Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kurt Got Got

fly.io

Post reply on HN
Print view View original

51–60 of 256 posts

Re: Kurt Got Got

#51

Post by latchkey »

akerl_ wrote: post #33
latchkey wrote: post #29

Earlier quoted context omitted.

This is exactly why I turned off auto enter.

Isn’t turning off auto enter exacerbating the problem? The avenue for catching this is that the password manager’s autofill won’t work on the phishing site, and the user could notice that and catch that it’s a malicious domain

Autofill doesn't always work for every site. So, now you're having to store in your mind where it works and where it doesn't. By disabling it, it forces you to go the extra step (command-shift-L) every time.

Re: Kurt Got Got

#52

Post by otterley »

o11c wrote: post #35
dewey wrote: post #19

Earlier quoted context omitted.

They prevent you from being one of these, and copy pasting the password from password manager into the wrong input field. Something that still happens often with many websites not properly auto-filling from password managers. > They just rely on you being busy, or out, or tired, and just not checking closely enough

If you are "copy-pasting" you are not using your password manager correctly.

This very story illustrates how people will override their password manager's builtin protections when panic ensues.

Re: Kurt Got Got

#53

Post by stavros »

dilyevsky wrote: post #38
bradgessler wrote: post #13

When we did annual pen testing audits for my last company, the security audit company always offered to do phishing or social engineering attacks, but advised against it because they said it worked every single time. One of the most memorable things they shared is they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on…

The stray USB stick is how Stuxnet allegedly got deployed. Tbh I doubt that works in this day and age.

Hah, watch me.

Re: Kurt Got Got

#54

Post by akerl_ »

otterley wrote: post #47
akerl_ wrote: post #30

Earlier quoted context omitted.

How does this square with the fact that the tech savvy person in the post was phished despite using a password manager.

Precisely. 1Password's browser integration would have noticed a domain mismatch and refused to autofill the password -- but in a panic, Kurt apparently opened 1Password and then copied/pasted the credentials manually.

Which is why a properly working password manager is not a strong defense against phishing.

Re: Kurt Got Got

#55

Post by stavros »

akerl_ wrote: post #48
roughly wrote: post #44

I was reading this and wondering why it was posted so high (I didn’t recognize the company name), and then I got to the name at the bottom. I think the lesson here is “if it could happen to Kurt, it could happen to anyone.” Yeah, the consequences here were pretty limited, but everyone’s got Some vulnerability, and it’s usually in the junk pile in the corner that you’re ignoring. If the attacker were genuinely trying…

I think you mean Kurt.

It would help if they mentioned his name anywhere in the post, title, or subtitle.

Re: Kurt Got Got

#56

Post by otterley »

dilyevsky wrote: post #31
tptacek wrote: post #22

Earlier quoted context omitted.

This whole story is about us getting zapped because we relied on a good long password in a password manager!

So what happened exactly? Did Kurt enter his twitter password manually after clicking on that phishing link? Did he not get his sus detector going off after the password manager didn't suggest the password?

Yes, that's exactly what happened. The nature of panic is that it overrides people's better judgment.

Re: Kurt Got Got

#57

Post by amenghra »

bradgessler wrote: post #13

When we did annual pen testing audits for my last company, the security audit company always offered to do phishing or social engineering attacks, but advised against it because they said it worked every single time. One of the most memorable things they shared is they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on…

If you are getting powned by running random executables found on usb drives, passkeys aren’t going to save you. Same if the social engineering is going to get you to install random executables.

Re: Kurt Got Got

#58

Post by roblabla »

dilyevsky wrote: post #38
bradgessler wrote: post #13

When we did annual pen testing audits for my last company, the security audit company always offered to do phishing or social engineering attacks, but advised against it because they said it worked every single time. One of the most memorable things they shared is they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on…

The stray USB stick is how Stuxnet allegedly got deployed. Tbh I doubt that works in this day and age.

A USB can pretend to be just about any type of device to get the appropriate driver installed and loaded. They can then send malformed packets to that driver to trigger some vulnerability and take over the system.

There are a _lot_ of drivers for devices on a default windows install. There are a _lot more_ if you allow for Windows Update to install drivers for devices (which it does by default). I would not trust all of them to be secure against a malicious device.

I know this is not how stuxxnet worked (instead using a vulnerability in how LNK files were shown in explorer.exe as the exploit), but that just goes to show how much surface there is to attack using this kind of USB stick.

And yeah, people still routinely plug random USBs in their computers. The average person is simultaneously curious and oblivious to this kind of threat (and I don't blame them - this kind of threat is hard to explain to a lay person).

Re: Kurt Got Got

#59

Post by roughly »

akerl_ wrote: post #48
roughly wrote: post #44

I was reading this and wondering why it was posted so high (I didn’t recognize the company name), and then I got to the name at the bottom. I think the lesson here is “if it could happen to Kurt, it could happen to anyone.” Yeah, the consequences here were pretty limited, but everyone’s got Some vulnerability, and it’s usually in the junk pile in the corner that you’re ignoring. If the attacker were genuinely trying…

I think you mean Kurt.

You’re right - I flagged on Thomas’s name in the signature and because I’ve seen him around here, well, forever, but Kurt is also extremely savvy.

Re: Kurt Got Got

#60

Post by OkayPhysicist »

latchkey wrote: post #29
silexia wrote: post #21

CEO here, I also almost got taken by a fake legal notice about a Facebook post. My password manager would not auto enter my password so I tried manually entering it like a dummy. Fortunately, it was the wrong one.

This is exactly why I turned off auto enter.

No, that's the opposite of the moral of that story. If the person you responded to had listened to the fact that the auto-enter didn't auto-enter, they wouldn't have been at any risk. Likewise in the article, the problem was that the CEO copy-pasted the password into the phishing page's password field, NOT that the auto-enter prompted him to do so.
Post reply on HN