Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oxford Temporarily Blocks Google Docs

blogs.oucs.ox.ac.uk

Post reply on HN
Print view View original

71–80 of 160 posts

Re: Oxford Temporarily Blocks Google Docs

#71

Post by CodeMage »

Major_Grooves wrote: post #63
UnoriginalGuy wrote: post #59

Earlier quoted context omitted.

I just want to re-enforce your second bullet... It is 2013, two factor authentication is here and it is open source software. You can use Google Authenticator[1] for free or you can use something like the YubiKey[2]. If the students have a smartphone then Google Authenticator is on almost all of the major platforms. [1] http://code.google.com/p/google-authenticator/ [2] http://www.yubico.com/about/background/

unfortunately most of the University runs on Microsoft Exchange I believe, and they do not support 2-factor authentication.

And once again we prove that Microsoft, just like parents, can be blamed for everything ;)

Re: Oxford Temporarily Blocks Google Docs

#72

Post by [deleted] »

freehunter wrote: post #30
jnazario wrote: post #25

Earlier quoted context omitted.

continuous phishing attacks via google docs? no, not quite. some collaborators and myself studied this a couple of years ago, it's a minuscule part of the phishing problem. http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=61... edited to add: here's the paper for you to read, i forgot i had a copy lying around. http://monkey.org/~jose/tmp/PHISHING-FINAL-03-KN.pdf

Just because you saw a small amount from Google Docs doesn't mean that Oxford isn't seeing a large amount, or large enough to concern them. If you're a researcher, you should know that you can't extrapolate your dataset to everyone.

[deleted]

Re: Oxford Temporarily Blocks Google Docs

#73

Post by jacques_chester »

marcloney wrote: post #68
jacques_chester wrote: post #52

Earlier quoted context omitted.

> Train your users where it is and isn't safe to enter credentials. This demonstrably doesn't work. It reduces but cannot eliminate all instances of phishing. > Don't give your users credentials. Have some alternate way to authenticate them like a login token. Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a universit…

If you place rate limiting on email accounts by default and then for the lower percent of users that need a higher rate do it on a case-by-case basis. In my experience most users that fall victim to these types of phishing attacks do not need to send high volumes of emails.

Oxford already has rate limiting. 1000 messages per hour through their servers, it seems [0].

The next step would be to filter outbound traffic to block SMTP from compromised PCs. It seems they have an outbound firewall, but it's not obvious which ports are closed because the list of blocked ports is ... blocked[1].

[0] http://blogs.oucs.ox.ac.uk/adamweblearn/2011/12/weblearn-una...

[1] http://www.oucs.ox.ac.uk/network/firewall/blocks/

Re: Oxford Temporarily Blocks Google Docs

#74

Post by corresation »

bat99 wrote: post #41

I wonder how many of the keyboard warriors in this thread have any experience of running very large and incredibly diverse networks like Oxford University's. The guys handling security for Oxford are highly experienced and capable. Oxford's network is far more complicated than a typical University.

have any experience of running very large and incredibly diverse networks like Oxford University's

The fact that they do something doesn't mean that they do it well. As others have mentioned, email filtering in Exchange (bizarre email platform for a university, but ignoring that) seems like a rudimentary starting point here.

Re: Oxford Temporarily Blocks Google Docs

#75

Post by EwanToo »

jacques_chester wrote: post #70
EwanToo wrote: post #65

Earlier quoted context omitted.

I can believe it, I just don't know why it's not been customised to react to links to docs.google.com if it's such a high volume issue. It's not a trivial problem by any means, but from the network security team's blog it doesn't seem like they've taken many of the steps that I'd expect prior to cutting off a very high traffic website.

Time. There's the nice clever intelligent solution which could be developed over a few weeks, or there's the fact that the phishers have decided -- for whatever reason -- to go apeshit today.

True, but in this case it seems like it's not a particularly new problem, just something that they've finally reacted to?

They actually mention sinkholing spreadsheets.google.com in this post from August 2011 [1], they actually say "There are also some forms which are more difficult to block ( I don’t think we’d be too popular if we sink-holed spreadsheets.google.com for example)".

So they've had the issue for years.

1 - https://blogs.oucs.ox.ac.uk/oxcert/2011/08/12/the-price-of-p...

Re: Oxford Temporarily Blocks Google Docs

#76

Post by jacques_chester »

blisterpeanuts wrote: post #62
marios wrote: post #45

Earlier quoted context omitted.

This. The only effective solution is to educate users, but that in itself is a difficult task. Phishing attacks rely on users being gullible / distracted / ignorant. Telling users _not_ to be any of these usually results in angry answers such as "Are you implying I am stupid !?", and the important part of the dialogue where you explain things to be wary of is completely ignored. Another way to communicate these thing…

"phish your own users" Now that's the best idea I've heard all morning. You should be running Oxford's IT dept!

I disagree.

At best the users who don't care will continue not to care. At worst it will train users to think "oh, it's another drill, ho hum".

Somewhere in the middle is some deeply embarrassed Deputy Vice Chancellor who decides to make those horrid computer people his personal enemies.

Re: Oxford Temporarily Blocks Google Docs

#77

Post by bat99 »

corresation wrote: post #74
bat99 wrote: post #41

I wonder how many of the keyboard warriors in this thread have any experience of running very large and incredibly diverse networks like Oxford University's. The guys handling security for Oxford are highly experienced and capable. Oxford's network is far more complicated than a typical University.

have any experience of running very large and incredibly diverse networks like Oxford University's The fact that they do something doesn't mean that they do it well . As others have mentioned, email filtering in Exchange (bizarre email platform for a university, but ignoring that) seems like a rudimentary starting point here.

Without wishing to debate the pros and cons of using Exchange, I can assure you that it was not the decision of the security team.

Re: Oxford Temporarily Blocks Google Docs

#79

Post by alan_cx »

mcherm wrote: post #27

They're attacking the wrong part of the problem. If misleading messages ("phishing") are leading their users to enter credentials onto forms which are then used to send out spam, then the solution is not to block access to one of the sites that supports forms. There are an unlimited number of sites that support forms. There are LOTS of better ways to solve this problem. Here are a few: * Train your users where it is…

Oooooooooooooooo rant coming on.............

Im sorry, but that is the typical tech reply that blows normal people's minds. Blame the user. Well, the user says, sod that, lets just block the problem and get on with what we wanted to do in the first place.

People, normal non tech people, want to use computers as a tool, not become experts in thwarting criminals, etc. If a user cant just go to a computer and simply use it, like say a library or book, then the computer and its champions are failing. Its not the users job to provide security. And no, its not like locking a door. The sheer amount of rubbish poor users have to go through to be safe on a computer is frankly a joke, and the reason so many non geeks love Apple. Yes geeks know Apple are as insecure and any one else, but users believe they are simple and safe.

(At this point, by all means picture a toddler going mental in a shop)

I've been in this business for 30 years, and "train the users" is for me a 30 year mantra that no one out side of geekdom wants to hear. It was my job to enable them to do their job more efficiently, not expect them to become some sort of security expert.

This Uni is doing the simple easy thing to let its users function safely. If the IT world doens't like it, then 1: tough, 2: damn well fix it, and 3: stop blaming users.

Then, you tell them to limit emails. "Oh right" says the user, "I thought one point of email was easy mass mailing, and now you want to bloke it?"

Really think about the user. Its they who make computers and the internet worth bothering with.

I feel better now. Thank you.

Re: Oxford Temporarily Blocks Google Docs

#80

Post by tshile »

Major_Grooves wrote: post #63
UnoriginalGuy wrote: post #59

Earlier quoted context omitted.

I just want to re-enforce your second bullet... It is 2013, two factor authentication is here and it is open source software. You can use Google Authenticator[1] for free or you can use something like the YubiKey[2]. If the students have a smartphone then Google Authenticator is on almost all of the major platforms. [1] http://code.google.com/p/google-authenticator/ [2] http://www.yubico.com/about/background/

unfortunately most of the University runs on Microsoft Exchange I believe, and they do not support 2-factor authentication.

Maybe you should do some more reading. There are certainly supported configurations for two factor authentication.
Post reply on HN