custody of secrets. It's authenticators that only authenticate one way, from the user to the service. That's the problem hardware keys fixed, and you can fix that same problem in software.

† (All three are closely related, and an investment you made in U2F in 2014 would still be paying off today.)

Re: When MFA isn't MFA, or how we got phished

#178

Post by out-of-ideas »

> The caller claimed to be one of the members of the IT team, and deepfaked our employee’s actual voice. The voice was familiar with the floor plan of the office, coworkers, and internal processes of the company.

huh.. this raises way more questions than it answers; my first two are: - how did the voice of some random employee (in IT for that matter) get learned by outside the company (enough to be deepfaked (and i presume on the fly) for that matter)? Maybe we should record less conversations (looks at Teams, Discord, Zoom) - where there already leaks of 'internal processes'?

Re: When MFA isn't MFA, or how we got phished

#179

Post by rmbyrro »

ketzo wrote: post #172
rmbyrro wrote: post #169

Earlier quoted context omitted.

> someone starts asking for information Especially OTP codes. I can't understand how someone works at a tech company and is clueless to the point of sharing an auth code over the phone. My grandma, sure, but a Retool employee? C'mon, haven't we all read enough of these stories?

You can't understand at all how someone with your coworker's voice might lull you into a false sense of urgency and safety? Security is a weak-link problem, not a strong-link one. You have to plan for the least security-minded people, the tired and stressed employee.

I can understand how someone with my coworker's voice might lull myself into a false sense of urgency and safety.

To the point of sharing an OTP code over the phone from a strange number? I'm sorry, no.

Re: When MFA isn't MFA, or how we got phished

#180

Post by nanidin »

Terretta wrote: post #174
codebje wrote: post #158

Earlier quoted context omitted.

I've had a wide range of responses from people calling me when I tell them I won't give personal details out based on a cold call. A few understand immediately and are good about it. Most have absolutely no idea why I would even be bothered about an unexpected caller asking me for personal information. A few are practically hostile about it. None, to date, have worked for a company that has a process established for…

> None, to date, have worked for a company that has a process established for safely establishing identity of the person they're calling What's fun here is, the moment they ask you for anything, flip the script and start to try to establish a trust identity for the caller. Tell them you need to verify them, and then ask how they propose you do that. Choose your own adventure from there.

Credit card fraud departments are generally good about this.
Post reply on HN