4 ms·
>> ...and this is an attack vector that actually does get used in the wild. I am starting to think this is the most important thing. Every time I read about an
by blakesterz 10y ago
>> ...and this is an attack vector that actually does get used in the wild.
I am starting to think this is the most important thing. Every time I read about an attack or a vulnerability 2 questions pop into my mind.
1. How easy is this to exploit remotely?
2. Is this an attack vector that actually does get used in the wild?
I usually finish both those questions off with "Today and what about next year?"
e.g. It's interesting that quantum computing is going to change quite a few things, but my list of worries is about 1,000 things long, and that's just way too far off to worry about today, or next year.
- dogma1138 10y agoYes this is a common tactic to keep compromised accounts. The attacker compromises the account and generates password recovery tokens. He then blackmails the user if the user resets it trough support or via account recovery the attacker uses a token to gain access to the account again. This is a very common tactic in blackmail for online game accounts. In fact this is also often used to bypass other security controls such as auto account locking. You compromise the email account, log on the IP or anything else triggers an automatic account unlock the user clears things up with support and the attacket uses the reset token to access the account without triggering a lockout this time around.