8 ms·

Former GS-employee here: The relevance of "gs.com" to the business of Goldman Sachs is pretty much zero. When I worked there in 2010 I was told somewhat tongu

by gyulai 5y ago

Former GS-employee here: The relevance of "gs.com" to the business of Goldman Sachs is pretty much zero. When I worked there in 2010 I was told somewhat tongue-in-cheek-ishly that up until the 2008 financial crisis, the telephone number for press inquiries went to a PR firm that was under strict orders to never answer any inquiries of any kind and never to engage the press for any reason whatsoever. This was the extent of their PR activity. The extent of their marketing & advertising was even less than that. GS.COM is there to serve that non-function within the business. If you do business with Goldman Sachs or if they are interested in doing business with you, you already have communication channels with them, and there's nothing that GS.COM could do to augment that in any way that is in any way meaningful. I'd be willing to bet that even a complete takeover of the webhosting behind GS.COM wouldn't get an attacker an iota closer to taking over any systems that actually matter to them. I remember what it was like to get approval there to make them open a port in a firewall so we could send e-mail from servers co-located at stock exchanges back to ourselves in the office. ...getting that signoff was a serious ordeal because the co-location networks operated by the stock exchanges are treated by them as "hostile", and they fought nail-and-teeth for keeping their firewalls as tight as they could possibly be. Asking them to loosen their security on anything internet-facing by even just an iota is an ordeal I never ever in my professional career want to have to go through.

bombcar 5y ago
The danger isn't that gs.com would leak data or somehow someone would get access to GS systems through it - the danger is that someone could change content on gs.com and then use that content to spear-phish or otherwise scam someone else. You get a link, you check it because you're good like that, see gs.com and then trust it.
- gyulai 5y ago
  ...but the economics of such an attack are still very different from when the same thing happened to chase.com or td.com or some other bank that had consumer banking. Because you can send phishing e-mails to the general public and get a pretty good hitrate of people who happen to be in business with that bank and very much used to conducting their business with that bank through that same domain. For GS.COM that hit-rate would be extremely small, unless you were somehow able to to reach people who are in business with GS with very high accuracy, and then the next problem you'd face is that the trust that these people put in GS.COM doesn't extend to doing any kind of business there. If you're a Norwegian oil company and you have GS handle your USD Forex forward contracts, then the way you do that kind of business is that you call somebody on the phone who works at GS, whose voice you recognize, who has likely invited you to their wedding at some point. You wouldn't expect them to send you an e-mail that put you into a web-flow on GS.COM that somehow ended up with you wiring a few million to an account number they display on-screen.
  - bombcar 5y ago
    I'm thinking not attacking GS's customers, but using GS's name to attack others. Imagine, if you will, a crypto scam that puts their scam page on a gs.com address, and makes it appear that Goldman Sachs supports and funds the scam, thereby encouraging people to send in their money.
    - gyulai 5y ago
      But the thing is: GS doesn't have a reputation among the general public. 60% of people probably never even heard of them. Another 35% of people have come across them on the news somewhere and probably have negative associations with GS. GS is one of those companies that journalists just love to hate. (GS? Who is GS? ...oh yeah. Now I remember, I saw this thing on the telly. Something about secret world government and stealing food away from the mouths of starving children in Africa for personal gain, I recall). And the other 5% are likely people too smart to fall for bitcoin scams.
      - eru 5y ago
        I suspect that's why bombcar suggested spear-phishing, not regular mass-phishing?
jfengel 5y ago
Relevant XKCD: https://xkcd.com/932/ https://xkcd.com/932/ [A television is showing Blondie as a news anchor. The inset picture of the news shows the logo of LulzSec, a man wearing a monocle and top hat.] Blondie: Hackers briefly took down the website of the CIA yesterday... [Ponytail, sitting in an armchair, is watching a television (seen from the side) standing on a table hearing what Blondie says as indicated with a zigzag line from the TV. Above the top part of the frame is a smaller frame with a label:] What people hear: Blondie (not shown from the TV): Someone hacked into the computers of the CIA!! [Megan, sitting in an armchair, is watching a television (seen from the side) standing on a table hearing what Blondie says as indicated with a zigzag line from the TV. Above the top part of the frame is a smaller frame with a label:] What computer experts hear: Blondie (not shown from the TV): Someone tore down a poster hung up by the CIA!!
eru 5y ago
Yes, though Goldman still runs a lot of their compute grid on public clouds.

by gyulai 5y ago

bombcar 5y ago

The danger isn't that gs.com would leak data or somehow someone would get access to GS systems through it - the danger is that someone could change content on gs.com and then use that content to spear-phish or otherwise scam someone else. You get a link, you check it because you're good like that, see gs.com and then trust it.

gyulai 5y ago
...but the economics of such an attack are still very different from when the same thing happened to chase.com or td.com or some other bank that had consumer banking. Because you can send phishing e-mails to the general public and get a pretty good hitrate of people who happen to be in business with that bank and very much used to conducting their business with that bank through that same domain. For GS.COM that hit-rate would be extremely small, unless you were somehow able to to reach people who are in business with GS with very high accuracy, and then the next problem you'd face is that the trust that these people put in GS.COM doesn't extend to doing any kind of business there. If you're a Norwegian oil company and you have GS handle your USD Forex forward contracts, then the way you do that kind of business is that you call somebody on the phone who works at GS, whose voice you recognize, who has likely invited you to their wedding at some point. You wouldn't expect them to send you an e-mail that put you into a web-flow on GS.COM that somehow ended up with you wiring a few million to an account number they display on-screen.
- bombcar 5y ago
  I'm thinking not attacking GS's customers, but using GS's name to attack others. Imagine, if you will, a crypto scam that puts their scam page on a gs.com address, and makes it appear that Goldman Sachs supports and funds the scam, thereby encouraging people to send in their money.
  - gyulai 5y ago
    But the thing is: GS doesn't have a reputation among the general public. 60% of people probably never even heard of them. Another 35% of people have come across them on the news somewhere and probably have negative associations with GS. GS is one of those companies that journalists just love to hate. (GS? Who is GS? ...oh yeah. Now I remember, I saw this thing on the telly. Something about secret world government and stealing food away from the mouths of starving children in Africa for personal gain, I recall). And the other 5% are likely people too smart to fall for bitcoin scams.
    - eru 5y ago
      I suspect that's why bombcar suggested spear-phishing, not regular mass-phishing?

jfengel 5y ago

Relevant XKCD: https://xkcd.com/932/ https://xkcd.com/932/ [A television is showing Blondie as a news anchor. The inset picture of the news shows the logo of LulzSec, a man wearing a monocle and top hat.] Blondie: Hackers briefly took down the website of the CIA yesterday... [Ponytail, sitting in an armchair, is watching a television (seen from the side) standing on a table hearing what Blondie says as indicated with a zigzag line from the TV. Above the top part of the frame is a smaller frame with a label:] What people hear: Blondie (not shown from the TV): Someone hacked into the computers of the CIA!! [Megan, sitting in an armchair, is watching a television (seen from the side) standing on a table hearing what Blondie says as indicated with a zigzag line from the TV. Above the top part of the frame is a smaller frame with a label:] What computer experts hear: Blondie (not shown from the TV): Someone tore down a poster hung up by the CIA!!

eru 5y ago

Yes, though Goldman still runs a lot of their compute grid on public clouds.