Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cosmo, the God who fell to Earth

wired.com

Post reply on HN
Print view View original

31–40 of 42 posts

Re: Cosmo, the God who fell to Earth

#31

Post by firefoxman1 »

mahyarm wrote: post #28
firefoxman1 wrote: post #24

Earlier quoted context omitted.

I bought a Palm Pre2 last year on ebay and had to go into an AT&T store to activate it. The person helping me had a little trouble activating it, so he called AT&T support and got help so quickly without being asked stupid questions, I've been using his technique ever since. Whenever I call tech support of a company that has physical locations, I always start with: "Hello, my name is Kevin, I'm an associate with [com…

What do you do when they ask you access the intranet at the terminal that is obviously right infront of you?

Lol that would be a bit of a dilemma. Haven't encountered that yet.

Re: Cosmo, the God who fell to Earth

#32

Post by anonymous »

marquis wrote: post #3

It's interesting to me how easy it is for some people to circumvent their ethics. This kid is intelligent enough to know what he's done is unethical but I've never been a teenage boy so I consider what would come with that feeling of discovering a sweet hack: a desire to use that knowledge to assert power above all costs.

It appears the guy he hacked was not chosen at random. So why was he chosen?

If you start something like Project Honeypot and then Cloudflare does that suggest you want to play "good guys, bad guys"? It's very subjective stuff. Is that sort of "business model" inviting trouble?

Not to imply there are no "bad guys" on the web - of course there are - but who would want to play with them?

"Good guys?"

The social engineering stuff is disturbing. It makes you not want to sign up for anything online, not even web mail.

But when you run websites that purport to label internet users as "good" or "bad" based on spurious evidence and numerous inferences, are you not opening yourself up to even more attention from "bad guys"?

Is it possible to run an internet business without messing around with these types of characters?

Honest question.

As for your question, marquis, I think it's simple psychology: If you go online and assert "You can't hack me" or "Our system is hack-proof" to an audience that includes people like the teenager in the story, then it's perceived as a challenge. And as we continue to see, both of those assertions continue to be false. The Wired stories always follow the same plot: In the end, the teenager is arrested, but the damage has already been done.

Re: Cosmo, the God who fell to Earth

#33

Post by rsingel »

aidenn0 wrote: post #29
Shank wrote: post #25

Earlier quoted context omitted.

The device doesn't need to be internet connected if you use the app. An iPod Touch does the job just as well as SMS, though you need to make sure the times are synchronized.

Still doesn't answer my question. It won't let me turn on 2FA without giving them a phone # that can be used (SMS or voice) to authenticate, which means anyone that can redirect my phone or capture my SMS messages (both fairly trivial in a targeted attack) can bypass 2FA.

Even if they could duplicate the SMS at that moment, you would still be protected if you use the app.

Re: Cosmo, the God who fell to Earth

#34

Post by ktizo »

jared314 wrote: post #22
ktizo wrote: post #14

The trouble is that normal operations are often indistinguishable from social engineering. I have worked several places where I have been told by management that something needs fixed on a web server, but they can't remember any passwords, so could I call up their ISP and just get it sorted. In these situations, I have never had to prove anything I couldn't have faked and I usually get asked to provide an email addre…

"Your security is based on the kindness, and apathy, of strangers." I repeat that warning to anyone who has become just computer-savvy enough to use a computer as well as they drive their car. The tinfoil-hat jokes have tapered off, over the years, with the mainstream news coverage of stolen user information.

I like that paraphrase, mind if I nick it?

Re: Cosmo, the God who fell to Earth

#35

Post by ktizo »

firefoxman1 wrote: post #31
mahyarm wrote: post #28

Earlier quoted context omitted.

What do you do when they ask you access the intranet at the terminal that is obviously right infront of you?

Lol that would be a bit of a dilemma. Haven't encountered that yet.

Tell them the screen broke.

Re: Cosmo, the God who fell to Earth

#36

Post by galadriel »

aidenn0 wrote: post #29
Shank wrote: post #25

Earlier quoted context omitted.

The device doesn't need to be internet connected if you use the app. An iPod Touch does the job just as well as SMS, though you need to make sure the times are synchronized.

Still doesn't answer my question. It won't let me turn on 2FA without giving them a phone # that can be used (SMS or voice) to authenticate, which means anyone that can redirect my phone or capture my SMS messages (both fairly trivial in a targeted attack) can bypass 2FA.

You have to just do that once to activate 2FA. Once activated, switch to mobile app. No one can turn it off without having code and password later. (apart from finding some flaw in system)

Re: Cosmo, the God who fell to Earth

#37

Post by jurjenh »

jared314 wrote: post #22
ktizo wrote: post #14

The trouble is that normal operations are often indistinguishable from social engineering. I have worked several places where I have been told by management that something needs fixed on a web server, but they can't remember any passwords, so could I call up their ISP and just get it sorted. In these situations, I have never had to prove anything I couldn't have faked and I usually get asked to provide an email addre…

"Your security is based on the kindness, and apathy, of strangers." I repeat that warning to anyone who has become just computer-savvy enough to use a computer as well as they drive their car. The tinfoil-hat jokes have tapered off, over the years, with the mainstream news coverage of stolen user information.

Just had a reminder of that this morning... Was doing a bit of routine maintenance on the server at work when I noticed repeated ssh login attempts appearing in the system logs... with usernames that clearly don't exist. Tracing the source ip address sent me to Beijing somewhere, so someone there was trying a port scan and random ssh login attempts.

I've never really looked for this kind of interaction before, and I wonder just how common it is these days - but I'd say that you can now pretty much guarantee that it will happen at some stage, and you'd better hope your security is up to the task.

Re: Cosmo, the God who fell to Earth

#39

Post by ceph_ »

Shank wrote: post #25
aidenn0 wrote: post #11

Reading this reminds me of a gripe I have; is it possible to use 2-factor authentication on gmail without a phone? You can print a list of OTPs but you can't enable it without also registering a phone number. Given how easy it is to intercept voice and SMS, that seems like a huge security hole.

The device doesn't need to be internet connected if you use the app. An iPod Touch does the job just as well as SMS, though you need to make sure the times are synchronized.

It's counter based, not time.

Re: Cosmo, the God who fell to Earth

#40

Post by nitrogen »

jurjenh wrote: post #37
jared314 wrote: post #22

Earlier quoted context omitted.

"Your security is based on the kindness, and apathy, of strangers." I repeat that warning to anyone who has become just computer-savvy enough to use a computer as well as they drive their car. The tinfoil-hat jokes have tapered off, over the years, with the mainstream news coverage of stolen user information.

Just had a reminder of that this morning... Was doing a bit of routine maintenance on the server at work when I noticed repeated ssh login attempts appearing in the system logs... with usernames that clearly don't exist. Tracing the source ip address sent me to Beijing somewhere, so someone there was trying a port scan and random ssh login attempts. I've never really looked for this kind of interaction before, and I…

It even happens if you just open port 22 on your home router. You can use things like fail2ban to put a short-term ban on offending addresses, and put your ssh server on a random (i.e. not 2222) high numbered port to reduce automated scans.
Post reply on HN