3 ms·

But once you have access to a person's email, you could just go back through the history and look for past communications like this and mimic them. That's my g

by bhousel 16y ago

But once you have access to a person's email, you could just go back through the history and look for past communications like this and mimic them. That's my guess about how they were able to ask specific questions about the root password. Some method of verifying the requester's identity out of band (e.g. 'call me for the password') is really the only way to go.

JonnieCache 16y ago
>'call me for the password' is really the only way to go. Nope. "From what I hear - yes... My friends who worked for whitehat security companies would first try to hack staff before hacking servers. Best was to call up the ceo on his personal homephone every night at 3am, until they knew what he sounded like raving mad. Then they called up the admins doing a very good impression of the irate ceo demanding his passwords were reset there and then. Worked a stupid amount of times apparently..." http://news.ycombinator.com/item?id=2067063 http://news.ycombinator.com/item?id=2067063
- bhousel 16y ago
  You kind of ignored my point about verifying the person's identity while you have them on the phone. LAST EDIT: Fine. shibboleths, passwords, pins, safeword cards, emails, texts, callerid, voice, and face to face conversations are all great tools to use when trying to secure some asset. All I'm saying is Go out of band when you want to verify a person's identity. If you are emailing, call. If you are on the phone, and you don't trust them, call them back at their home. Or text them a code and ask them for the code. Or meet in a trusted place and take a DNA sample. Whatever is appropriate for the thing you are securing. Sure, any of these methods can be compromised through social engineering, blackmail, theft, or violence. That's not the point. If you care about a password, don't send it through the same channel that you use to verify the person that you are sending the password to. Shibboleths and ROT13ing won't solve the problem of knowing who you are talking to.
  - JonnieCache 16y ago
    How would you identify the person on the phone? Their voice clearly isn't enough. Caller ID can be spoofed. With another password? What happens when they forget that as well? I guess you could require a face to face meeting to reset that password. But by having two alternative passwords, you have increased the attack surface. The user is much more likely to write the second "emergency" password down I expect. Also, what happens when your helpdesk's VoIP system gets hacked in the same way that the email system got hacked in this case?
    - lukeschlather 16y ago
      Only document the full procedure on paper, and forbid people from mentioning the full procedure except in person. If an admin gets an email asking for a password, they should reply with a fake password, and then await a call to give a real password. Or vice versa. If the person contacting them tries repeatedly, they should feign incompetence and / or laziness, escalating if it gets out of hand (even if escalating means passing to another equal-rank admin.)
      - doki_pen 16y ago
        This is the right idea. A feedback loop is critical to hacking. If you take away the feedback loop it becomes nearly impossible.
      - bhousel 16y ago
        Or just PGP encrypt any emails with root passwords or other details about your system. Just make sure you decide before the emergency who needs to be trusted with that information, and be smart about how you exchange keys with everyone involved.
  - JonnieCache 16y ago
    >If you are on the phone, and you don't trust them, call them back at their home. Didn't think of that. Great idea.
    - 16y ago
- stcredzero 16y ago
  A company with truly good security practices would put into place a protocol for transferring passwords over voice comms. I'm making a note right now.

by bhousel 16y ago

JonnieCache 16y ago

>'call me for the password' is really the only way to go. Nope. "From what I hear - yes... My friends who worked for whitehat security companies would first try to hack staff before hacking servers. Best was to call up the ceo on his personal homephone every night at 3am, until they knew what he sounded like raving mad. Then they called up the admins doing a very good impression of the irate ceo demanding his passwords were reset there and then. Worked a stupid amount of times apparently..." http://news.ycombinator.com/item?id=2067063 http://news.ycombinator.com/item?id=2067063

bhousel 16y ago
You kind of ignored my point about verifying the person's identity while you have them on the phone. LAST EDIT: Fine. shibboleths, passwords, pins, safeword cards, emails, texts, callerid, voice, and face to face conversations are all great tools to use when trying to secure some asset. All I'm saying is Go out of band when you want to verify a person's identity. If you are emailing, call. If you are on the phone, and you don't trust them, call them back at their home. Or text them a code and ask them for the code. Or meet in a trusted place and take a DNA sample. Whatever is appropriate for the thing you are securing. Sure, any of these methods can be compromised through social engineering, blackmail, theft, or violence. That's not the point. If you care about a password, don't send it through the same channel that you use to verify the person that you are sending the password to. Shibboleths and ROT13ing won't solve the problem of knowing who you are talking to.
- JonnieCache 16y ago
  How would you identify the person on the phone? Their voice clearly isn't enough. Caller ID can be spoofed. With another password? What happens when they forget that as well? I guess you could require a face to face meeting to reset that password. But by having two alternative passwords, you have increased the attack surface. The user is much more likely to write the second "emergency" password down I expect. Also, what happens when your helpdesk's VoIP system gets hacked in the same way that the email system got hacked in this case?
  - lukeschlather 16y ago
    Only document the full procedure on paper, and forbid people from mentioning the full procedure except in person. If an admin gets an email asking for a password, they should reply with a fake password, and then await a call to give a real password. Or vice versa. If the person contacting them tries repeatedly, they should feign incompetence and / or laziness, escalating if it gets out of hand (even if escalating means passing to another equal-rank admin.)
    - doki_pen 16y ago
      This is the right idea. A feedback loop is critical to hacking. If you take away the feedback loop it becomes nearly impossible.
    - bhousel 16y ago
      Or just PGP encrypt any emails with root passwords or other details about your system. Just make sure you decide before the emergency who needs to be trusted with that information, and be smart about how you exchange keys with everyone involved.
- JonnieCache 16y ago
  >If you are on the phone, and you don't trust them, call them back at their home. Didn't think of that. Great idea.
  - 16y ago
stcredzero 16y ago
A company with truly good security practices would put into place a protocol for transferring passwords over voice comms. I'm making a note right now.