How the Syrian Electronic Army Hacked The Onion • Hacker News Board

Re: How the Syrian Electronic Army Hacked The Onion

#21

Post by jrochkind1 » Wed, May 08, 2013, 10:07 PM UTC

An interesting story.

> The email addresses for your twitter accounts should be on a system that is isolated from your organization’s normal email. This will make your Twitter accounts virtually invulnerable to phishing (providing that you’re using unique, strong passwords for every account).

That doesn't make a lot of sense. Sure, now your twitter account is somewhat protected against phishing (I think 'invulernable' is a bit too confident, even with 'virtually' added as qualifier).

But what about any other possible account? So now you say every single other possible account related to your business should be associated with an email address isolated from normal email, to protect them from phishing. Right?

Okay, so what makes is the 'normal email' again? You've just decided to split all your email amongst as many disparate systems as possible, to protect against phishing... which I guess it sort of does, but at cost of so much confusion that you've probably opened yourself up to something else.

Unless twitter alone is so high value to protect in this way?

Or am I missing something?

Re: How the Syrian Electronic Army Hacked The Onion

#22

Post by shloime » Wed, May 08, 2013, 10:08 PM UTC

mjn wrote: post #12

Google requiring you to enter your password at random times for random things (e.g. to read a Google Groups message) seems like one contributing factor, since people treat those prompts as routine noise, and are less likely to investigate such a common occurrence too deeply.

I agree with this point. I retype my user information, even while logged in, at least a few times a week.

Re: How the Syrian Electronic Army Hacked The Onion

#23

Post by [deleted] » Wed, May 08, 2013, 10:11 PM UTC

RegEx wrote: post #15

ben1040 wrote: post #2

One more reason to use 2FA on your Google Apps account.

2FA is great, but it wouldn't save you here if you ask it to remember you for 30 days.

[deleted]

Re: How the Syrian Electronic Army Hacked The Onion

#24

Post by mentat » Wed, May 08, 2013, 10:13 PM UTC

shloime wrote: post #22

mjn wrote: post #12

Google requiring you to enter your password at random times for random things (e.g. to read a Google Groups message) seems like one contributing factor, since people treat those prompts as routine noise, and are less likely to investigate such a common occurrence too deeply.

I agree with this point. I retype my user information, even while logged in, at least a few times a week.

That's odd because I never do. I'm using two-factor and I only have to retype login information when that expires (approximately 30 days I believe.) Also, someone did phish my Google cookies and Google immediately shutdown my account and made me type in something from a text to reactivate my account. Overall I'm pretty happy with both of those circumstances.

Re: How the Syrian Electronic Army Hacked The Onion

#25

Post by ihsw » Wed, May 08, 2013, 10:16 PM UTC

RegEx wrote: post #15

ben1040 wrote: post #2

One more reason to use 2FA on your Google Apps account.

2FA is great, but it wouldn't save you here if you ask it to remember you for 30 days.

That feature is limited to the device you told it to 'remember' you on.

Re: How the Syrian Electronic Army Hacked The Onion

#26

Post by kcorbitt » Wed, May 08, 2013, 10:17 PM UTC

I got several paragraphs into this writeup before I realized it wasn't just an Onion spoof of the once-a-day "anatomy of a hack" articles that come through here. :P

Re: How the Syrian Electronic Army Hacked The Onion

#27

Post by wyck » Wed, May 08, 2013, 10:18 PM UTC

I thought it would be something interesting given the title..nope just something you see in your email everyday .. Maybe the Onion's next move should be to invest with a Nigerian prince.

I will forward this post to my grandfather with "Don’t let this happen to you" in bold.

/onion

Re: How the Syrian Electronic Army Hacked The Onion

#28

Post by DigitalJack » Wed, May 08, 2013, 10:21 PM UTC

This is almost verbatim to the spear phishing email that allowed the AP twitter account to be compromised.

http://jimromenesko.com/2013/04/23/ap-warned-staffers-just-b...

Re: How the Syrian Electronic Army Hacked The Onion

#29

Post by DigitalJack » Wed, May 08, 2013, 10:24 PM UTC

wyck wrote: post #27

I thought it would be something interesting given the title..nope just something you see in your email everyday .. Maybe the Onion's next move should be to invest with a Nigerian prince. I will forward this post to my grandfather with "Don’t let this happen to you" in bold. /onion

When an email looks like it came from someone you know, and says something like:

"hey, check this out: http://blah.com "

and has their name at the bottom, it becomes very easy to make a mistake.

Re: How the Syrian Electronic Army Hacked The Onion

#30

Post by plorkyeran » Wed, May 08, 2013, 10:25 PM UTC

danielweber wrote: post #14

pserwylo wrote: post #9

I often think about creating a browser and email plugin/extension to help with this: - Look at all link tags. - If it looks like a URL (has a scheme at the beginning, or something which resembles a hostname, or a bunch of path or query parameters), inspect the actual link. - If they have different hosts, warn the user, and perhaps give them the option of just visiting what the contents of the link tag say (rather tha…

My brain is a bit fried, but what about a rule that "if the text contained in the tag is a FQDN, it should match the FQDN in the href exactly"? What are the false positives?

Things like Google results that go through a redirector for click tracking.