5 ms·

The admin tool was used to change the email on an account, then the attacker reset the password and got full access to the account. Apparently having 2FA enable

The admin tool was used to change the email on an account, then the attacker reset the password and got full access to the account. Apparently having 2FA enabled did not stop this attack (admin tool probably had the power to strip 2FA from accounts). So while the tool did not directly have the ability to tweet, it effectively did.

csunbird 6y ago
I feel like the power to reset emails and remove 2fa should be only held by a very small subset of customer support, with proper training.
- chedabob 6y ago
  That seems like it was the case, but the attackers got access to lower privileged accounts and used them to find who had that access so they could target them.
  - toyg 6y ago
    The key being "proper training". Those few god-level admins should be drilled enough to defeat a phone-phishing campaign. In fact, they should probably have custom procedures to look after their own credentials.
- c00ls0sa 6y ago
  I work in customer service supervising entry level employees. The amount of power they have at any given time is astounding and it's by sheer ignorance or benevolence that more isn't embezzled en masse or this information isn't used for personal gain. My entire team of newly trained staff have access to your bank account information, where and when your payment was posted by IP, and we can strip 2fa or mobile numbers at whim. This coupled with inexperienced agents often leaves multiple accounts compromised. Having a select few engineers who don't work weekends always helps. We don't train the agents to tell them that they could potentially ruin customers' weeks by pushing the wrong button and it happens way too often to be standard, but as long as investors are happy and banks are good to reverse charges with no penalties here we are. Tech companies are good to throw caution to the wind.

5 ms·

The admin tool was used to change the email on an account, then the attacker reset the password and got full access to the account. Apparently having 2FA enable

by extrapickles 6y ago

csunbird 6y ago
I feel like the power to reset emails and remove 2fa should be only held by a very small subset of customer support, with proper training.
- chedabob 6y ago
  That seems like it was the case, but the attackers got access to lower privileged accounts and used them to find who had that access so they could target them.
  - toyg 6y ago
    The key being "proper training". Those few god-level admins should be drilled enough to defeat a phone-phishing campaign. In fact, they should probably have custom procedures to look after their own credentials.
- c00ls0sa 6y ago
  I work in customer service supervising entry level employees. The amount of power they have at any given time is astounding and it's by sheer ignorance or benevolence that more isn't embezzled en masse or this information isn't used for personal gain. My entire team of newly trained staff have access to your bank account information, where and when your payment was posted by IP, and we can strip 2fa or mobile numbers at whim. This coupled with inexperienced agents often leaves multiple accounts compromised. Having a select few engineers who don't work weekends always helps. We don't train the agents to tell them that they could potentially ruin customers' weeks by pushing the wrong button and it happens way too often to be standard, but as long as investors are happy and banks are good to reverse charges with no penalties here we are. Tech companies are good to throw caution to the wind.