3 ms·
I want to know how they social engineered an employee at a 2FA-enabled company into bypassing 2FA. Was the employee able to disable 2FA for their own account?
by harshreality 6y ago
I want to know how they social engineered an employee at a 2FA-enabled company into bypassing 2FA.
Was the employee able to disable 2FA for their own account?
Was the employee social engineered into adding someone else's 2FA key to their account?
Did the employee read a 2FA code to the attacker, and that somehow enabled all the evil things the attacker did, without any additional checks or 2FA codes?
Did the attacker hack the employee's system and MITM their 2FA code without their knowledge? It doesn't sound like it, because that wouldn't be social engineering.
- _underfl0w_ 6y agoToo lazy to provide a link (sorry) but KrebsOnSecurity had some screenshots of a forum user offering up access to internal tooling. The access may have been deliberately sold, not necessarily coerced.
- SyneRyder 6y agoHere's the Krebs link, who claims to have identified the exact hacker behind it: https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/ https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-e... Vice Motherboard interviewed the hacker, who claims the Twitter employee was paid to hack the accounts for them: https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...
- lovehashbrowns 6y agoI wonder if it was something like DUO and employees were told to just hit approve. Get employee's password Call employee "Hey [employee], I'm [coworker] from the security team and we noticed your DUO was locked. I just enabled it, but we want to make sure it works. Hit Approve when you get a notification." Log in with password Wait for employee to hit Approve.
- Thorrez 6y agoThat's why you need a phishing-resistant method of 2FA. U2F is phishing resistant. Any type of OTP, or anything that doesn't bind the user action to the url bar is susceptible to phishing. U2F has the computer verify the url bar so it's phishing-resistant.
- raverbashing 6y agoI just find it ironic that the same people pushing for 2FA and arbitrary password rules are now saying "oh I guess 2FA is phishable" The best defense against Phishing seems to be to hire competent people and to train them on that and to establish "No You-Know-Who-You're-Talking-To" policies, as if something gets failed to do by whomever that didn't follow security procedures (example: "CEO" asking for "urgent" favour) is not blamed
- Thorrez 6y agoArbitrary password rules don't make phishing any easier or harder. For phishing involving malicious websites the answer is not training, it's U2F. For other phishing, yes, training is useful.
- lysp 6y agoStolen access token after 2fa had been entered.
- alexfromapex 6y agoThey probably got the reps to disclose the phone numbers by saying is this the right phone number? And then they made a SIM card for that number to get the 2FA text