5 ms·

That comment ended very differently than I expected it to. What rubs me the wrong way is that they'd doubt the call. It'd take seconds to process "how can the

That comment ended very differently than I expected it to. What rubs me the wrong way is that they'd doubt the call. It'd take seconds to process "how can the attacker benefit from this" and come up empty. After all it's not like he was calling them and offering to fix the issue, he was literally giving them a heads up, the worst that could happen is a wasted call to the bank.

jonas21 7y ago
> the worst that could happen is a wasted call to the bank. Well, no. The worst (and probably very likely) thing that would happen is they would call the bank, the bank would block withdrawals from their payroll processor, and they would miss payroll for that period. This could also have severe financial consequences for the company's employees, given how many people live paycheck to paycheck. Small businesses are constantly inundated with all varieties of scam calls, so it's not at all unreasonable to be suspicious of someone who calls you out of the blue and says, "Your payroll accounts have been hacked, and you’re about to lose a great deal of money. You should contact your bank immediately." The odds of ever getting a call from a good samaritan like Brian Krebs are vanishingly small, while you're probably getting called by scammers every day.
- BoorishBears 7y ago
  That's not true though... He says right there, the fraudulent payroll payments were many times the normal amount and not part of the normal cycle. In fact, from what he described, even the bank would have picked up on the fraudulent transactions upon human review. Small businesses are not going to confuse out-of-cycle payroll payments with normal ones, cash flow is way too tight for mistakes like that. - I'm also not saying it's unreasonable to be suspicious of the call, but after that initial suspicion, it's unreasonable not to hang up immediately on the scammer... then make a "sanity call" to bank/payroll processor/both
  - perl4ever 7y ago
    This is like asking why people crash planes when one of their instruments is telling them bad information and the others are all working fine. Once you know something important isn't trustworthy, it's easy and likely to become very disoriented as to what you can trust. This is why people reflexively doubt anything particularly out of the ordinary - it might rarely be wrong, but it's far better than becoming paranoid at every drop of a hat.
cortesoft 7y ago
Just because you can't think of how an attack can benefit from this in a few seconds doesn't mean there isn't a way. Making a security decision based on your inability to think of how it could be a danger in seconds is a pretty foolhardy strategy.
- BoorishBears 7y ago
  It's crazy how every reply to this comment is arguing a complete strawman. The other comment is arguing you could accidentally cancel payroll, which tells me they've never had to worry about payroll before. This one is claiming I'm advocating making a "security decision based on...". - It's making a sanity check based on a few seconds of conversation. If you didn't know, confirming a withdrawal for many times your normal payroll from your payroll account to an unknown account at the wrong time is fraudulent takes very little effort past a phone call. That effort is easily worth it based on an off-the-cuff risk assessment.
  - perl4ever 7y ago
    Fundamentally, you can't do a risk assessment in response to someone telling you you're about to collide with an "unknown unknown". Most of the time, assuming the source is maliciously trying to confuse you is a better choice than doubting everything. When arguing from an armchair on the internet, somehow people forget what actual uncertainty under stress is like.

jonas21 7y ago

> the worst that could happen is a wasted call to the bank. Well, no. The worst (and probably very likely) thing that would happen is they would call the bank, the bank would block withdrawals from their payroll processor, and they would miss payroll for that period. This could also have severe financial consequences for the company's employees, given how many people live paycheck to paycheck. Small businesses are constantly inundated with all varieties of scam calls, so it's not at all unreasonable to be suspicious of someone who calls you out of the blue and says, "Your payroll accounts have been hacked, and you’re about to lose a great deal of money. You should contact your bank immediately." The odds of ever getting a call from a good samaritan like Brian Krebs are vanishingly small, while you're probably getting called by scammers every day.

BoorishBears 7y ago
That's not true though... He says right there, the fraudulent payroll payments were many times the normal amount and not part of the normal cycle. In fact, from what he described, even the bank would have picked up on the fraudulent transactions upon human review. Small businesses are not going to confuse out-of-cycle payroll payments with normal ones, cash flow is way too tight for mistakes like that. - I'm also not saying it's unreasonable to be suspicious of the call, but after that initial suspicion, it's unreasonable not to hang up immediately on the scammer... then make a "sanity call" to bank/payroll processor/both
- perl4ever 7y ago
  This is like asking why people crash planes when one of their instruments is telling them bad information and the others are all working fine. Once you know something important isn't trustworthy, it's easy and likely to become very disoriented as to what you can trust. This is why people reflexively doubt anything particularly out of the ordinary - it might rarely be wrong, but it's far better than becoming paranoid at every drop of a hat.

cortesoft 7y ago

Just because you can't think of how an attack can benefit from this in a few seconds doesn't mean there isn't a way. Making a security decision based on your inability to think of how it could be a danger in seconds is a pretty foolhardy strategy.

BoorishBears 7y ago
It's crazy how every reply to this comment is arguing a complete strawman. The other comment is arguing you could accidentally cancel payroll, which tells me they've never had to worry about payroll before. This one is claiming I'm advocating making a "security decision based on...". - It's making a sanity check based on a few seconds of conversation. If you didn't know, confirming a withdrawal for many times your normal payroll from your payroll account to an unknown account at the wrong time is fraudulent takes very little effort past a phone call. That effort is easily worth it based on an off-the-cuff risk assessment.
- perl4ever 7y ago
  Fundamentally, you can't do a risk assessment in response to someone telling you you're about to collide with an "unknown unknown". Most of the time, assuming the source is maliciously trying to confuse you is a better choice than doubting everything. When arguing from an armchair on the internet, somehow people forget what actual uncertainty under stress is like.