Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When MFA isn't MFA, or how we got phished

retool.com

Post reply on HN
Print view View original

71–80 of 287 posts

Re: When MFA isn't MFA, or how we got phished

#71

Post by pvg »

hn_throwaway_99 wrote: post #38
rolobio wrote: post #22

Very sophisticated attack, I would bet most people would fall for this. I'm surprised Google encourages syncing the codes to the cloud... kind of defeats the purpose. I sync my TOTP between devices using an encrypted backup, even if someone got that file they could not use the codes. FIDO2 would go a long way to help with this issue. There is no code to share over the phone. FIDO2 can also detect the domain making th…

> Very sophisticated attack, I would bet most people would fall for this. No. If you think people at your company would fall for this, then IMO you have bad security training. The simple mantra of "Hang up, lookup, call back" ( https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... ) would have prevented this. Literally like 99% of social engineering attacks would be prevented this way. Seriously, make a lit…

The ineffectiveness of "security training" is precisely why TOTP is on its way out - you couldn't even train Google employees to avoid getting compromised.

Re: When MFA isn't MFA, or how we got phished

#72

Post by joshxyz »

fireflash38 wrote: post #65
hn_throwaway_99 wrote: post #60

Question for security folks out there: So often I see these kinds of phishing attacks that have hugely negative consequences (see the MGM Resorts post earlier today), and the main problem is that just one relatively junior employee who falls for a targeted phishing attack can bring down the whole system. Is anyone aware of systems that essentially require multiple logins from different users when accessing sensitive…

You're looking for quorums, or key splits. They aren't super common. You see them with some HSMs (need M of N persons to perform X action).

not good with acronyms, what is hsm here?

Re: When MFA isn't MFA, or how we got phished

#73

Post by [deleted] »

hn_throwaway_99 wrote: post #38
rolobio wrote: post #22

Very sophisticated attack, I would bet most people would fall for this. I'm surprised Google encourages syncing the codes to the cloud... kind of defeats the purpose. I sync my TOTP between devices using an encrypted backup, even if someone got that file they could not use the codes. FIDO2 would go a long way to help with this issue. There is no code to share over the phone. FIDO2 can also detect the domain making th…

> Very sophisticated attack, I would bet most people would fall for this. No. If you think people at your company would fall for this, then IMO you have bad security training. The simple mantra of "Hang up, lookup, call back" ( https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo... ) would have prevented this. Literally like 99% of social engineering attacks would be prevented this way. Seriously, make a lit…

[deleted]

Re: When MFA isn't MFA, or how we got phished

#74

Post by fireflash38 »

burkaman wrote: post #35
AshamedCaptain wrote: post #14

Earlier quoted context omitted.

For me the question is "who the fsck uses Google Authenticator to store all their tokens, both company and personal?"

Google Authenticator was I believe the first available TOTP app, and is by far the most popular. It used to be open source and have no connection to your Google account. Many people installed it years ago when they first set up MFA, and have just been adding stuff to it ever since because it's easy and it works. Even for technical users who understand how TOTP works, there is no obvious reason it appears unsafe to pu…

I think technically Blizzard Authenticator (even the app) was available before Google Authenticator, but obviously for extremely limited use.

Re: When MFA isn't MFA, or how we got phished

#75

Post by oldtownroad »

rahidz wrote: post #2

>The caller claimed to be one of the members of the IT team, and deepfaked our employee’s actual voice. The voice was familiar with the floor plan of the office, coworkers, and internal processes of the company. Wow that is quite sophisticated.

And obviously untrue. If you’re an employee who just caused a security incident of course you’re going to make it seem as sophisticated as possible but considering Retool has hundreds of employees from all over the world, the range of accents is going to be such that any voice will sound like that of at least one employee.

Are you close enough to members of your IT team to recognise their voices but not be close enough to them to make any sort of small talk that the attacker wouldn’t be able to respond to convincingly?

If you’re an attacker who can do a convincing french accent, pick an IT employee from LinkedIn with a french name. No need to do the hard work of tracking down source audio for a deepfake when voices are the least distinguishable part of our identity.

Every story about someone being conned over the phone now includes a line about deepfakes but these exact attacks have been happening for decades.

Re: When MFA isn't MFA, or how we got phished

#76

Post by luma »

bawolff wrote: post #64
rolobio wrote: post #22

Very sophisticated attack, I would bet most people would fall for this. I'm surprised Google encourages syncing the codes to the cloud... kind of defeats the purpose. I sync my TOTP between devices using an encrypted backup, even if someone got that file they could not use the codes. FIDO2 would go a long way to help with this issue. There is no code to share over the phone. FIDO2 can also detect the domain making th…

> I'm surprised Google encourages syncing the codes to the cloud... kind of defeats the purpose. Depends on what you think the purpose is. People talk about TOTP solving all sorts of problems, but in practise the only one it really solves for most setups is people choosing bad passwords or reusing passwords on other insecure sites. Pretty much every other threat model for it is wishful thinking. While i also think th…

TOTP is helpful when you don’t fully trust the input process. If rogue javascript is grabbing creds from your page, or the client has a keylogger they don’t know about, TOTP can help.

Re: When MFA isn't MFA, or how we got phished

#77

Post by tough »

wyldberry wrote: post #51
mistrial9 wrote: post #19

Earlier quoted context omitted.

it is a cynical comment that is meant to hilite the relationship between humans where oppressive and untrusting employment leads to increase in antipathy, ill-will, feelings of being abused and all of that leading to insider theft and serious pre-meditated betrayal ?

Zero Trust is such a bad branding for how the architecture works. It's just "always prove" architecture.

It does seem to sound pretty well on the mind of the executives signing the deals that hear the marketing talk

Re: When MFA isn't MFA, or how we got phished

#78

Post by luma »

miki123211 wrote: post #53
softfalcon wrote: post #26

Earlier quoted context omitted.

>FIDO2 can also detect the domain making the request, and will not provide the correct code even it the page looks correct to a human. I could not agree more with this sentiment! We need more of this kind of automated checking going on for users. I'm tired of seeing "just check for typo's in the URL" or "make sure it's the real site!" advice given to the average user. People are not able to do this even when they kno…

The problem with Fido (and other such solutions, including smartphone-based passkeys) is that they make things extremely hard if you're poor / homeless / in an unsafe / violent family situation and therefore change devices often. It's mostly a non-issue for Silicon Valley tech employees working solely on their corporate laptops, and U2F is perfect for that use-case, but these concerns make MFA a non-starter for the w…

Biometrics aren’t a great key because they cannot generally be revoked. This isn’t a privacy concern, it’s a security problem. You leave your fingerprints nearly everywhere you go, and they only need to be compromised once and then can never be used again. At best, you can repeat this process a sum total of 10 times without taking your shoes off to login.

Re: When MFA isn't MFA, or how we got phished

#79

Post by coderintherye »

joshxyz wrote: post #72
fireflash38 wrote: post #65

Earlier quoted context omitted.

You're looking for quorums, or key splits. They aren't super common. You see them with some HSMs (need M of N persons to perform X action).

not good with acronyms, what is hsm here?

Hardware security module https://en.wikipedia.org/wiki/Hardware_security_module

Re: When MFA isn't MFA, or how we got phished

#80

Post by fireflash38 »

jpc0 wrote: post #28
mr_mitm wrote: post #5

Earlier quoted context omitted.

It's well known that OTP is not immune to phishing. Force your users on webauthn or some other public key based second factor if you're aiming at decreasing the incident rate.

I blame SAML and any other federated login being an "enterprise only" feature on most platforms. So users get used to sharing passwords between multiple accounts and no centralised authority for login. This causes the "hey what's your password? I need to quickly fix this thing" culture in smaller companies which should never be a thing in the first place. If users knew the IT department would never need their passwor…

Ugh, or being able to generate an API/service token. It just ingrains the bad passwords and password sharing if you have to use passwords everywhere.
Post reply on HN