Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kurt Got Got

fly.io

Post reply on HN
Print view View original

171–180 of 256 posts

Re: Kurt Got Got

#171

Post by eru »

mr_mitm wrote: post #166
Amorymeltzer wrote: post #111

Earlier quoted context omitted.

>they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on it and get p0wned. One of my favorite quotes is from an unnamed architect of the plan in a 2012 article about Stuxnet/the cyber attacks on Iran's nuclear program: "It turns out there is always an idiot around who doesn't think much about the thumb drive in their…

I don't think we should be calling the users idiots when we failed to make our systems secure by design. If a simple act like plugging in a thumb drive by a well-meaning user undermines the security of an entire operation, then why do we allow such a thing to happen? Relevant: https://www.schneier.com/blog/archives/2016/10/security_desi...

Yes. People used to laugh at the auto-play for CD-ROMs in Windows 95. But if a USB device can hijack your system, is it that different?

Re: Kurt Got Got

#172

Post by eru »

taneq wrote: post #160
solid_fuel wrote: post #117

Earlier quoted context omitted.

At a previous position, I had a rather strained relationship with the IT department - they were very slow to fill requests and maintained an extremely locked down windows server that we were supposed to develop for. It wasn't the worse environment, but the constant red tape was pretty frustrating. I got got when they sent out a phishing test email disguised as a survey of user satisfaction with the IT department. Hon…

TBH this is probably the best argument for actually conducting phishing pentests. It shuts up the technical users who think they're too smart to need the handrails and safety nets that the IT department set up for the rest of the average plebs who work there. (Speaking as one of the technical users here. Of course, it wouldn't happen to ME! :P )

If you never read your emails, it's hard for them to get you with phishing emails.

Re: Kurt Got Got

#173

Post by lmm »

tsimionescu wrote: post #137
bee_rider wrote: post #112

Earlier quoted context omitted.

I don’t disagree. But, haven’t there been bugs where operating systems will auto run some executable as soon as the USB is plugged in? So, just to be paranoid, I’d classify just plugging the thing in as “running random executables.” At least as a non-security guy. I wonder if anyone has tried going to a local staples or bestbuy something, and slipping the person at the register a bribe… “if anyone from so-and-so corp…

Even if the OS doesn't have any bad security practices and doesn't do this, there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal. As long as the computer is unlocked, this will work, and will easily get full local user access, even defeating UAT or similar measures. It can then make itself persistent by "typing in" a mal…

> there is a very simple way to execute code from an USB stick: the USB stick pretends it's a USB keyboard and starts sending input to access a terminal

Good systems these days won't accept such a "keyboard" until it's approved by the user.

Re: Kurt Got Got

#174

Post by tialaramex »

mr_mitm wrote: post #167
tialaramex wrote: post #94

Earlier quoted context omitted.

If you're getting pwned a physical Security Key still means bad guys don't have the actual credential (there's no way to get that), and they have to work relatively hard to even create a situation where maybe you to let them use the credential you do have (inside the Security Key) while they're in position to exploit you. These devices want a physical interaction (this is called "User present") for most operations, t…

All your 2FA apps, token, security keys, certificates and what not only protect the authentication (and in the case of online banking, a few other actions like transferring money). After that, a single bearer token authenticates each request. If your endpoint is compromised, the attackers will simply steal the bearer token after you authenticate.

That's true, but in terms of system design you definitely should ask to see the proof of identity again during unusual transactions and not just that bearer token - for example attempts to add or remove 2FA should need that extra step, as well as say high value financial transactions or irreversible system changes.

Re: Kurt Got Got

#175

Post by [deleted] »

vhcr wrote: post #149
kalleboo wrote: post #123

Earlier quoted context omitted.

It's far too common for websites to redirect to some separate domain for sign in which isn't the one originally used to sign up, getting users used to "oh gotta copy the password again" as a totally normal thing that happens

That should only happen once, you should store the password for the second domain too.

[deleted]

Re: Kurt Got Got

#177

Post by throw-10-8 »

latchkey wrote: post #66
OkayPhysicist wrote: post #60

Earlier quoted context omitted.

No, that's the opposite of the moral of that story. If the person you responded to had listened to the fact that the auto-enter didn't auto-enter, they wouldn't have been at any risk. Likewise in the article, the problem was that the CEO copy-pasted the password into the phishing page's password field, NOT that the auto-enter prompted him to do so.

As I mention below: Autofill doesn't always work for every site. So, now you're having to store in your mind where it works and where it doesn't. By disabling it, it forces you to go the extra step (command-shift-L) every time.

Hide Sidebar?

Honestly it sounds like you are missing the point while simultaneously using a bad password manager.

Re: Kurt Got Got

#178

Post by rm445 »

amenghra wrote: post #57
bradgessler wrote: post #13

When we did annual pen testing audits for my last company, the security audit company always offered to do phishing or social engineering attacks, but advised against it because they said it worked every single time. One of the most memorable things they shared is they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on…

If you are getting powned by running random executables found on usb drives, passkeys aren’t going to save you. Same if the social engineering is going to get you to install random executables.

I think the claim is that plugging in the USB device is enough. If people needed to try running an executable from the device, some devices would still be compromised, but with lower frequency. I don't know exactly what happens. Automatically-triggered 'driver' install that is actually malware? Presenting as a keyboard and typing commands? Low-level cracks in the OS USB stack?

It feels to me more like OSes ought to be more secure. But USB devices are extremely convenient.

Re: Kurt Got Got

#179

Post by vintagedave »

dyauspitr wrote: post #127
ezfe wrote: post #115

Earlier quoted context omitted.

They didn't...?

The first line of this article is talking about the $FLY token

I think it's a security token: https://fly.io/blog/macaroons-escalated-quickly/

And calling it $FLY like a crypto thing is part of the joke.

Re: Kurt Got Got

#180

Post by breakingcups »

tptacek wrote: post #7

I want to say again that the key thing in this post is that anything "serious" at Fly.io couldn't have gotten phished: your SSO login won't work if you don't have mandatory phish-resistant 2FA set up for it. What went wrong here is that Twitter wasn't behind that perimeter, because, well, we have trouble taking Twitter seriously. We shouldn't have, and we do take it seriously now.

I will say that a "Critical Security Vulnerability in flyctl, update now: https://bad-link/to/update.zip" tweet will have very serious consequences for a portion of your userbase, despite not directly compromising your own infra.
Post reply on HN