Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanks FedEx, this is why we keep getting phished

troyhunt.com

Post reply on HN
Print view View original

261–270 of 576 posts

Re: Thanks FedEx, this is why we keep getting phished

#261

Post by internet101010 »

meindnoch wrote: post #154
Thorrez wrote: post #136

Earlier quoted context omitted.

Is blocking the last 20 passwords a bad thing? I agree the other stuff is bad, but to me, that part doesn't seem bad.

Forced password updates are a bad thing. If your company does forced password updates, they are not following the NIST recommendation: https://pages.nist.gov/800-63-FAQ/#q-b05 If your company is not following the NIST recommendation, they are incompetent, and will be held liable in case of a breach.

Internal password resets are a bad thing. It has its place in document sharing/collaboration platforms not connected to AD as an additional layer of revoking access when people leave a company.

Re: Thanks FedEx, this is why we keep getting phished

#262

Post by pbackx »

I think this will be full of similar experiences: Some time ago my wife's cards suddenly got all kinds of charges, clearly not ours. So we call the bank and while they put the blame on us, among other things they said the bank never ever would contact us by SMS and we may have clicked on dodgy links in one of those messages.

Eventually they decide we should replace all our cards. 5 minutes later we get an SMS asking us to call an unknown number to set our PIN code for the new card. It contained at least 5 warning signs as in the author's article.

We call them back asking them what that SMS is about and the only explanation is "That is the good kind of SMS, you can trust it"

(Eventually we did get all stolen money back, but it took a while. We never got a plausible explanation of what may have happened and what we could do to prevent it in the future)

Re: Thanks FedEx, this is why we keep getting phished

#263

Post by ryandrake »

gjsman-1000 wrote: post #256
ryandrake wrote: post #253

Earlier quoted context omitted.

I can’t believe it’s 2024 and we are still seeing bugs with handling “special” characters. Unicode has been here for how long? Robust string handling is supported in every language. There is no such thing as a special character. My name should be able to contain Chinese characters. My password should be able to contain emojis. What is this Stone Age shit still running on companies’ backends?

Most companies don't like rewriting their code. If it ain't broke, don't fix. (Weird password issues don't count as broke.) There's no guarantee, after all, that the rewrite won't have major edge cases and mistakes of it's own. The upper layer might change now and then, to give a veneer of modernity. But just like Windows being built on 90s technology, the stuff underneath could be even more ancient.

A software that can't accept a % as part of your password is absolutely, positively broken--in any industry or application. In many companies, this would be a P0 "don't go home until it's fixed" production emergency if a bug like this crept in to the software. We need to stop excusing long-standing bugs in horrible legacy software just because they are long-standing.

Re: Thanks FedEx, this is why we keep getting phished

#264

Post by gjsman-1000 »

ryandrake wrote: post #263
gjsman-1000 wrote: post #256

Earlier quoted context omitted.

Most companies don't like rewriting their code. If it ain't broke, don't fix. (Weird password issues don't count as broke.) There's no guarantee, after all, that the rewrite won't have major edge cases and mistakes of it's own. The upper layer might change now and then, to give a veneer of modernity. But just like Windows being built on 90s technology, the stuff underneath could be even more ancient.

A software that can't accept a % as part of your password is absolutely, positively broken--in any industry or application. In many companies, this would be a P0 "don't go home until it's fixed" production emergency if a bug like this crept in to the software. We need to stop excusing long-standing bugs in horrible legacy software just because they are long-standing.

> In many companies, this would be a P0 "don't go home until it's fixed" production emergency if a bug like this crept in to the software.

Would it, really?

P0 would probably be "10% of our customers can't submit an order." Or "20% of our vendors are experiencing 404s."

Re: Thanks FedEx, this is why we keep getting phished

#265

Post by judge2020 »

dudul wrote: post #113
wccrawford wrote: post #35

When I bought a car once, I received an email a few months later saying I hadn't proven I had obtained insurance on it, and the bank wanted me to visit a domain that wasn't theirs to provide proof. The email I got looked like a badly-scanned letterhead and was very, very fishy. After I received a few of them, I finally contacted the bank and it was legit . I tried telling the office person (not just a clerk at the co…

Happened to me with my mortgage. Got this very weirdly phrased letter about how my homeowner insurance info needed to be updated/confirmed and that I had to go to to clear it out. I called my insurance broker and yes indeed it was legit. I also tried to explain to them how this letter was a few steps removed from a Nigerian prince scam based on all the red flags, but i don't think it made a big difference.

The national insurance providers are often pretty slow or shady when it comes to claims, but I've never had a bad experience with Allstate or State Farm when it comes to their cybersecurity and domain experience. Allstate's frontends (web and app) sometimes feel more clunky but their APIs feel good enough and sites seem to follow good design practices.

Re: Thanks FedEx, this is why we keep getting phished

#266

Post by aaronharnly »

lobochrome wrote: post #52
sebtron wrote: post #32

A few months ago I got an email from the IT center of the company I work for that was dodgier than any phishing email I have ever received: - Coming from a domain that looks nothing like the official domain of the company, rather some generic @itservice.com or something. - Subject: "URGENT: your account is expiring soon". - Multiple links provided in the email body, all illegible and multiple lines long, none of them…

Our IT did the exact same thing with expiring m365 passwords. They weren’t using the corp domain, typos all over and the URL was obscured using a bizarre link shortener. The same guys also force us to change our passwords every 6 months and block the last twenty. Passwords we have to enter in systems that can’t pull directly from password managers and thus have to type 10-20 per day. Guess the average strength of an…

My work password now has an "18" embedded somewhere in the middle of it thanks to my autoincrement approach to handling that kind of obnoxious policy.

Then I became CTO and retired the policy to align to modern NIST recommendations, so that "18" is in there forever :)

Re: Thanks FedEx, this is why we keep getting phished

#267

Post by bombcar »

philsnow wrote: post #118
bombcar wrote: post #89

Earlier quoted context omitted.

Healthcare companies in the US send the most scammy looking links for payment processing you’ve ever seen - things like my-healthcare-billing.net It’s insane.

I’m supposed to pay my semi-annual property taxes (on the order of ~thousands of USD) on a site that ends in .org instead of .gov, and nobody apparently sees anything weird or wrong with it.

Now that I think of it, I'm not sure I've ever seen a government payment site hosted on .gov; usually .com.

Re: Thanks FedEx, this is why we keep getting phished

#269

Post by evandale »

yau8edq12i wrote: post #38
Kwpolska wrote: post #33

Earlier quoted context omitted.

There's an EU law demanding such documents to be delivered on a "durable medium". Some banks and financial institutions may have a strange approach to those, even though email attachments seem to be enough for others.

I've never heard of this "EU law". Which one are you talking about? I live in the EU and my bank pretty much only contacts me through email.

If you've never heard of it why not Google "eu durable medium"? Looks like the claim is true and I didn't need to ask for a source to figure it out.

https://www.fca.org.uk/firms/durable-medium

https://www.lexology.com/library/detail.aspx?g=788714a1-d7b6...

Re: Thanks FedEx, this is why we keep getting phished

#270

Post by bombcar »

__float wrote: post #220
bonton89 wrote: post #192

Earlier quoted context omitted.

Lets not forget all the typosquatting looking domains Microsoft uses. It almost seems like they bought them up to protect users, forgot why they did that and said "hey we have all these domains, lets use those?"

Do you have any examples? I'm largely out of the Microsoft ecosystem these days, aside from the occasional Xbox usage.

Office.com redirects you to login.microsoftonline.com which isn't horribly bad, but is starting to get there. Now you have microsoft365.com and friends, too.

At least when things were login.microsoft.com you could apply the "last part is definitive" now that heuristic is pretty useless. And if you watch the actual DNS requests during a login, whew.

CDNs make it even worse, here's a few VALID requests from my DNS cache:

store-images.s-microsoft.com-c.edgekey.net

www.msftconnecttest.com

123499-ipv4v6.farm.dprodmgd103.aa-rt.sharepoint.com

download.windowsupdate.com.edgesuite.net

At least some end in apparently legitimate domains, but sheesh, that last one looks like something straight out of 2000s era scams.

Post reply on HN