Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanks FedEx, this is why we keep getting phished

troyhunt.com

Post reply on HN
Print view View original

351–360 of 576 posts

Re: Thanks FedEx, this is why we keep getting phished

#351

Post by krisoft »

gjsman-1000 wrote: post #284
ryandrake wrote: post #274

Earlier quoted context omitted.

If 10% of customers have passwords that now can't log in and submit orders, that would be an emergency. We're taking OP's word for it that FedEx doesn't allow certain characters as passwords (actually, from the description, it seems more like FedEx only allows specific characters which is even worse). If either of those are true, it is most certainly a defect. Whether FedEx treats that defect as an emergency is up to…

> You originally said "Weird password issues don't count as broke." I think this might just be a case where we have to "agree to disagree". I meant broke in the sense of "if it ain't broke, don't fix." If there are over 300 microservices running code, connected to mainframes running code that was originally from the 80s, but they occasionally have password issues - the risks caused by trying to fix it might be greate…

> If there are over 300 microservices running code, connected to mainframes running code that was originally from the 80s, but they occasionally have password issues

And we ended up where the thread originally begin "FedEx may have the worst and least secure digital platform for a major company."

Besides that is horrible! There should be 1 microservice which deals with passwords, the authentication one. Everything else should just get a token attesting that the user is authenticated (or not).

Re: Thanks FedEx, this is why we keep getting phished

#352

Post by 0xbadcafebee »

hn_throwaway_99 wrote: post #289

Wow, I thought this was a great post, and I'm just dumbfounded about how egregiously bad that first SMS was - FedEx might as well tell the recipient they want to customs duties wired to a Nigerian prince. But I also disagree with the general push of Troy Hunt's recommendations. That is, we should just take the base assumption that humans, generally, can't distinguish between real and phishing inbound messages. That's…

> That's only going to become more true with AI.

It can't become any more true than it already is. Humans already fail to identify phishing 95% of the time. And a human can already create an exact duplicate e-mail, website, text, etc as a real one. There's no need for AI.

Re: Thanks FedEx, this is why we keep getting phished

#353

Post by Aldipower »

romwell wrote: post #77
Aldipower wrote: post #66

Earlier quoted context omitted.

Man, this is just a marketing gimmick. I am always short in USB sticks. So, could have gotten another one.. How about a little bit more of humor?

If you give me your mailing address, I'll arrange it that the bank will mail you one, too. Just be sure to use the included NOTVIRUS.EXE viewer for best experience.

In your fantasies. It is of course in the responsibility of the bank to check if this is virus free. I am using Linux anyway.. No autorun.exe here. Is this still a thing with Windows?

Re: Thanks FedEx, this is why we keep getting phished

#354

Post by calfuris »

Rudism wrote: post #245

A while ago my wife applied for a home equity loan. At some point I got a call from someone claiming to be from the bank she had applied through (I forget which one), calling to make sure I approved the loan since the home is in both our names. He asked for my name, which I gave him, and then the last four digits of my social security number, which I also gave him. He then proceeded to ask for my full social security…

PSA: If you are of a certain age, the last four digits might be roughly all of the useful entropy in your SSN. Be careful with them. Before 2011, the first three digits indicated the office that issued the number and the middle two (the "group number") were used in a publicly-known sequence. The Social Security Administration helpfully published periodic lists of the highest group number reached by each office. This makes it extremely easy to predict the first five numbers for people who were registered at birth, which became quite common in 1986 when tax laws changed to require children's SSNs to claim the associated tax credit.

Re: Thanks FedEx, this is why we keep getting phished

#355

Post by krisoft »

bastawhiz wrote: post #329
Rudism wrote: post #245

A while ago my wife applied for a home equity loan. At some point I got a call from someone claiming to be from the bank she had applied through (I forget which one), calling to make sure I approved the loan since the home is in both our names. He asked for my name, which I gave him, and then the last four digits of my social security number, which I also gave him. He then proceeded to ask for my full social security…

I'd have read him the riot act on the phone. My bank has big warning banners on virtually every page of the site warning me to be careful of scammers. Someone calling me on the phone and asking for my TIN? Yeah, I don't think so.

> I'd have read him the riot act on the phone.

No point. If he is a scammer he has a thick skin. If he is working for the bank this is either a training or a policy issue.

Just refuse politely and report to the bank. (preferably to some security channel if there is one.)

Re: Thanks FedEx, this is why we keep getting phished

#357

Post by dunham »

natebc wrote: post #95
Rygian wrote: post #43

Earlier quoted context omitted.

Did you click on the "Report Phishing attempt" button installed by your IT center in your mail client? Sorry for the probable sarcasm. In a company that size, if the IT center does not provide a means to report phishing attempts then there are more serious problems than a dodgy email campaign.

This is even worse in companies that have security offices actively sending out phishing emails worded as internal emails from your company that shame you if you click any of the links in them. email is well and truly dead.

That reminds me that we had a "chief architect" who sent out his fairwell email with a link to his linked-in page in the footer, but the link actually went to a certain music video on youtube.

I suppose, if you want to train people to not click on links, that's a fun way to do it.

Re: Thanks FedEx, this is why we keep getting phished

#358

Post by zokier »

naruhodo wrote: post #90

There really needs to be some kind of cryptographic authentication system for text messages and caller ID that gives the recipient absolute certainty about the identity of the sender. Registering a name in this system should require real-world proof of identity including a business address and the contact information of real people. There should be serious financial penalties for identity fraud. It should be an open…

Relevant as article was about Australia: https://www.acma.gov.au/articles/2024-02/five-telcos-breache...

Re: Thanks FedEx, this is why we keep getting phished

#359

Post by kccqzy »

Rudism wrote: post #245

A while ago my wife applied for a home equity loan. At some point I got a call from someone claiming to be from the bank she had applied through (I forget which one), calling to make sure I approved the loan since the home is in both our names. He asked for my name, which I gave him, and then the last four digits of my social security number, which I also gave him. He then proceeded to ask for my full social security…

This is just an extremely incompetent and rude loan officer. Generally the loan officers are motivated to close the deal and write you a check because they get commission from that. They are nice to their customers because pissing off customers won't get them that sweet commission. The loan officer I last talked to managed to close more than $1B of mortgages in a year and he's the nicest guy on the phone. In your case, they could for example let you email them using their official bank email address, or use the bank's own web app or messaging system.

Re: Thanks FedEx, this is why we keep getting phished

#360

Post by d_k_f »

lucb1e wrote: post #337
Rudism wrote: post #245

A while ago my wife applied for a home equity loan. At some point I got a call from someone claiming to be from the bank she had applied through (I forget which one), calling to make sure I approved the loan since the home is in both our names. He asked for my name, which I gave him, and then the last four digits of my social security number, which I also gave him. He then proceeded to ask for my full social security…

Terms of service from my bank say you're not allowed to give your PIN or secrets like one-time passwords (called "TAN" here) to third parties, not even the bank employees themselves. But when I contacted them about a phishing practice, it was A-OK because it was a "legitimate" website that phished your credentials to view the last 180 days of transaction histories, compute a credit score, and then withdraw the money.…

I've implemented the bank account checking flow for a German client in a purely B2B setting, and this is essentially based on the PSD2 directive, which requires all/some/most (not entirely sure) banks to provide exactly this functionality (google keywords "PSD2" and "XS2A"). The bank's T&C should reflect this ... somewhere.

The main protection to you not getting scammed out of money this way is in the kind of TAN used for this process. It should/must only allow read access to your account, and at least one of my banks very clearly shows this in the 2fa approval app. Technically, checking your account history and then deducting money will (hopefully) have been two different processes.

The moral/ethical implications of requesting (up to) 365 days of full bank transaction details and being allowed to store this information is a whole different animal, tough, and I'm glad I haven't had to do this myself yet.

Post reply on HN