5 ms·

As always with security the first thing to ask is "What is your threat model?" This person's threat model seems to be people who email him for a legitimate bus

As always with security the first thing to ask is "What is your threat model?" This person's threat model seems to be people who email him for a legitimate business reason, but see that he's away & take the opportunity to attack him? I just don't buy it - I think there is nothing wrong with always setting an autoresponder.

markovbot 8y ago
I think the point is that autoresponders will autorespond to legitimate business emails as well as phishing/scam/whatever other emails.
- kovrik 8y ago
  So the attacker gets autoresponse. What's next? What is the attack vector here? UPD: also, I guess any attacker could just assume that you're Out of Office at night time.
  - toomuchtodo 8y ago
    EDIT: To be clear, I don't think this is a serious threat whatsoever, and went through the exercise as an explanation. Go easy on my comments, just having fun thinking it through. Impersonate the person out of town to escalate to their privilege level. Imposter: "My password isn't working, can you help me reset it?" Yes, this is unlikely to to work in smaller orgs where you know people face to face. It is more likely to work as the org scales up in size (think enterprises with their own helpdesk). Once you have email and/or other federated access, you have a toehold. Bonus points if you've cloned their work cell SIM or have rerouted SIP for their desk phone to keep them out of the loop. I have seen weaker phishing attacks on financial/accounting staff who have the authority to move millions of dollars of corporate funds. EDIT: > Whom the would-be attackers send this email to? Phishing target > Do they send this email from their own email address? Throw away address or spoofed address from a familiar-to-the-business domain. > Is there an assumption that sysadmin/support team will blindly reset a password on someone else's request? This is one assumption. > How do attackers bypass corporate VPN? VPN access might not be required to obtain the level of access desired. Do all of your SaaS providers require 2FA? Your business bank accounts?
    - kovrik 8y ago
      Sorry, still not clear to me. - Whom the would-be attackers send this email to? - Do they send this email from their own email address? - Is there an assumption that sysadmin/support team will blindly reset a password on someone else's request? - How do attackers bypass corporate VPN?
    - vegannet 8y ago
      Any organisation where “hey I forgot my password, can you reset it?” from an unknown email address is an attack that has chance of success is an organisation where there’s dozens of major problems long before you get to auto-responders identifying who is away from the office.
      - toomuchtodo 8y ago
        You're assuming I can't hop on the phone (appearing to come from a known number using Caller ID spoofing, using LinkedIn to get a general idea of the org chart) and bluff my way through it with your underpaid, overworked help desk staff. People are the weakest link. This is only a few steps above Indian scammers taking remote control of users’ computers and convincing those users to send them hundreds of dollars of gift cards to prevent legal action by the IRS. Consider your average user, not the HN participant. https://www.youtube.com/watch?v=YVqurfWzB-Q https://www.youtube.com/watch?v=YVqurfWzB-Q (Hacking Humans : Social Engineering Techniques and How to Protect Against Them - Stephen Haunts)
        vegannet 8y ago
        We are arguing different points. I’m saying _if_ an organisation _is_ insecure enough for social engineering to work then a vacation auto-responder is not going to represent any meaningful increase in risk.
        toomuchtodo 8y ago
        I am arguing that _most_ organizations are insecure enough for social engineering to work, and that autoresponders are yet another vector. Orgs that observe proper operational security are still a minority.
  - Too 8y ago
    If attacker gets info you are out of office for 2 weeks it most likely also means you are traveling and out of home for 2 weeks. Perfect opportunity for burglary. This is not a hypothetical scenario, almost every year there is some idiot saying they going for vacation in those mini-interviews in the local newspaper and then they get their house broken into. However the probability that someone does email you and is a burglar at the same time is extremely small.
- asdfasgasdgasdg 8y ago
  Not all of them do. Gmail can be set to only respond to people who you've had contact with before.
throwawaymath 8y ago
Yeah, this is a stretch... I'm getting pretty tired of this kind of thing. It's pretty clear to me that the infosec industry (within appsec and netsec at least, not risk and compliance) is bifurcated into two distinct groups. The first group consists of people who have real technical expertise, find serious vulnerabilities and make concrete suggestions about legitimate issues. The second group, and the one I see more and more often (especially in bug bounties), consists of people who find ridiculous "security" "risks" in all manner of things. They're not appsec or netsec people but they think they're identifying actual security issues. Sometimes they point out superfluous implementation issues but more often than not they're writing articles like this - nitpicking the design of a thing without clarifying their threat model and with only a vague grounding in the potential risk of compromise. I mean did we really need a security PSA about the risk of email autoresponders? Come on.
- coding123 8y ago
  At some point we just can't do more to thwart every possible threat. What are we going to be told to sneak out the back door of our house and walk 3 blocks to where we parked our car?
- jordz 8y ago
  Absolutely couldn’t agree more.
- userbinator 8y ago
  I have heard the term "security vultures" being applied to the second group, and wish it was more common (the term, not the group...)
  - CoreSet 8y ago
    I like "security fatalism" for the underlying behavior.
- sho 8y ago
  I've had a member of the second group, describing himself as a "certified white hat hacker", sign up for a small SAAS product I'm involved with, mess around a bit and then file a slew of "urgent vulnerability reports" of supposed security issues, all of them profoundly so-whattish in the context of a niche business SAAS. When I closed them all without further action, the chap then had the gall to demand payment - or at least a "certificate of appreciation" he could parlay into future business. Needless to say we declined. This lack of any concept of a threat model was precisely why his (considerable) effort was totally wasted and I can imagine similar "researchers" giving the industry as a whole a bad name.
zebraflask 8y ago
This is an interesting discussion. I can see the author's point - maybe, as a thought experiment, an attacker could latch onto the fact that someone is out of the office and use that as a wedge. Along the lines of "John and I had a payment planned, but he's out of the office, can you send it to [fake destination]?" But, like other people have noted, you also have to weigh the chance of that happening in real life. It seems like the amount of planning on the attacker's part would be significant enough that if they could pull it off, they would have found easier targets by then.
- EvanAnderson 8y ago
  I actually did see a situation just like that, and it amounted to lucky diligence on the part of a third-party that the situation was detected before it was too late. A guy in an Accounts Receivable role got phished. He went on a two week vacation, and bright-and-early on the first day he was out the phisher sent out emails as the vacationing AR person to a number of Customers advising them that remittance processing was being handled by a new third-party. They directed all the Customers to that third-party's "new" bank account. The attacker helpfully put a rule on the guy's Inbox to move new messages from every domain that the attacker emailed directly to "Deleted Items". One of the Customers thought it seemed a bit fishy and called-in to confirm that very first day.
- volkl48 8y ago
  Even that would be hard to use in real life, as an "out of office message" does not mean that their colleagues can't easily reach them. If you're some outsider you don't know if that person is really unreachable or if their colleagues can easily reach them on Slack/send them a text/whatever if they have some important question. And if you are internal/close enough to know their time off plans and that they're going backpacking in the Canadian Arctic, you didn't need the message to tell you they're out of office.
mc32 8y ago
Wouldn't an autoresponder for your email domain users and people in your addressbook be enough? The rest of the people don't need to know you're out of the office (by and large). Of course, if you're in sales that's diff but also has little sec implication. (Any internal threat would know you're out by other means anyhow)
monochromatic 8y ago
Still, I’d rather just forward my email to my assistant while I’m gone. If it’s urgent it’ll get handled. If not, it’ll wait.
- mprev 8y ago
  Can we all forward our email to your assistant too?
  - MiddleEndian 8y ago
    And who assists the assistants?
ce4 8y ago
Maybe his threat model is an attack to his position/team from within the corp. Should also apply to politicians within the party :-) Then it of course makes sense to not send these mails and read and answer them.

markovbot 8y ago

I think the point is that autoresponders will autorespond to legitimate business emails as well as phishing/scam/whatever other emails.

kovrik 8y ago
So the attacker gets autoresponse. What's next? What is the attack vector here? UPD: also, I guess any attacker could just assume that you're Out of Office at night time.
- toomuchtodo 8y ago
  EDIT: To be clear, I don't think this is a serious threat whatsoever, and went through the exercise as an explanation. Go easy on my comments, just having fun thinking it through. Impersonate the person out of town to escalate to their privilege level. Imposter: "My password isn't working, can you help me reset it?" Yes, this is unlikely to to work in smaller orgs where you know people face to face. It is more likely to work as the org scales up in size (think enterprises with their own helpdesk). Once you have email and/or other federated access, you have a toehold. Bonus points if you've cloned their work cell SIM or have rerouted SIP for their desk phone to keep them out of the loop. I have seen weaker phishing attacks on financial/accounting staff who have the authority to move millions of dollars of corporate funds. EDIT: > Whom the would-be attackers send this email to? Phishing target > Do they send this email from their own email address? Throw away address or spoofed address from a familiar-to-the-business domain. > Is there an assumption that sysadmin/support team will blindly reset a password on someone else's request? This is one assumption. > How do attackers bypass corporate VPN? VPN access might not be required to obtain the level of access desired. Do all of your SaaS providers require 2FA? Your business bank accounts?
  - kovrik 8y ago
    Sorry, still not clear to me. - Whom the would-be attackers send this email to? - Do they send this email from their own email address? - Is there an assumption that sysadmin/support team will blindly reset a password on someone else's request? - How do attackers bypass corporate VPN?
  - vegannet 8y ago
    Any organisation where “hey I forgot my password, can you reset it?” from an unknown email address is an attack that has chance of success is an organisation where there’s dozens of major problems long before you get to auto-responders identifying who is away from the office.
    - toomuchtodo 8y ago
      You're assuming I can't hop on the phone (appearing to come from a known number using Caller ID spoofing, using LinkedIn to get a general idea of the org chart) and bluff my way through it with your underpaid, overworked help desk staff. People are the weakest link. This is only a few steps above Indian scammers taking remote control of users’ computers and convincing those users to send them hundreds of dollars of gift cards to prevent legal action by the IRS. Consider your average user, not the HN participant. https://www.youtube.com/watch?v=YVqurfWzB-Q https://www.youtube.com/watch?v=YVqurfWzB-Q (Hacking Humans : Social Engineering Techniques and How to Protect Against Them - Stephen Haunts)
      - vegannet 8y ago
        We are arguing different points. I’m saying _if_ an organisation _is_ insecure enough for social engineering to work then a vacation auto-responder is not going to represent any meaningful increase in risk.
        toomuchtodo 8y ago
        I am arguing that _most_ organizations are insecure enough for social engineering to work, and that autoresponders are yet another vector. Orgs that observe proper operational security are still a minority.
- Too 8y ago
  If attacker gets info you are out of office for 2 weeks it most likely also means you are traveling and out of home for 2 weeks. Perfect opportunity for burglary. This is not a hypothetical scenario, almost every year there is some idiot saying they going for vacation in those mini-interviews in the local newspaper and then they get their house broken into. However the probability that someone does email you and is a burglar at the same time is extremely small.
asdfasgasdgasdg 8y ago
Not all of them do. Gmail can be set to only respond to people who you've had contact with before.

throwawaymath 8y ago

Yeah, this is a stretch... I'm getting pretty tired of this kind of thing. It's pretty clear to me that the infosec industry (within appsec and netsec at least, not risk and compliance) is bifurcated into two distinct groups. The first group consists of people who have real technical expertise, find serious vulnerabilities and make concrete suggestions about legitimate issues. The second group, and the one I see more and more often (especially in bug bounties), consists of people who find ridiculous "security" "risks" in all manner of things. They're not appsec or netsec people but they think they're identifying actual security issues. Sometimes they point out superfluous implementation issues but more often than not they're writing articles like this - nitpicking the design of a thing without clarifying their threat model and with only a vague grounding in the potential risk of compromise. I mean did we really need a security PSA about the risk of email autoresponders? Come on.

coding123 8y ago
At some point we just can't do more to thwart every possible threat. What are we going to be told to sneak out the back door of our house and walk 3 blocks to where we parked our car?
jordz 8y ago
Absolutely couldn’t agree more.
userbinator 8y ago
I have heard the term "security vultures" being applied to the second group, and wish it was more common (the term, not the group...)
- CoreSet 8y ago
  I like "security fatalism" for the underlying behavior.
sho 8y ago
I've had a member of the second group, describing himself as a "certified white hat hacker", sign up for a small SAAS product I'm involved with, mess around a bit and then file a slew of "urgent vulnerability reports" of supposed security issues, all of them profoundly so-whattish in the context of a niche business SAAS. When I closed them all without further action, the chap then had the gall to demand payment - or at least a "certificate of appreciation" he could parlay into future business. Needless to say we declined. This lack of any concept of a threat model was precisely why his (considerable) effort was totally wasted and I can imagine similar "researchers" giving the industry as a whole a bad name.

zebraflask 8y ago

This is an interesting discussion. I can see the author's point - maybe, as a thought experiment, an attacker could latch onto the fact that someone is out of the office and use that as a wedge. Along the lines of "John and I had a payment planned, but he's out of the office, can you send it to [fake destination]?" But, like other people have noted, you also have to weigh the chance of that happening in real life. It seems like the amount of planning on the attacker's part would be significant enough that if they could pull it off, they would have found easier targets by then.

EvanAnderson 8y ago
I actually did see a situation just like that, and it amounted to lucky diligence on the part of a third-party that the situation was detected before it was too late. A guy in an Accounts Receivable role got phished. He went on a two week vacation, and bright-and-early on the first day he was out the phisher sent out emails as the vacationing AR person to a number of Customers advising them that remittance processing was being handled by a new third-party. They directed all the Customers to that third-party's "new" bank account. The attacker helpfully put a rule on the guy's Inbox to move new messages from every domain that the attacker emailed directly to "Deleted Items". One of the Customers thought it seemed a bit fishy and called-in to confirm that very first day.
volkl48 8y ago
Even that would be hard to use in real life, as an "out of office message" does not mean that their colleagues can't easily reach them. If you're some outsider you don't know if that person is really unreachable or if their colleagues can easily reach them on Slack/send them a text/whatever if they have some important question. And if you are internal/close enough to know their time off plans and that they're going backpacking in the Canadian Arctic, you didn't need the message to tell you they're out of office.

mc32 8y ago

Wouldn't an autoresponder for your email domain users and people in your addressbook be enough? The rest of the people don't need to know you're out of the office (by and large). Of course, if you're in sales that's diff but also has little sec implication. (Any internal threat would know you're out by other means anyhow)

monochromatic 8y ago

Still, I’d rather just forward my email to my assistant while I’m gone. If it’s urgent it’ll get handled. If not, it’ll wait.

mprev 8y ago
Can we all forward our email to your assistant too?
- MiddleEndian 8y ago
  And who assists the assistants?

ce4 8y ago

Maybe his threat model is an attack to his position/team from within the corp. Should also apply to politicians within the party :-) Then it of course makes sense to not send these mails and read and answer them.