An update on our security incident • Hacker News Board

Re: An update on our security incident

#81

Post by EE84M3i » Fri, Jul 31, 2020, 6:23 AM UTC

_8j50 wrote: post #40

As someone who works to stop these, the most frustrating part is how even infosec people thik enough training or $vendor's email security solution will stop this. It's like boy scouts that think they will stop navy seals. There is too much focus on entry point of an attack,especially by news media.

What infosec people think $vendor email security solutions are going to solve phishing attacks? I was under the impression that the people that buy those solutions (like many security solutions) are primarily non-infosec people that want to paper over their real problem without fixing it.

Granted, there is a place for some of these things temporarily while working to fix the actual problem, but that's a mitigation, not a solution.

Re: An update on our security incident

#82

Post by skybrian » Fri, Jul 31, 2020, 6:25 AM UTC

Ueland wrote: post #61

marcan_42 wrote: post #43

Earlier quoted context omitted.

We're talking about companies , not users . Competent companies can and absolutely do require dongles (or equivalently trustable corporate hardware) to log in to their systems.

And as a Norwegian it boggles my mind that banks in the US only require username and password to access their bank. We have moved on to a authenticator living on a phone sim card, and you use either that or a "real" hardware dongle for all logins and (most) transactions to confirm your identity.

US banks do commonly use SMS messages as a second factor, for what it's worth.

Re: An update on our security incident

#83

Post by Closi » Fri, Jul 31, 2020, 6:28 AM UTC

Thorrez wrote: post #21

iamleppert wrote: post #11

They should require hardware security devices (dongles). Really Twitter should be ashamed of their poor internal security.

Note that not all hardware security devices are safe. U2F security devices are safe against phishing; OTP security devices are not safe against phishing.

U2F are safe against simple phishing, but sophisticated attacks can include 2-factor input.

Re: An update on our security incident

#84

Post by ma2rten » Fri, Jul 31, 2020, 6:29 AM UTC

andrew_ wrote: post #36

0xUser wrote: post #5

Source (with more details): https://blog.twitter.com/en_us/topics/company/2020/an-update... > The social engineering that occurred on July 15, 2020, targeted a small number of employees through a phone spear phishing attack. A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools. Not all o…

I'd like to know more about these tools. That there's at least one which can bypass a user's 2FA settings without notification suggests that there are additional tools in the same vein.

Google requires its employees to use a security key for access to all internal systems including admin tools, source code and email. Every since google started enforcing this policy the number of successful phishing attacks has gone down to basically zero.

Re: An update on our security incident

#85

Post by bananabreakfast » Fri, Jul 31, 2020, 6:30 AM UTC

ehsankia wrote: post #23

0xUser wrote: post #5

Source (with more details): https://blog.twitter.com/en_us/topics/company/2020/an-update... > The social engineering that occurred on July 15, 2020, targeted a small number of employees through a phone spear phishing attack. A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools. Not all o…

Were the spear fishing attacked also used to get 2FA, or did these accounts not have 2FA? Would hardware based 2FA not have stopped this?

It says right there in the linked page that the phishing attack was able to manipulate multiple employees into giving access past their 2FA.

Re: An update on our security incident

#86

Post by skybrian » Fri, Jul 31, 2020, 6:32 AM UTC

PopeDotNinja wrote: post #52

Thorrez wrote: post #28

Earlier quoted context omitted.

Rare for employees or rare for consumers? Companies can push much higher security onto employees than onto consumers.

How do they deal with lost dongles?

Same as other computer equipment, get another one from tech support and revoke the old one. Or at least, that's how it worked when people still went to the office.

Re: An update on our security incident

#87

Post by _8j50 » Fri, Jul 31, 2020, 6:34 AM UTC

EE84M3i wrote: post #81

_8j50 wrote: post #40

As someone who works to stop these, the most frustrating part is how even infosec people thik enough training or $vendor's email security solution will stop this. It's like boy scouts that think they will stop navy seals. There is too much focus on entry point of an attack,especially by news media.

What infosec people think $vendor email security solutions are going to solve phishing attacks? I was under the impression that the people that buy those solutions (like many security solutions) are primarily non-infosec people that want to paper over their real problem without fixing it. Granted, there is a place for some of these things temporarily while working to fix the actual problem, but that's a mitigation, n…

Nope, seasoned pros I respect think trainig+$vendor is good enough. If it isn't, blame the user or the vendor!

There are shops where the goal is to have someone to blame when you get owned and there are rare shops where the goal is to do it right to catch/stop bad guys even if it means you get blamed (because management understand security is not absolute)

Re: An update on our security incident

#88

Post by monoideism » Fri, Jul 31, 2020, 6:35 AM UTC

zamalek wrote: post #29

ehsankia wrote: post #23

Earlier quoted context omitted.

Were the spear fishing attacked also used to get 2FA, or did these accounts not have 2FA? Would hardware based 2FA not have stopped this?

I haven't seen a form of phishing that hardware 2FA doesn't stop. Yes, it would have.

Significant forms of phishing are stopped by U2F (as used by Yubikey and others), by crytographically binding your credential to the domain name , and only issuing an approval signature if the site matches. Obviously, this stops credential phishing.

https://krebsonsecurity.com/2018/07/google-security-keys-neu...

https://medium.com/@antonisikora/how-u2f-security-keys-can-e...

Re: An update on our security incident

#89

Post by dpweb » Fri, Jul 31, 2020, 6:38 AM UTC

0xUser wrote: post #5

Source (with more details): https://blog.twitter.com/en_us/topics/company/2020/an-update... > The social engineering that occurred on July 15, 2020, targeted a small number of employees through a phone spear phishing attack. A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools. Not all o…

No disrespect to those challenged with protecting such a huge target, but why do admin tools even have these capabilities? I could see needing to disable a user account or change some attributes, but why would an admin ever need to tweet from it? There shouldn't be tools with God privileges even for admins. Not surprising human error was involved in a breach this huge. So, how many people had access to this tool? Is there a killswitch for the tool itself available to very few, really very few, persons? edit: I dont know if the tool can tweet but surprised 2FA can be stripped without a human being confirming (ie.. the acct owner's social media person), especially for famous people.

Re: An update on our security incident

#90

Post by _8j50 » Fri, Jul 31, 2020, 6:38 AM UTC

iKevinShah wrote: post #65

_8j50 wrote: post #40

As someone who works to stop these, the most frustrating part is how even infosec people thik enough training or $vendor's email security solution will stop this. It's like boy scouts that think they will stop navy seals. There is too much focus on entry point of an attack,especially by news media.

Hey, Any good literature which you'd recommend to read to avoid something like this?

That's the thing, you can't,not with the way current tech is. But you can read up about having good monitoring/detection and hardening on your endpoints.

Microsoft for example recommenda privileged access workstations. If twitter's employees used a separate set of credentials and workstations for privileged twitter moderation than their regular account/machine used for email and day to day stuff I bet the attack wolf have failed.