17 ms·

Hackers Prove They Can ‘Pwn’ the Lives of Those Not Hyperconnected

105 points by pavornyoh 11y ago

TlDrBot 11y ago
Summary: Hackers send grandmother phishing mail. Grandmother enter her email address and password. Hackers go into house of Grandmother. Hackers change settings on router and and television of grandmother.
- acbabis 11y ago
  Yeah, this isn't really that scary as long as you know how to spot phishing scams. Am disappoint.
  - onion2k 11y ago
    A chain is only as strong as its weakest link. If anyone has enough privileges for a malicious attacker to use their account/info to compromise your network then that is the measure of how well protected you are. In this case it was a grandmother, but it doesn't have to be. It could be a salesperson, an HR manager, a burnt out developer. When a business grows to a sufficient size that there are people working in it who are disinterested in "computers" or "processes" (in the case of a software startup that's probably over about 10 staff), then you suddenly introduce some huge weak points in your IT infrastructure. That should be scary.
    - acbabis 11y ago
      Yeah, I guess I should be scared that companies I trust might be making these types of mistakes; I hadn't seen it from that angle. I'm just disappointed that the article was about "hackers" but just talked about scams most of us are already aware of; seems kind of click-baity. They could have entitled the article "Here's One Easy Trick to Protect Yourself from Identity Theft."
- nchelluri 11y ago
  curious, is this really a bot or someone just providing a service under the guise of a bot? be pretty cool if it was the former. that would be some serious natural language processing. (not that i know anything about that subject) i read the article, this post does seem like a pretty accurate summary.
  - mkagenius 11y ago
    Its difficult for one person to judge that. Some kind of bias creeps in when you read the article and see the summary again since your mind fills the gap automatically which is created by the summary.
- lqdc13 11y ago
  Yeah, I don't consider the phishing scams interesting at all. This seems like more of a marketing stunt than anything. And it's borderline not hacking. They actually didn't even do the whole thing themselves. Instead hired a phishing service... To me this is more similar to people dressed as UPS truck drivers going inside an apartment and stealing keys. Or a cashier taking a picture of a customer's credit card. P.S. Excellent bot if it is a bot. It seems to be taking sides on an issue and not just summarizing, which I haven't seen happen previously with any other summary bots.
  - TazeTSchnitzel 11y ago
    Phishing is hacking. It's social engineering. They didn't 'hire a phishing service'. They used a website.
  - rezistik 11y ago
    Social Engineering is absolutely hacking. This wasn't a sophisticated example, but it's still a very real threat.
    - coldpie 11y ago
      I guess I have a narrower definition of hacking, specifically that it is using technology in a way it wasn't intended. If you ask someone for their credentials and they give them to you, I don't see that as being "a hack," although I guess modern parlance would say the victim "was hacked."
      - kqr 11y ago
        "Hacking" is in everyday parlance not too far from "gaining unauthorised access to a technical system." Social engineering is often a very efficient alternative to rainbow tables, wiretapping, buffer overruns and other technical exploits.
        rezistik 11y ago
        It's often the only or best way too. The more secure a place is the easier it is to get in. People become very trusting. Carry a clipbord and look like you know where you're going and you can walk damn near anywhere.
sdoering 11y ago
Well actually, looking at the things my parents and parents in law did on their home networks, their Smart TVs and so on, having this in a understandable form for the lay person is really good. To understand, that your door opener, your TV and other things can be "hacked" is important. The information to use different passwords for every service is important. We as people in the know have to help our elders and peers to see how easy it is to use a pwd-mgr and have a little bit more basic security. If nothing more, this piece goes a step in the right direction.
- oAlbe 11y ago
  Don't trust password managers. They are hackable pieces of software just like the ones you are trying to protect. And they are not reliable (see last news of Lastpass acquisition by LogMeIn). I'm not saying you should ditch password managers and just memorize all of your password. I'm just saying: use them as a well-informed user. Back in the days, Bruce Schneier suggested to write passwords down on a piece of paper and keep it in your wallet as the least weak security measure. Today, based on this article[0], he actually recommends the use of a password manager "[...] simply because it allows you to choose longer and stronger passwords.", which basically means it's the lesser of two evils. [0] https://www.schneier.com/blog/archives/2014/09/security_of_pas.html https://www.schneier.com/blog/archives/2014/09/security_of_p...
  - scintill76 11y ago
    Not all password managers are commercial, closed-source, and cloud-connected. This probably wasn't a main point of yours, but since you mentioned LastPass I felt this should be clarified. I'm currently using PasswordSafe (in Wine on Linux) with git to version/synchronize between systems. It is kinda painful, but at least it's nice to not be syncing to somebody's cloud or running in a browser. I've been thinking about converting an old Android device into a more secure password manager. I envision having the device hold the decryption key for the PW "vault" as long as it's connected to my authenticated system. I either request credentials from the PC and approve on-device, or select them on the screen, and it types them as a USB keyboard (or perhaps some other way less prone to garden-variety keyloggers.) I guess I haven't because it's kind of a lot of effort and will lower convenience levels. :) I ought to at least find a better way than the clipboard, to transfer passwords from the manager app to the browser etc...
artjacob 11y ago
So cute :)
jtchang 11y ago
It's easy to dismiss it as a phishing scam but these days some of them can be very convincing and elaborate. It's not hard to obscure URLs, obtain good looking SSL certs, and have a good story behind it. Social engineering will always work.
spyder 11y ago
"Critical points were that Mrs. Walsh needed a new garage door opener..." I'm surprised they only care about the electronic locks and didn't show how easy it is to pick most of the mechanical locks. Especially when they are talking about the "not hyperconnected" hacks.
- comex 11y ago
  Or, you know, break the window, if the garage has a window, or use some other more brute force technique. Less stealthy, but not incredibly different for most purposes.
  - ryanlol 11y ago
    And with just a roll of duct tape you can silently break a window.
cxseven 11y ago
Fake virus warnings also sucker a lot of older people. Putting them on Chromebooks kills a lot of birds with one stone.
- pja 11y ago
  There’s still the possibility of malicious Chrome extensions: I had to eliminate one or two from my son’s Chromebook recently. The naive will always be vulnerable to bad actors unfortunately.
  - axelfreeman 11y ago
    I recommend this extension to find malicious chrome extensions. https://chrome.google.com/webstore/detail/chrome-apps-extensions-de/ohmmkhmmmpcnpikjeljgnaoabkaalbgc https://chrome.google.com/webstore/detail/chrome-apps-extens...
methou 11y ago
>> To spare Mrs. Walsh any actual harm, the hackers used a service called Phish5, which does not actually store passwords and is often used by employers to test employees’ ability to spot malicious phishing cons. I'm signing up for Phish5. Looks like exactly what I need for my team.
axelfreeman 11y ago
Hackers can "pwn" you by not even hacking you. If someone can hack e.g. your phone provider or something you can get even worse problems and you did not anything wrong.
tefo-mohapi 11y ago
This is more about how hackers use phishing (old) to get passwords etc. Nothing new. Actually looks like phishing works best on those not hyperconnected or heavy internent users because they would most likely know the pitfalls.
downandout 11y ago
This is a silly article with an alarmist title. They look at a list of sites she likes on Facebook, then they phish her from one of them. Then she lets them into her house where they look for post-it notes with passwords on them. For a grand finale, they open her garage door. I guess the takeaway here is don't let people that identify themselves as "hackers" through your door and into your home office if you have passwords written on post-its, but I am fairly certain this is a rare occurrence.
- TazeTSchnitzel 11y ago
  The title isn't alarmist. The victim was an ordinary who didn't have a particularly "IoT" home and wasn't a heavy Internet user. They were hacked successfully. It is a useful article as a warning for non-technical people.
  - richmarr 11y ago
    To be honest I don't think technical people are above this either... either as civilians or as service designers
  - wellsjohnston 11y ago
    I think it kind of is. There wasn't really hacking involved here, just people taking advantage of an older woman and "pwning" her. Really cringey if you ask me.
    - kqr 11y ago
      This was the day when you learned how a huge portion of serious "hacking" is done. Taking advantage of the right older women is a very time efficient way of gaining access to systems you shouldn't have access to. If you want to know more, I can recommend The Art of Deception by Kevin Mitnick.
    - TazeTSchnitzel 11y ago
      Social engineering and brute force attacks aren't "hacking"? Come on.
dalacv 11y ago
does anyone really say 'Pwn' anymore?
- mhurron 11y ago
  https://en.wikipedia.org/wiki/Pwn2Own https://en.wikipedia.org/wiki/Pwn2Own
a3n 11y ago
So many people here are dismissing this as unsophisticated. Burglars have always targeted items that are valuable to them. Easy to sell, gets a good price, etc. Now we have digital assets in the home, and burglars are going to focus on those things too. For most of the population, and probably many of "us", physical access to those digital assets isn't particularly secure. And to have those assets "taken" today is much more far reaching than to have lost a stereo or checkbook. Just because the attacker had to get off his couch and go somewhere shouldn't minimize this threat. "Physical access means's you're pwned" is a true statement. One thing I do at home, for example, is to use full disk encryption on my laptop, and hibernate it when I leave. So that if someone steals it, it's just a plastic brick. For exactly the scenario described in the article.
- notfoss 11y ago
  I have always considered it to be a good practice to use disk encryption on laptops (or other mobile devices), but after thinking about the burglar scenario, I think it is better to encrypt the desktops as well.
curiousjorge 11y ago
yeah you can break into anyone's homes without a computer, imagine that media!
746F7475 11y ago
So "those not hyperconnected" means just normal people? I don't claim to be hacking proof since I don't control every bit of my data myself, but if someone came into my house they wouldn't find passwords in a notebook or saved passwords in my browsers
edem 11y ago
Aren't they crackers instead of hackers?
6stringmerc 11y ago
An interesting piece and definitely has some merit depending on the audience. False sense of security. Bad habits. This is kind of an exaggerated approach to teaching. For anybody who doubts that "gaining physical access" automatically disqualifies the results, let me share a recent uptick in a specific con in my area that could very well be adapted as a template to other unsuspecting areas: Two men in hard-hats and workman clothes approach a home, clipboard in hand, and claim to be with the "power company" and want to have a moment of time to talk about some trees close to the power lines. It's a right of way issue. They ask for the resident to come out and take a look with them. All seems pretty normal. The talker gets the person or couple's attention while the other makes a quick excuse to go back to the truck out in front of the house. The talker carries on about how they're going to take care of the trees at no cost to the residents, and they act very cordial overall. Meanwhile, the partner has gone into the home via the front door which was left unlocked, goes for the most likely targets of value (ex: jewelry). The partner goes to the truck while talker wraps up and leaves. By the time the residents notice anything is amiss, the duo are long gone. Trust-cons are a huge issue for a large portion of the population, in my opinion. Being prepared to be charmed while being fleeced is not how normal people go about their day.

105 points by pavornyoh 11y ago

Summary: Hackers send grandmother phishing mail. Grandmother enter her email address and password. Hackers go into house of Grandmother. Hackers change settings on router and and television of grandmother.

acbabis 11y ago
Yeah, this isn't really that scary as long as you know how to spot phishing scams. Am disappoint.
- onion2k 11y ago
  A chain is only as strong as its weakest link. If anyone has enough privileges for a malicious attacker to use their account/info to compromise your network then that is the measure of how well protected you are. In this case it was a grandmother, but it doesn't have to be. It could be a salesperson, an HR manager, a burnt out developer. When a business grows to a sufficient size that there are people working in it who are disinterested in "computers" or "processes" (in the case of a software startup that's probably over about 10 staff), then you suddenly introduce some huge weak points in your IT infrastructure. That should be scary.
  - acbabis 11y ago
    Yeah, I guess I should be scared that companies I trust might be making these types of mistakes; I hadn't seen it from that angle. I'm just disappointed that the article was about "hackers" but just talked about scams most of us are already aware of; seems kind of click-baity. They could have entitled the article "Here's One Easy Trick to Protect Yourself from Identity Theft."
nchelluri 11y ago
curious, is this really a bot or someone just providing a service under the guise of a bot? be pretty cool if it was the former. that would be some serious natural language processing. (not that i know anything about that subject) i read the article, this post does seem like a pretty accurate summary.
- mkagenius 11y ago
  Its difficult for one person to judge that. Some kind of bias creeps in when you read the article and see the summary again since your mind fills the gap automatically which is created by the summary.
lqdc13 11y ago
Yeah, I don't consider the phishing scams interesting at all. This seems like more of a marketing stunt than anything. And it's borderline not hacking. They actually didn't even do the whole thing themselves. Instead hired a phishing service... To me this is more similar to people dressed as UPS truck drivers going inside an apartment and stealing keys. Or a cashier taking a picture of a customer's credit card. P.S. Excellent bot if it is a bot. It seems to be taking sides on an issue and not just summarizing, which I haven't seen happen previously with any other summary bots.
- TazeTSchnitzel 11y ago
  Phishing is hacking. It's social engineering. They didn't 'hire a phishing service'. They used a website.
- rezistik 11y ago
  Social Engineering is absolutely hacking. This wasn't a sophisticated example, but it's still a very real threat.
  - coldpie 11y ago
    I guess I have a narrower definition of hacking, specifically that it is using technology in a way it wasn't intended. If you ask someone for their credentials and they give them to you, I don't see that as being "a hack," although I guess modern parlance would say the victim "was hacked."
    - kqr 11y ago
      "Hacking" is in everyday parlance not too far from "gaining unauthorised access to a technical system." Social engineering is often a very efficient alternative to rainbow tables, wiretapping, buffer overruns and other technical exploits.
      - rezistik 11y ago
        It's often the only or best way too. The more secure a place is the easier it is to get in. People become very trusting. Carry a clipbord and look like you know where you're going and you can walk damn near anywhere.

sdoering 11y ago

Well actually, looking at the things my parents and parents in law did on their home networks, their Smart TVs and so on, having this in a understandable form for the lay person is really good. To understand, that your door opener, your TV and other things can be "hacked" is important. The information to use different passwords for every service is important. We as people in the know have to help our elders and peers to see how easy it is to use a pwd-mgr and have a little bit more basic security. If nothing more, this piece goes a step in the right direction.

oAlbe 11y ago
Don't trust password managers. They are hackable pieces of software just like the ones you are trying to protect. And they are not reliable (see last news of Lastpass acquisition by LogMeIn). I'm not saying you should ditch password managers and just memorize all of your password. I'm just saying: use them as a well-informed user. Back in the days, Bruce Schneier suggested to write passwords down on a piece of paper and keep it in your wallet as the least weak security measure. Today, based on this article[0], he actually recommends the use of a password manager "[...] simply because it allows you to choose longer and stronger passwords.", which basically means it's the lesser of two evils. [0] https://www.schneier.com/blog/archives/2014/09/security_of_pas.html https://www.schneier.com/blog/archives/2014/09/security_of_p...
- scintill76 11y ago
  Not all password managers are commercial, closed-source, and cloud-connected. This probably wasn't a main point of yours, but since you mentioned LastPass I felt this should be clarified. I'm currently using PasswordSafe (in Wine on Linux) with git to version/synchronize between systems. It is kinda painful, but at least it's nice to not be syncing to somebody's cloud or running in a browser. I've been thinking about converting an old Android device into a more secure password manager. I envision having the device hold the decryption key for the PW "vault" as long as it's connected to my authenticated system. I either request credentials from the PC and approve on-device, or select them on the screen, and it types them as a USB keyboard (or perhaps some other way less prone to garden-variety keyloggers.) I guess I haven't because it's kind of a lot of effort and will lower convenience levels. :) I ought to at least find a better way than the clipboard, to transfer passwords from the manager app to the browser etc...

artjacob 11y ago

So cute :)

jtchang 11y ago

It's easy to dismiss it as a phishing scam but these days some of them can be very convincing and elaborate. It's not hard to obscure URLs, obtain good looking SSL certs, and have a good story behind it. Social engineering will always work.

spyder 11y ago

"Critical points were that Mrs. Walsh needed a new garage door opener..." I'm surprised they only care about the electronic locks and didn't show how easy it is to pick most of the mechanical locks. Especially when they are talking about the "not hyperconnected" hacks.

comex 11y ago
Or, you know, break the window, if the garage has a window, or use some other more brute force technique. Less stealthy, but not incredibly different for most purposes.
- ryanlol 11y ago
  And with just a roll of duct tape you can silently break a window.

cxseven 11y ago

Fake virus warnings also sucker a lot of older people. Putting them on Chromebooks kills a lot of birds with one stone.

pja 11y ago
There’s still the possibility of malicious Chrome extensions: I had to eliminate one or two from my son’s Chromebook recently. The naive will always be vulnerable to bad actors unfortunately.
- axelfreeman 11y ago
  I recommend this extension to find malicious chrome extensions. https://chrome.google.com/webstore/detail/chrome-apps-extensions-de/ohmmkhmmmpcnpikjeljgnaoabkaalbgc https://chrome.google.com/webstore/detail/chrome-apps-extens...

methou 11y ago

>> To spare Mrs. Walsh any actual harm, the hackers used a service called Phish5, which does not actually store passwords and is often used by employers to test employees’ ability to spot malicious phishing cons. I'm signing up for Phish5. Looks like exactly what I need for my team.

axelfreeman 11y ago

Hackers can "pwn" you by not even hacking you. If someone can hack e.g. your phone provider or something you can get even worse problems and you did not anything wrong.

tefo-mohapi 11y ago

This is more about how hackers use phishing (old) to get passwords etc. Nothing new. Actually looks like phishing works best on those not hyperconnected or heavy internent users because they would most likely know the pitfalls.

downandout 11y ago

This is a silly article with an alarmist title. They look at a list of sites she likes on Facebook, then they phish her from one of them. Then she lets them into her house where they look for post-it notes with passwords on them. For a grand finale, they open her garage door. I guess the takeaway here is don't let people that identify themselves as "hackers" through your door and into your home office if you have passwords written on post-its, but I am fairly certain this is a rare occurrence.

TazeTSchnitzel 11y ago
The title isn't alarmist. The victim was an ordinary who didn't have a particularly "IoT" home and wasn't a heavy Internet user. They were hacked successfully. It is a useful article as a warning for non-technical people.
- richmarr 11y ago
  To be honest I don't think technical people are above this either... either as civilians or as service designers
- wellsjohnston 11y ago
  I think it kind of is. There wasn't really hacking involved here, just people taking advantage of an older woman and "pwning" her. Really cringey if you ask me.
  - kqr 11y ago
    This was the day when you learned how a huge portion of serious "hacking" is done. Taking advantage of the right older women is a very time efficient way of gaining access to systems you shouldn't have access to. If you want to know more, I can recommend The Art of Deception by Kevin Mitnick.
  - TazeTSchnitzel 11y ago
    Social engineering and brute force attacks aren't "hacking"? Come on.

dalacv 11y ago

does anyone really say 'Pwn' anymore?

mhurron 11y ago
https://en.wikipedia.org/wiki/Pwn2Own https://en.wikipedia.org/wiki/Pwn2Own

a3n 11y ago

So many people here are dismissing this as unsophisticated. Burglars have always targeted items that are valuable to them. Easy to sell, gets a good price, etc. Now we have digital assets in the home, and burglars are going to focus on those things too. For most of the population, and probably many of "us", physical access to those digital assets isn't particularly secure. And to have those assets "taken" today is much more far reaching than to have lost a stereo or checkbook. Just because the attacker had to get off his couch and go somewhere shouldn't minimize this threat. "Physical access means's you're pwned" is a true statement. One thing I do at home, for example, is to use full disk encryption on my laptop, and hibernate it when I leave. So that if someone steals it, it's just a plastic brick. For exactly the scenario described in the article.

notfoss 11y ago
I have always considered it to be a good practice to use disk encryption on laptops (or other mobile devices), but after thinking about the burglar scenario, I think it is better to encrypt the desktops as well.

curiousjorge 11y ago

yeah you can break into anyone's homes without a computer, imagine that media!

746F7475 11y ago

So "those not hyperconnected" means just normal people? I don't claim to be hacking proof since I don't control every bit of my data myself, but if someone came into my house they wouldn't find passwords in a notebook or saved passwords in my browsers

edem 11y ago

Aren't they crackers instead of hackers?

6stringmerc 11y ago

An interesting piece and definitely has some merit depending on the audience. False sense of security. Bad habits. This is kind of an exaggerated approach to teaching. For anybody who doubts that "gaining physical access" automatically disqualifies the results, let me share a recent uptick in a specific con in my area that could very well be adapted as a template to other unsuspecting areas: Two men in hard-hats and workman clothes approach a home, clipboard in hand, and claim to be with the "power company" and want to have a moment of time to talk about some trees close to the power lines. It's a right of way issue. They ask for the resident to come out and take a look with them. All seems pretty normal. The talker gets the person or couple's attention while the other makes a quick excuse to go back to the truck out in front of the house. The talker carries on about how they're going to take care of the trees at no cost to the residents, and they act very cordial overall. Meanwhile, the partner has gone into the home via the front door which was left unlocked, goes for the most likely targets of value (ex: jewelry). The partner goes to the truck while talker wraps up and leaves. By the time the residents notice anything is amiss, the duo are long gone. Trust-cons are a huge issue for a large portion of the population, in my opinion. Being prepared to be charmed while being fleeced is not how normal people go about their day.