Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kurt Got Got

fly.io

Post reply on HN
Print view View original

211–220 of 256 posts

Re: Kurt Got Got

#211

Post by zahlman »

roblabla wrote: post #58
dilyevsky wrote: post #38

Earlier quoted context omitted.

The stray USB stick is how Stuxnet allegedly got deployed. Tbh I doubt that works in this day and age.

A USB can pretend to be just about any type of device to get the appropriate driver installed and loaded. They can then send malformed packets to that driver to trigger some vulnerability and take over the system. There are a _lot_ of drivers for devices on a default windows install. There are a _lot more_ if you allow for Windows Update to install drivers for devices (which it does by default). I would not trust all…

Do people still commonly use USB for removable storage? I kinda assumed it was all SD/microSD now.

Re: Kurt Got Got

#212

Post by tptacek »

parliament32 wrote: post #205
tptacek wrote: post #14

Earlier quoted context omitted.

We don't like TOTP, at all, for reasons even more obvious now, but our standard answer for advanced MFA has been OIDC, which is what most people should do rather than setting up bespoke U2F/FIDO2/Passkeys. We will get to this though. https://fly.io/blog/tokenized-tokens/

That would be great, but > Fly.io supports Google and GitHub as Identity Providers[1] How about you just support SAML like a real enterprise vendor, so IdP-specific support isn't your problem anymore? I get it, SAML is hard, but it's really the One True Path when it comes to this stuff. [1] https://fly.io/docs/security/sso/

SAML is awful, maybe the worst cryptographic protocol ever devised, and we won't implement it unless we absolutely have to. OIDC is the future.

I'm not exaggerating; you can use the search bar and find longer comments from me on SAML and XMLDSIG. You might just as well ask when we're going to implement DNSSEC.

Re: Kurt Got Got

#213

Post by ctennis1 »

KingOfCoders wrote: post #146

Phishing training does not work. "Understanding the Efficacy of Phishing Training in Practice" https://arianamirian.com/docs/ieee-25.pdf

Maybe not - but I work in a regulated industry, we had an employee get phished a few years ago, and the regulatory bodies wanted detailed records of all phishing testing and training conducted for the previous 5 years. So for some of us it's a necessary evil.

Re: Kurt Got Got

#214

Post by bc569a80a344f9c »

DamnInteresting wrote: post #210
bradgessler wrote: post #13

When we did annual pen testing audits for my last company, the security audit company always offered to do phishing or social engineering attacks, but advised against it because they said it worked every single time. One of the most memorable things they shared is they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on…

Last year I got a phishing email at my work address, and it was more convincing than most. I knew it was phishing, but it might have fooled me if I'd been less attentive. When I see these sophisticated phishing messages I like to click through and check out how well-made the phishing site itself is, sometimes I fill their form with bogus info to waste their time. So I opened the link in a sandboxed window, looked aro…

I think it's fair to put more (or, maybe, less) nuance on that. Zero-days against browsers exist, zero-days against plugins installed via MDM exist. Sure, you didn't actually submit any credentials, but cybersecurity training and phishing simulations have to target a lowest common denominator: people shouldn't click on links in shady emails. Sometimes just the act of clicking is bad enough. So that's what they base assigning training or a pass/fail on: whether you accessed the pretend TA site, and not whether you hit a submit button there.

For what it's worth, all vendors I've worked with in that space report on both. I'm pretty sure even o365's built-in (and rather crude) tool reports both on "clicked link" and "submitted credentials". I'd estimate it's more likely your employer was able to tell the difference, but didn't both differentiating between the two when assigning follow-up training because just clicking is bad enough.

Re: Kurt Got Got

#215

Post by zahlman »

sergiotapia wrote: post #65
otterley wrote: post #47

Earlier quoted context omitted.

Precisely. 1Password's browser integration would have noticed a domain mismatch and refused to autofill the password -- but in a panic, Kurt apparently opened 1Password and then copied/pasted the credentials manually.

This is how they got my Steam account credentials, although I realized the stupid shit I did the second I clicked submit form, and reset my password to random 32 characters using bitwarden. Me! Someone who is deeply technical AND paranoid. The key here is the hacker must create the most incisive, scary email that will short circuit your higher brain functions and get you to log in. I should have realized the fact tha…

> The key here is the hacker must create the most incisive, scary email that will short circuit your higher brain functions and get you to log in.

... and specifically by using the link in the email, yes?

Re: Kurt Got Got

#216

Post by zahlman »

tptacek wrote: post #199
breakingcups wrote: post #180

Earlier quoted context omitted.

I will say that a "Critical Security Vulnerability in flyctl, update now: https://bad-link/to/update.zip" tweet will have very serious consequences for a portion of your userbase, despite not directly compromising your own infra.

You could do that yourself today by getting a blue-checked @realFlyDotIo. But there's a paragraph in the article about this, and we know what we would have done had there been any signs of direct attacks on our users.

> You could do that yourself today by getting a blue-checked @realFlyDotIo

Wouldn't that also require convincing your customers to follow that account?

Re: Kurt Got Got

#217

Post by tsimionescu »

windward wrote: post #187
tsimionescu wrote: post #184

Earlier quoted context omitted.

Which systems ask before allowing you to use a keyboard you just plugged in over USB? Windows, Ubuntu, Fedora certainly don't, at least not by default.

I've only seen it on Macs

Out of curiosity, how does that work if this is the only input method connected? Or is this only shown if you have another keyboard (and/or mouse) already connected.

Re: Kurt Got Got

#218

Post by latchkey »

throw-10-8 wrote: post #177
latchkey wrote: post #66

Earlier quoted context omitted.

As I mention below: Autofill doesn't always work for every site. So, now you're having to store in your mind where it works and where it doesn't. By disabling it, it forces you to go the extra step (command-shift-L) every time.

Hide Sidebar? Honestly it sounds like you are missing the point while simultaneously using a bad password manager.

That isn't hide sidebar and I use a common PM.

Re: Kurt Got Got

#220

Post by darthwalsh »

stavros wrote: post #36
dilyevsky wrote: post #31

Earlier quoted context omitted.

So what happened exactly? Did Kurt enter his twitter password manually after clicking on that phishing link? Did he not get his sus detector going off after the password manager didn't suggest the password?

That happened to me as well, I put it down to "fucking password manager, it's broken again". For example, BitWarden has spent the past month refusing to auto fill fields for me. Bugs are really not uncommon at all, I'd think my password manager is broken before I thought I'm getting phished (which is exactly how they get you).

The ability to autofill by domain is a critical function of a password manager. It sounds like this tool is performing a lot worse than your browser's built-in password manager -- maybe that's enough to encourage a switch?
Post reply on HN