12 ms·

>APT10 often attacked a service provider’s system by “spear-phishing” – sending company employees emails sigh...

by nova22033 7y ago

kache_ 7y ago
It's a fairly complex and difficult task to phish proof your corporation.
- verdverm 7y ago
  Google claims they haven't been phished in over a year, since requiring hardware keys for auth.
  - kache_ 7y ago
    That's interesting. This should bring us to the realization that we should think of this as an engineering problem, rather than having an expectation of humans being "bug-free".
    - raverbashing 7y ago
      Well, after everybody and their mother pushed for 2FA they realized people can still get phished for the 2FA token, so... If the service that you're running is not made by idiots that will store your password with anything weaker than PBKDF2 then a strong (unique) password is still a good bet. Human factors are an issue and I believe lack of enforcement and prosecution is another issue.
    - ovi256 7y ago
      We definitely should! The current state of infosec as practiced, regarding, say, vulnerability to email trojan horses, is like using sharp knives for door handles, that instead of just mangling your fingers make a copy of the door keys and mail them to people who sent you emails. And then insisting that repeated user training is enough, and a cost-efficient counter-measure. Even in the face of repeated evidence that it's not. A rested, focused, well-trained human is almost bug-free. No one is rested, focused or well-trained 100% of the time.
    - codedokode 7y ago
      To me it is obvious that passwords are insecure. Just think how many people are saving them in a browser without a master password, share them in internal chats, use same password everywhere because it's difficult to remember several passwords etc.
  - MR4D 7y ago
    Can you help me understand how those relate to each other? For instance, someone gets a malicious email, and clicks on a link which downloads a bit of code the exploits a bug in the software to install something, perhaps a key logger or screen reader. What on earth does hardware keys do to eliminate that? Seriously, I can’t make the connection (and if I understood I’d probably roll that out across my firm tomorrow!).
    - verdverm 7y ago
      I phished for your login credentials, and I get them, but there is no way for me to effectively use them because there is still the hardware key step, which I do not have. Malware downloads is a separate issue from phishing schemes.
      - jjoonathan 7y ago
        Right, and even if they completely root an employee's laptop and phone they still can't get into the hardware key. Sure, they can "boop hijack" the key by popping up a convincing fake login prompt, but they have to synchronize their schedule to the employee they want to hijack and pull off a convincing fake login prompt each and every time they want to login, so the logistics are still much more challenging than copying a OTP seed.
        MR4D 7y ago
        Why go thru all that trouble when you can just phish with malware? I’m reminded of back when Kevin Mitnick said it wasn’t that he was a great hacker, but that he was good as social engineering. What made him good was that he took the easiest way in, which is kind of what my point is. I don’t care if you block the hardest hack - I care about blocking the easiest. (FWIW, I am a huge fan of 2FA, I just don’t understand how it stops phishing.)
        dasil003 7y ago
        You're moving the goalposts. GP was just explaining why base level phishing has been elevated to a higher difficulty level than without U2F. The way U2F prevents phishing is by binding auth requests to the requesting origin and generating unique key pairs for each origin, so it doesn't matter if the user is convinced and manually activates the key, the phishing site gains nothing it can use on a different origin—even in real time.
  - hguant 7y ago
    Google also is running (or claims to be running, I don't work at their IT department) an interesting zero-trust-networking setup involving a lot of on the fly certificate generation and revocation, as well as some SDN trickery behind the scenes. I wouldn't be surprised if that had more to do with their no haxx than 2FA or hardware auth keys. Link to their somewhat vague white papers on the matter: https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/
    - nickpsecurity 7y ago
      Security by obfuscation of techniques involved. Classic trick. It's the best so long as each security measure and their interactions are fairly secure.
      - opportune 7y ago
        I would say obfuscation is a valid strategy if also coupled with good security practices / algorithmic security. You're no less secure than if you were using the common flavors of good security practices (assuming you didn't create a mistake in rolling your own, which is a difficult assumption) but the effort required to target you is much higher than normal, and you are somewhat shielded from blanket-applying zero days.
    - xenospn 7y ago
      Google also does not allow Windows Laptops/PCs anywhere near their campus.
      - robocat 7y ago
        Exactly: Google detected they were hacked by the Chinese government a decade ago ("Operation Aurora" affecting a lot of other companies including Adobe, Juniper, Rackspace, Yahoo, Symantec, Northrop Grumman, Morgan Stanley, Dow Chemical). Google stopped allowing Windows to be used within the organisation in 2010 as a response. I think any other organisation that continued to use Windows values features more than they value security (and I believe that is still the case: you can't secure Windows, Office or Microsoft browsers against state level actors).
- godzillabrennus 7y ago
  http://knowbe4.com http://knowbe4.com has a pretty good training platform for creating more security awareness and for testing your users with generated phishing emails.
  - 0xcde4c3db 7y ago
    Which ends up being darkly hilarious when they're whitelisted, leading to a situation where literally every "phishing attempt" an employee ever sees is a fake crafted to conform to the stereotypes given in the training.
    - Tactic 7y ago
      Indeed. I setup a rule in outlook to look for knowbe4 in the header to dump those. Although, to be fair, I doubt it is the devs they are worried about.
    - logfromblammo 7y ago
      My employer uses PhishMe. Every "phishing attempt" I see is from my own employer. It is not adaptive. They don't scale up the apparent sophistication of the attack if previous attempt didn't work. So I am continually getting e-mails from "HR" asking me to update my contact info, or from "Expense Reports" asking me to verify some info to get reimbursed for my travel expenses. It's annoying.
- 0xcde4c3db 7y ago
  Especially when IT is more interested in outsourcing every possible service to a different company/domain. Office 365 alone involves a pretty staggering number, including such self-evidently trustworthy gems as "microsoftonline.com", "azurewebsites.net", and "aka.ms". It's hard to keep up with what's legitimate when seemingly everything you do involves a different domain with a different design language and account management process. Then there's the increasingly popular practice of running things "in-house" but actually on some half-assed cloud stack (What the heck are those stupid CloudFront subdomains, anyhow?).
  - notacoward 7y ago
    What's particularly annoying is that HR and finance functions are often among the most likely to involve outsourcing, even as they're also the most sensitive. If I wanted to spear-phish someone, it would probably be through something that looks related to a care provider or financial institution that the company uses, not to the company itself.
  - raghava 7y ago
    > It's hard to keep up with what's legitimate when seemingly everything you do involves a different domain with a different design language and account management process. Seriously, right! https://microsoftazuresponsorships.com https://microsoftazuresponsorships.com https://getlicensingready.com/ https://getlicensingready.com/ https://sysinternals.com https://sysinternals.com (fairly popular and well-known!) https://www.microsoftpartnercommunity.com/ https://www.microsoftpartnercommunity.com/ https://azureedge.net https://azureedge.net etc
    - deleted 7y ago
      [deleted]
    - zantana 7y ago
      More egregious to me has always been my various banks which start out at with bankofamerica.com, chase.com etc but after authentication and some hops I'm usually at something phishtastic like bankfrontend.com.

>APT10 often attacked a service provider’s system by “spear-phishing” – sending company employees emails sigh...

kache_ 7y ago

It's a fairly complex and difficult task to phish proof your corporation.

verdverm 7y ago
Google claims they haven't been phished in over a year, since requiring hardware keys for auth.
- kache_ 7y ago
  That's interesting. This should bring us to the realization that we should think of this as an engineering problem, rather than having an expectation of humans being "bug-free".
  - raverbashing 7y ago
    Well, after everybody and their mother pushed for 2FA they realized people can still get phished for the 2FA token, so... If the service that you're running is not made by idiots that will store your password with anything weaker than PBKDF2 then a strong (unique) password is still a good bet. Human factors are an issue and I believe lack of enforcement and prosecution is another issue.
  - ovi256 7y ago
    We definitely should! The current state of infosec as practiced, regarding, say, vulnerability to email trojan horses, is like using sharp knives for door handles, that instead of just mangling your fingers make a copy of the door keys and mail them to people who sent you emails. And then insisting that repeated user training is enough, and a cost-efficient counter-measure. Even in the face of repeated evidence that it's not. A rested, focused, well-trained human is almost bug-free. No one is rested, focused or well-trained 100% of the time.
  - codedokode 7y ago
    To me it is obvious that passwords are insecure. Just think how many people are saving them in a browser without a master password, share them in internal chats, use same password everywhere because it's difficult to remember several passwords etc.
- MR4D 7y ago
  Can you help me understand how those relate to each other? For instance, someone gets a malicious email, and clicks on a link which downloads a bit of code the exploits a bug in the software to install something, perhaps a key logger or screen reader. What on earth does hardware keys do to eliminate that? Seriously, I can’t make the connection (and if I understood I’d probably roll that out across my firm tomorrow!).
  - verdverm 7y ago
    I phished for your login credentials, and I get them, but there is no way for me to effectively use them because there is still the hardware key step, which I do not have. Malware downloads is a separate issue from phishing schemes.
    - jjoonathan 7y ago
      Right, and even if they completely root an employee's laptop and phone they still can't get into the hardware key. Sure, they can "boop hijack" the key by popping up a convincing fake login prompt, but they have to synchronize their schedule to the employee they want to hijack and pull off a convincing fake login prompt each and every time they want to login, so the logistics are still much more challenging than copying a OTP seed.
      - MR4D 7y ago
        Why go thru all that trouble when you can just phish with malware? I’m reminded of back when Kevin Mitnick said it wasn’t that he was a great hacker, but that he was good as social engineering. What made him good was that he took the easiest way in, which is kind of what my point is. I don’t care if you block the hardest hack - I care about blocking the easiest. (FWIW, I am a huge fan of 2FA, I just don’t understand how it stops phishing.)
        dasil003 7y ago
        You're moving the goalposts. GP was just explaining why base level phishing has been elevated to a higher difficulty level than without U2F. The way U2F prevents phishing is by binding auth requests to the requesting origin and generating unique key pairs for each origin, so it doesn't matter if the user is convinced and manually activates the key, the phishing site gains nothing it can use on a different origin—even in real time.
- hguant 7y ago
  Google also is running (or claims to be running, I don't work at their IT department) an interesting zero-trust-networking setup involving a lot of on the fly certificate generation and revocation, as well as some SDN trickery behind the scenes. I wouldn't be surprised if that had more to do with their no haxx than 2FA or hardware auth keys. Link to their somewhat vague white papers on the matter: https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/
  - nickpsecurity 7y ago
    Security by obfuscation of techniques involved. Classic trick. It's the best so long as each security measure and their interactions are fairly secure.
    - opportune 7y ago
      I would say obfuscation is a valid strategy if also coupled with good security practices / algorithmic security. You're no less secure than if you were using the common flavors of good security practices (assuming you didn't create a mistake in rolling your own, which is a difficult assumption) but the effort required to target you is much higher than normal, and you are somewhat shielded from blanket-applying zero days.
  - xenospn 7y ago
    Google also does not allow Windows Laptops/PCs anywhere near their campus.
    - robocat 7y ago
      Exactly: Google detected they were hacked by the Chinese government a decade ago ("Operation Aurora" affecting a lot of other companies including Adobe, Juniper, Rackspace, Yahoo, Symantec, Northrop Grumman, Morgan Stanley, Dow Chemical). Google stopped allowing Windows to be used within the organisation in 2010 as a response. I think any other organisation that continued to use Windows values features more than they value security (and I believe that is still the case: you can't secure Windows, Office or Microsoft browsers against state level actors).
godzillabrennus 7y ago
http://knowbe4.com http://knowbe4.com has a pretty good training platform for creating more security awareness and for testing your users with generated phishing emails.
- 0xcde4c3db 7y ago
  Which ends up being darkly hilarious when they're whitelisted, leading to a situation where literally every "phishing attempt" an employee ever sees is a fake crafted to conform to the stereotypes given in the training.
  - Tactic 7y ago
    Indeed. I setup a rule in outlook to look for knowbe4 in the header to dump those. Although, to be fair, I doubt it is the devs they are worried about.
  - logfromblammo 7y ago
    My employer uses PhishMe. Every "phishing attempt" I see is from my own employer. It is not adaptive. They don't scale up the apparent sophistication of the attack if previous attempt didn't work. So I am continually getting e-mails from "HR" asking me to update my contact info, or from "Expense Reports" asking me to verify some info to get reimbursed for my travel expenses. It's annoying.
0xcde4c3db 7y ago
Especially when IT is more interested in outsourcing every possible service to a different company/domain. Office 365 alone involves a pretty staggering number, including such self-evidently trustworthy gems as "microsoftonline.com", "azurewebsites.net", and "aka.ms". It's hard to keep up with what's legitimate when seemingly everything you do involves a different domain with a different design language and account management process. Then there's the increasingly popular practice of running things "in-house" but actually on some half-assed cloud stack (What the heck are those stupid CloudFront subdomains, anyhow?).
- notacoward 7y ago
  What's particularly annoying is that HR and finance functions are often among the most likely to involve outsourcing, even as they're also the most sensitive. If I wanted to spear-phish someone, it would probably be through something that looks related to a care provider or financial institution that the company uses, not to the company itself.
- raghava 7y ago
  > It's hard to keep up with what's legitimate when seemingly everything you do involves a different domain with a different design language and account management process. Seriously, right! https://microsoftazuresponsorships.com https://microsoftazuresponsorships.com https://getlicensingready.com/ https://getlicensingready.com/ https://sysinternals.com https://sysinternals.com (fairly popular and well-known!) https://www.microsoftpartnercommunity.com/ https://www.microsoftpartnercommunity.com/ https://azureedge.net https://azureedge.net etc
  - deleted 7y ago
    [deleted]
  - zantana 7y ago
    More egregious to me has always been my various banks which start out at with bankofamerica.com, chase.com etc but after authentication and some hops I'm usually at something phishtastic like bankfrontend.com.