Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When MFA isn't MFA, or how we got phished

retool.com

Post reply on HN
Print view View original

181–190 of 287 posts

Re: When MFA isn't MFA, or how we got phished

#181

Post by odux »

crabbone wrote: post #170

MFA is a scam resulting from Google first, and then others wanting to get users' phone numbers associated with more data they collect on them. It provides no tangible security benefits, creates a lot of headache for IT department, creates big gaps in developer's productivity (if used in a programming company) and, actually, creates a new attack vector (phones are lost or stolen a lot more often than any other means o…

Wait, what? MFA - multi factor authentication- has existed long before Google was founded. RSA Securid tokens were introduced in the 1980s or so.

MFA is a easy and good way to prevent hostile account takeovers. Especially with the amount of data breaches, one time passwords are way more secure than memorized “static” passwords.

SMS based two factor is the one Google pushed. Even Google recommends other ways of MFA these days (using hardware like YubiKey or apps like Authy).

Public’s phone numbers are not that valuable for a company like Google . Until very recently they were listed in phone books publicly available.

Re: When MFA isn't MFA, or how we got phished

#182

Post by lxgr »

macNchz wrote: post #100

Beyond having hardware keys, this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information. It's always okay to say, "actually, let me get back to you in a minute" and hang up, calling back on a known phone number from the employee directory, or…

> someone from your credit card company is calling and asking for something? Call back on the number on the back of your card.

This recently happened to me, and bizarrely they wouldn’t tell me what’s actually going on on my account because of not being able to verify me. (They were also immediately asking for personal information on the outbound call, which apparently really was from them.)

Re: When MFA isn't MFA, or how we got phished

#183

Post by hooverd »

yesimahuman wrote: post #58
hn_throwaway_99 wrote: post #38

Earlier quoted context omitted.

> Very sophisticated attack, I would bet most people would fall for this. No. If you think people at your company would fall for this, then IMO you have bad security training. The simple mantra of "Hang up, lookup, call back" ( https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... ) would have prevented this. Literally like 99% of social engineering attacks would be prevented this way. Seriously, make a lit…

This fails to satisfy one of the core lessons here: trust nothing, not even your own training and culture.

Especially not the information security team. They're the most likely to be compromised.

Re: When MFA isn't MFA, or how we got phished

#184

Post by polygamous_bat »

lxgr wrote: post #182
macNchz wrote: post #100

Beyond having hardware keys, this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information. It's always okay to say, "actually, let me get back to you in a minute" and hang up, calling back on a known phone number from the employee directory, or…

> someone from your credit card company is calling and asking for something? Call back on the number on the back of your card. This recently happened to me, and bizarrely they wouldn’t tell me what’s actually going on on my account because of not being able to verify me. (They were also immediately asking for personal information on the outbound call, which apparently really was from them.)

That's the big problem, isn't it? People think it's okay to give out information on an incoming call because often it is really okay. If it were unreliable 99% of the time, phishers would not use this method as an attack vector.

Re: When MFA isn't MFA, or how we got phished

#185

Post by rawgabbit »

e12e wrote: post #166
kerblang wrote: post #30

Earlier quoted context omitted.

Do all these 2FA apps - like say Microsoft Authenticator - have these hidden/not-so-hidden private keys? From other posts it sounds like you can view the token and write it down... MA doesn't have that, I don't think.

TOTP (Time-based one-time password) need a shared secret (and two synchronized clocks) to work, so yes. FIDO2/WebAuthn relies on public key technology - so does also have a secret key - but is designed to be kept secret from the service/server one authenticates against. For use - FIDO2 is more like a multi-use id. Like a driver's license many services accept as id. If you lose it - you don't restore a backup copy fro…

Which FIDO2 service do you recommend?

I get tired reading all these security articles. The more I read, the more I feel they are hiding something.

Re: When MFA isn't MFA, or how we got phished

#186

Post by Izkata »

boblob-law wrote: post #140

Am I the only one questioning the deep fake of the voice?

If they have an audio recording of the person, there's a bunch of sites where you can create them on the fly for free. Don't know about the quality, though I imagine distortion can be dismissed as being from the phone rather than the fake.

Re: When MFA isn't MFA, or how we got phished

#187

Post by OJFord »

lxgr wrote: post #182
macNchz wrote: post #100

Beyond having hardware keys, this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information. It's always okay to say, "actually, let me get back to you in a minute" and hang up, calling back on a known phone number from the employee directory, or…

> someone from your credit card company is calling and asking for something? Call back on the number on the back of your card. This recently happened to me, and bizarrely they wouldn’t tell me what’s actually going on on my account because of not being able to verify me. (They were also immediately asking for personal information on the outbound call, which apparently really was from them.)

Financial companies, the government, ... I always try to bother to raise the issue afterwards, but (not that I think my comments alone would do anything) so far nothing changed that I've taken issue with, I don't think.

A big one I'm aware of many others complaining about in the industry is local governments in the UK soliciting elector details via 'householdresponse.com/' in a completely indistinguishable from phishing sort of way.

(They send you a single letter directing you to that address with 'security code part 1' and '2' in the same letter, along with inherently your postcode which is the only other identifier requested. It's an awful combination of security theatre and miseducation that scammy phishing techniques look legit.)

Re: When MFA isn't MFA, or how we got phished

#188

Post by glandium »

burkaman wrote: post #35
AshamedCaptain wrote: post #14

Earlier quoted context omitted.

For me the question is "who the fsck uses Google Authenticator to store all their tokens, both company and personal?"

Google Authenticator was I believe the first available TOTP app, and is by far the most popular. It used to be open source and have no connection to your Google account. Many people installed it years ago when they first set up MFA, and have just been adding stuff to it ever since because it's easy and it works. Even for technical users who understand how TOTP works, there is no obvious reason it appears unsafe to pu…

Also, since it doesn't allow to extract the private keys, you're kind of stuck with it once you've started using it.

Re: When MFA isn't MFA, or how we got phished

#189

Post by ianhawes »

dvdhsu wrote: post #147
hnburnsy wrote: post #135

Earlier quoted context omitted.

Thanks for all this insight, this is why HN rules. What is your impression of law enforcement, everyone claims to reach out after an attack, but I've never seen follow up of sucessful law enforcement activity resulting in arrests or prosecution. Thanks again.

(May also have to delete this later, but...) Law enforcement is currently attempting to ascertain whether or not the actor is within the US. If it's within the US, I (personally) believe there's a good chance they'll take the case on and presumably with enough digging, will find the attacker. (The people involved seem to be... pretty good.) But if they're outside US (which is actually reasonably high probability, giv…

FWIW engaging simultaneously with both the FBI and the USAO/DOJ and putting pressure on DOJ to act on the case typically results in better outcomes than just assuming the SA assigned is going to follow through and bugging them about it.

Re: When MFA isn't MFA, or how we got phished

#190

Post by ianhawes »

oldtownroad wrote: post #161
dvdhsu wrote: post #89

Earlier quoted context omitted.

Hi, David, founder @ Retool here. We are currently working with law enforcement, and we believe they have corroborating evidence through audio that suggests a deepfake is likely. (Put another way, law enforcement has more evidence than just the employee's testimony.) (I wish we could blog about this one day... maybe in a few decades, hah. Learning more about the government's surveillance capabilities has been interes…

> …we believe they have corroborating evidence through audio that suggests a deepfake is likely… Does that mean they have audio of the call?

Most attacks like this use stolen credentials for VOIP providers, i.e. Twilio. It's likely the FBI quickly obtained a subpoena which produced a recording. The attacker may not have known the call was being recorded.
Post reply on HN