4 ms·

Social engineering in tech has been around since before Kevin Mitnick publicized it and went to jail (unjustly). Why do we keep making the same mistakes over a

Social engineering in tech has been around since before Kevin Mitnick publicized it and went to jail (unjustly). Why do we keep making the same mistakes over and over again as an industry? We NEED UNIFORM security standards with ALL trusted companies with customer support, where we have tiers of support, and 1st tier doesn't have any access that could compromised security. Similar to ISO standards. This means there can't be any "impedance" mismatching that can be used from one service to another. For example, one company gives out the last 4 digits of the credit card, and the other uses the last 4 as security info. What we need is a uniform security standard and training for ALL customer support personnel so that you can use Apple to break into Amazon, or Digital Ocean or Namecheap. The staff need to be trained to never succumb to social engineering ever, and in fact make it impossible for 1st line support to reset anything. Have any security information get passed up to second tier support who are extremely well-trained. Etc. And have this standardized so that there is incentive for customers to look for this certification so that we don't have to keep suffering the same mistakes over and over again.

Someone1234 11y ago
> Kevin Mitnick publicized it and went to jail (unjustly) You're joking right? He even fully admits that he did what they accused him of doing.
- Negative1 11y ago
  Ever heard of a plea deal? He was obligated to 'admit wrongdoing' in order to get a reduced sentence. Sure, he could have stuck to his guns, but, jail has very bad internet.
  - Someone1234 11y ago
    I meant in his book and speeches he has since given he has admitted doing more or less what they accused him of doing. I'd definitely agree that the solitary confinement was cruel and unusual. I'd also agree that the law wasn't mature enough when he was charged so he was charged with proxy-laws. But ultimately he did do what they said he did, and some of it was pretty messed up. He would definitely be charged today with computer crimes (or generic crimes) for many of his exploits at the time.
    - josefresco 11y ago
      I would imagine owning up to his "crimes" helps his business / brand. If he disclaimed all credit, he would be seen less an an expert in his field of work. https://www.mitnicksecurity.com https://www.mitnicksecurity.com
- henrik_w 11y ago
  FWIW, I've only read Ghost in the Wire, but all he admits to there is that he broke into systems and download the source code för various systems. Nothing destructive, nothing he made any money off. (the book is great, by the way, highly recommended)
- pfarnsworth 11y ago
  Do you know anything about the case? They said he shouldn't even use the phone and spent time in solitary because they said he could cause a nuclear war. The entire case against him was horrifying to anyone that cares about human rights.
tamar 11y ago
I hate to break it to you, but "uniform" security standards that are out there in the open would be like a whole can of worms. That is like showing someone "here's a lock and what's inside of it." In time, someone will pick that lock. Uniformity is what you don't need, nor would you want to know the nuances of how security and privacy are handled at a company so that you know exactly what holes need to be exposed. You can't standardize security. It's way too risky.
- gherkin0 11y ago
  You're basically advocating for security through obscurity. A standardized process design could be carefully examined and improved to plug the holes, so all you're left with are implementation bugs. You'll never get there with a thousand disparate processes: they'll have design and implementation bugs, as well situations where system compromises data used to secure another. Plus, standardized processes would allow implementation of more expensive processes. For instance, you could have a higher-grade fallback "prove who you are" process that involves going to some designated office in-person with all the right documents. Not even Google would pay to setup such offices in every city, but if Google, Amazon, Online Banks, etc. all would use it, it might be possible.
  - tamar 11y ago
    That's exactly what I'm advocating. Standardization would expose millions of people to policies that can be exploited in time. It's better for all of us not to know. I know, this is an issue some would disagree with. I do not think it's safe to standardize at all.
- neohaven 11y ago
  "Here's a lock and here's what inside it, but you still can't break it because you lack a separate secret of no mechanical relevance" is the only way to make a system secure. If it is possible at all, you WANT a system where knowledge of all the mechanics do not allow people to crack the safe. See encryption. A secure crypto mechanism is not vulnerable to disclosure of its mechanism. The key is the secret. The mechanism is not. Having a secret mechanism that relies on its own secrecy means your main weakness is someone explaining how it works to the outside world. RSA is perfectly well-known. So is rot13. rot13 is crap, disclosure or not. RSA is not as crap, disclosure or not.
brador 11y ago
We need automated security protocols with real humans only for emergencies, edge cases, or where things go wrong. There is no reason for Namecheap to have a human in the loop for this, at this stage.
raverbashing 11y ago
While "security specialists" are using last digits of CC and mother's maiden name as secure info I'm not holding my breath
peterwwillis 11y ago
As a business, it costs more to piss off your customers regularly because they can't get into their accounts than it does to refund the rare victim of social engineering.
- pfarnsworth 11y ago
  Sounds exactly like what I would expect from a lazy, shortsighted business who believed that a successful social engineering attempt wouldn't cost them more money.
henrik_w 11y ago
Talking about Kevin Minnick, I can really recommend his book Ghost in the Wires, both for the story and the numerous great examples of social engineering https://henrikwarne.com/2015/12/27/social-engineering-from-kevin-mitnick/ https://henrikwarne.com/2015/12/27/social-engineering-from-k...
deegles 11y ago
I like this idea. If you want to work as a CS rep and handle password resets, you need to have XYZ 1.0 security training, regardless of the company.

Someone1234 11y ago

> Kevin Mitnick publicized it and went to jail (unjustly) You're joking right? He even fully admits that he did what they accused him of doing.

Negative1 11y ago
Ever heard of a plea deal? He was obligated to 'admit wrongdoing' in order to get a reduced sentence. Sure, he could have stuck to his guns, but, jail has very bad internet.
- Someone1234 11y ago
  I meant in his book and speeches he has since given he has admitted doing more or less what they accused him of doing. I'd definitely agree that the solitary confinement was cruel and unusual. I'd also agree that the law wasn't mature enough when he was charged so he was charged with proxy-laws. But ultimately he did do what they said he did, and some of it was pretty messed up. He would definitely be charged today with computer crimes (or generic crimes) for many of his exploits at the time.
  - josefresco 11y ago
    I would imagine owning up to his "crimes" helps his business / brand. If he disclaimed all credit, he would be seen less an an expert in his field of work. https://www.mitnicksecurity.com https://www.mitnicksecurity.com
henrik_w 11y ago
FWIW, I've only read Ghost in the Wire, but all he admits to there is that he broke into systems and download the source code för various systems. Nothing destructive, nothing he made any money off. (the book is great, by the way, highly recommended)
pfarnsworth 11y ago
Do you know anything about the case? They said he shouldn't even use the phone and spent time in solitary because they said he could cause a nuclear war. The entire case against him was horrifying to anyone that cares about human rights.

tamar 11y ago

I hate to break it to you, but "uniform" security standards that are out there in the open would be like a whole can of worms. That is like showing someone "here's a lock and what's inside of it." In time, someone will pick that lock. Uniformity is what you don't need, nor would you want to know the nuances of how security and privacy are handled at a company so that you know exactly what holes need to be exposed. You can't standardize security. It's way too risky.

gherkin0 11y ago
You're basically advocating for security through obscurity. A standardized process design could be carefully examined and improved to plug the holes, so all you're left with are implementation bugs. You'll never get there with a thousand disparate processes: they'll have design and implementation bugs, as well situations where system compromises data used to secure another. Plus, standardized processes would allow implementation of more expensive processes. For instance, you could have a higher-grade fallback "prove who you are" process that involves going to some designated office in-person with all the right documents. Not even Google would pay to setup such offices in every city, but if Google, Amazon, Online Banks, etc. all would use it, it might be possible.
- tamar 11y ago
  That's exactly what I'm advocating. Standardization would expose millions of people to policies that can be exploited in time. It's better for all of us not to know. I know, this is an issue some would disagree with. I do not think it's safe to standardize at all.
neohaven 11y ago
"Here's a lock and here's what inside it, but you still can't break it because you lack a separate secret of no mechanical relevance" is the only way to make a system secure. If it is possible at all, you WANT a system where knowledge of all the mechanics do not allow people to crack the safe. See encryption. A secure crypto mechanism is not vulnerable to disclosure of its mechanism. The key is the secret. The mechanism is not. Having a secret mechanism that relies on its own secrecy means your main weakness is someone explaining how it works to the outside world. RSA is perfectly well-known. So is rot13. rot13 is crap, disclosure or not. RSA is not as crap, disclosure or not.

brador 11y ago

We need automated security protocols with real humans only for emergencies, edge cases, or where things go wrong. There is no reason for Namecheap to have a human in the loop for this, at this stage.

raverbashing 11y ago

While "security specialists" are using last digits of CC and mother's maiden name as secure info I'm not holding my breath

peterwwillis 11y ago

As a business, it costs more to piss off your customers regularly because they can't get into their accounts than it does to refund the rare victim of social engineering.

pfarnsworth 11y ago
Sounds exactly like what I would expect from a lazy, shortsighted business who believed that a successful social engineering attempt wouldn't cost them more money.

henrik_w 11y ago

Talking about Kevin Minnick, I can really recommend his book Ghost in the Wires, both for the story and the numerous great examples of social engineering https://henrikwarne.com/2015/12/27/social-engineering-from-kevin-mitnick/ https://henrikwarne.com/2015/12/27/social-engineering-from-k...

deegles 11y ago

I like this idea. If you want to work as a CS rep and handle password resets, you need to have XYZ 1.0 security training, regardless of the company.