Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Skype blog hacked

blogs.skype.com

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Skype blog hacked

#41

Post by X4 »

jblz wrote: post #25
mrkris wrote: post #10

I don't consider getting access to a website via the most insecure blogging platform on the internet "hacking".

Not sure why you say that. WordPress.com offers 2-Factor Auth: http://en.support.wordpress.com/security/two-step-authentica... There are also tons of available security plugins & pretty extensive documentation on hardening a self-hosted install: http://wordpress.org/plugins/tags/security http://codex.wordpress.org/Hardening_WordPress

Hardening Wordpress. That made me speechless…………

But hey, what do I know? ¯\_(ツ)_/¯ Only the tip of the iceberg. Some men believe.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wordpress

Re: Skype blog hacked

#42

Post by Spearchucker »

Viper007Bond wrote: post #40
t0 wrote: post #6

Earlier quoted context omitted.

You're right. It was probably a brute force since they don't have maximum login attempts. http://blogs.skype.com/wp-admin

Limiting login attempts is not as effective as you might think. How should it work? If you want to ban IP addresses that get X attempts wrong in Y minutes, then you're failing to realize that hackers like this normally have access to hundreds or thousands of IP addresses. If you want to lock the whole account for a while, then you've just introduced a way for anyone to lock the account of someone else they don't like…

No need to ban an IP address. After x attempts just add y seconds before allowing another login attempt. If you like, lock account with SMS or email to owner after z attempts. Do this per login, regardless of device type/location. The time taken to test out just 5 passwords should make a brute force impractical.

Re: Skype blog hacked

#43

Post by wyck »

Spearchucker wrote: post #42
Viper007Bond wrote: post #40

Earlier quoted context omitted.

Limiting login attempts is not as effective as you might think. How should it work? If you want to ban IP addresses that get X attempts wrong in Y minutes, then you're failing to realize that hackers like this normally have access to hundreds or thousands of IP addresses. If you want to lock the whole account for a while, then you've just introduced a way for anyone to lock the account of someone else they don't like…

No need to ban an IP address. After x attempts just add y seconds before allowing another login attempt. If you like, lock account with SMS or email to owner after z attempts. Do this per login, regardless of device type/location. The time taken to test out just 5 passwords should make a brute force impractical.

This plugin does exactly that and is very effective. Everyone using WP should be using it. http://wordpress.org/plugins/limit-login-attempts/

Re: Skype blog hacked

#44

Post by krapp »

X4 wrote: post #41
jblz wrote: post #25

Earlier quoted context omitted.

Not sure why you say that. WordPress.com offers 2-Factor Auth: http://en.support.wordpress.com/security/two-step-authentica... There are also tons of available security plugins & pretty extensive documentation on hardening a self-hosted install: http://wordpress.org/plugins/tags/security http://codex.wordpress.org/Hardening_WordPress

Hardening Wordpress. That made me speechless………… But hey, what do I know? ¯\_(ツ)_/¯ Only the tip of the iceberg. Some men believe. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wordpress

How much of what's on that list actually applies to a recent version of Wordpress?

Re: Skype blog hacked

#45

Post by wyck »

X4 wrote: post #41
jblz wrote: post #25

Earlier quoted context omitted.

Not sure why you say that. WordPress.com offers 2-Factor Auth: http://en.support.wordpress.com/security/two-step-authentica... There are also tons of available security plugins & pretty extensive documentation on hardening a self-hosted install: http://wordpress.org/plugins/tags/security http://codex.wordpress.org/Hardening_WordPress

Hardening Wordpress. That made me speechless………… But hey, what do I know? ¯\_(ツ)_/¯ Only the tip of the iceberg. Some men believe. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wordpress

Not much because those are plugins and not WordPress, there are over 27k of them on .org and probably another 5-10k hosted on other sites.

Re: Skype blog hacked

#46

Post by magic_haze »

zeitg3ist wrote: post #15
romanovcode wrote: post #9

I'm not sure why the accent on "Stop using MS, it's spying on you!" is on MS. AFAIK every company is using your data and giving/selling it to the government. How is MS more evil than anyone else?

Microsoft has been moving Skype from its original peer-to-peer architecture to a more centralized system for some time. After the Snowden shitstorm, critics have been implying that the move was NSA-related.

I might be wrong, but wasn't skype's p2p system used mostly for udp hole punching? (i.e., the supernodes were used to initiate the connection and then the clients communicated directly with each other.) With the centralized system, do the call contents go through microsoft's servers now? (this should be pretty easy to prove, doesn't it? Just check the addresses where your UDP packets are being sent to and received from.) It just seems to me that if anyone wanted to spy on you, forcing someone else to migrate to an entirely new system would be massive overkill: Applebaum's talk shows there are _plenty_ of better tools available to get to your packets.

EDIT: This really seems like an interesting question: _are_ there any advantages an attacker would have with skype's centralized system that they wouldn't with their previous p2p system? From what we've seen so far, I think the differences (from an attacker's perspective) are trivial.

Re: Skype blog hacked

#47

Post by Viper007Bond »

Spearchucker wrote: post #42
Viper007Bond wrote: post #40

Earlier quoted context omitted.

Limiting login attempts is not as effective as you might think. How should it work? If you want to ban IP addresses that get X attempts wrong in Y minutes, then you're failing to realize that hackers like this normally have access to hundreds or thousands of IP addresses. If you want to lock the whole account for a while, then you've just introduced a way for anyone to lock the account of someone else they don't like…

No need to ban an IP address. After x attempts just add y seconds before allowing another login attempt. If you like, lock account with SMS or email to owner after z attempts. Do this per login, regardless of device type/location. The time taken to test out just 5 passwords should make a brute force impractical.

That sounds not fun for the account owner. I could prevent you from logging into your account.

Re: Skype blog hacked

#48

Post by jfoster »

xSwag wrote: post #4

This blog is not hosted by the Skype but on WordPress VIP. This means that, most likely, the blog was not broken into using a software exploit of any sort since the security on VIP blogs is professional. Knowing that this is the Syrian Army, this attack was most likely done using phished credentials. If they had any sort of system access they would have defaced the entire subdomain or the main site. So most likely, t…

Doesn't WordPress offer any two-step auth option? Feels like a rather large limitation.

Re: Skype blog hacked

#49

Post by Viper007Bond »

wyck wrote: post #43
Spearchucker wrote: post #42

Earlier quoted context omitted.

No need to ban an IP address. After x attempts just add y seconds before allowing another login attempt. If you like, lock account with SMS or email to owner after z attempts. Do this per login, regardless of device type/location. The time taken to test out just 5 passwords should make a brute force impractical.

This plugin does exactly that and is very effective. Everyone using WP should be using it. http://wordpress.org/plugins/limit-login-attempts/

I run this on my personal site to prevent drive-bys but it won't stop a determined hacker with many IPs.

Here's a proper solution to secure your account: http://wordpress.org/plugins/google-authenticator/

Re: Skype blog hacked

#50

Post by barsxl »

t0 wrote: post #6
xSwag wrote: post #4

This blog is not hosted by the Skype but on WordPress VIP. This means that, most likely, the blog was not broken into using a software exploit of any sort since the security on VIP blogs is professional. Knowing that this is the Syrian Army, this attack was most likely done using phished credentials. If they had any sort of system access they would have defaced the entire subdomain or the main site. So most likely, t…

You're right. It was probably a brute force since they don't have maximum login attempts. http://blogs.skype.com/wp-admin

WordPress.com has pretty sophisticated brute force detection mechanisms and protections in place. I am not sure why you would say otherwise.
Post reply on HN