Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When MFA isn't MFA, or how we got phished

retool.com

Post reply on HN
Print view View original

281–287 of 287 posts

Re: When MFA isn't MFA, or how we got phished

#281

Post by psd1 »

zamfi wrote: post #220
dataflow wrote: post #116

Earlier quoted context omitted.

> this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information. The trouble is, calling the number on the back of your card requires actually taking out your card, dialing it, wading through a million menus, and waiting who-knows-how-long for s…

I think the parent poster is arguing that we should normalize this behavior not that there's no excuse for not calling the number back given the reality we have today. You're saying it's natural for people not to want to call back and wade through a million menus, and I agree. But the conclusion from this is that companies should change their processes so that calling back is easy , precisely because otherwise people…

Unfortunately there's a dark incentive. Providing support costs money, but an automated phone menu does not (or at least, it's negligible). So you want to chuck your customers into hold music hell and winnow out as many as you can. This also makes your staff scheduling easier.

If your customers are captive, this is all upside. And most customers will tolerate this. The ones that do churn somehow don't generate blame for the psychopaths who implement this hostile practice, those bastards cut support costs and get promoted out.

Re: When MFA isn't MFA, or how we got phished

#282

Post by psd1 »

MaxBarraclough wrote: post #238
intrasight wrote: post #218

Earlier quoted context omitted.

I'm going to add to this that "hang up" means physically do that. I've heard that many are tricked by the attacker playing a "dial tone" sound into the phone and thus keeping the line open and "answering" when you thought you called you bank.

You may be right that some people are tricked into thinking the call has been terminated by the caller, when in fact the caller is playing a dial tone over the line. It's worse than that though. In some telephone systems, the call is not ended when the callee hangs up. https://security.stackexchange.com/questions/100268/does-han...

Yikes,although please note that BT reduced this time to 2s in 2015: https://www.bbc.co.uk/news/business-34714531

Re: When MFA isn't MFA, or how we got phished

#283

Post by mwarkentin »

solatic wrote: post #264
fragmede wrote: post #259

Earlier quoted context omitted.

The universe I'm in is the one where you have to staff the IT department and they have to support the device. The IT department costs way more than $21/month. You have a valid point that we need SaaS vendor support for SAML/whatever, but GitHub, specifically, supports SSO. Yeah, it costs money to get that feature, but security doesn't just happen. Security is expensive, but it's more expensive not to have it. In this…

I've personally worked for multiple startups where rolling out hardware keys did not require making additional IT hires (we're talking about companies smaller than ~50 people). Perhaps at BigCo size, you end up needing dedicated personnel to support a hardware key rollout at that scale, but at that scale you have the budget for GitHub Enterprise anyway so the point about pricing is moot; at BigCo size there is also e…

Yep, we just had a cabinet with a bunch of hardware keys for anyone to take.

Remote employees take a bit more support though.

Re: When MFA isn't MFA, or how we got phished

#284

Post by xorcist »

skeaker wrote: post #272
xorcist wrote: post #236

Earlier quoted context omitted.

Making a meme is nothing like an interactive telephone conversation. It's not that it's impossible, but it's not trivial either. But mainly, it's just unnecessary. If the user is not fooled by a well crafted phishing, by doing the most trivial countermeasures such as calling back, they are not going to be fooled by a deepfake. In practice work on phishing is mostly better spent elsewhere. So while we shouldn't dismis…

I suppose the disconnect then would be that we fundamentally disagree on what the simpler answer is. It's my understanding that a deepfake voice being used as part of a phishing scam is something that can be done trivially (or at least by a determined actor using free tools, so at least trivial enough for this case), so to me that would be the simplest, most obvious answer when compared to a company-wide conspiracy,…

Try it! The tools are publicly available. You might find that it's harder than you think. We are very sensitive for uncanny conversations. Analogue imitations and pitching the voice is much easier to work with.

However, my point is that none of that matters. After all, deepfakes are only going to get easier, so it is only a matter of time before it is as cheap as you describe. It is that imitating a voice have very little impact on the outcome of a phishing operation. Sure, it might not hurt, but other things affects the success of a scam. Don't rely on impersonating a voice, especially since a trivial callback completely defeats it, no matter how much resources you put into it.

Which is also why none of these recent media stories make sense. And when investigated, none of them has held up to scrutiny, precisely as expected. I have not done this myself but look out for follow up stories by respected bloggers and journalists.

Lots of people work with defending against these operations, and none of them spend any correctly identifying deepfakes for a reason. Don't believe my word, I am not in the business, but ask anyone who is if they find these details believable.

Re: When MFA isn't MFA, or how we got phished

#285

Post by hackeraccount »

xnx wrote: post #254
macNchz wrote: post #100

Beyond having hardware keys, this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information. It's always okay to say, "actually, let me get back to you in a minute" and hang up, calling back on a known phone number from the employee directory, or…

I've expanded this to the general case and don't answer phone calls.

I've stopped listening to people. I limit myself to talking at them. The upside is that I'm never fooled. The downside is that so far as I can tell half the world hates me and the other half think I'm a lunatic.

Re: When MFA isn't MFA, or how we got phished

#286

Post by dizhn »

acegopher wrote: post #175
crabbone wrote: post #170

MFA is a scam resulting from Google first, and then others wanting to get users' phone numbers associated with more data they collect on them. It provides no tangible security benefits, creates a lot of headache for IT department, creates big gaps in developer's productivity (if used in a programming company) and, actually, creates a new attack vector (phones are lost or stolen a lot more often than any other means o…

I use 1Password's authenticator, so no-one needs my phone number, and I don't have to worry about losing my phone, as there is a Linux CLI, a browser extension, etc.

Google repeatedly sends the 2fa to my phone even though I have an authenticator app set up for it. Even if I use the app, it still asks me to authenticate their own thing on my phone. So I just gave up and use that all the time now.

Re: When MFA isn't MFA, or how we got phished

#287

Post by snagg »

tptacek wrote: post #177

We use OTPs extensively at Retool: it’s how we authenticate into Google and Okta, how we authenticate into our internal VPN, and how we authenticate into our own internal instances of Retool They should stop using OTPs. OTPs are obsolete. For the past decade, the industry has been migrating from OTPs to phishing-proof authenticators: U2F, then WebAuthn, and now Passkeys†. The entire motivation for these new 2FA schem…

Worth noting that implementing FIDO2/Passkeys is more challenging than it looks both from a UX standpoint and from a threat modeling standpoint. We tried to cover some of this in a blog post, in case anybody is interested: https://www.slashid.dev/blog/passkeys-security-implementatio...
Post reply on HN