4 ms·

"The unauthorized party socially engineered a customer support employee by phone and obtained access to certain customer support systems." I guess the customer

by emreb 5y ago

"The unauthorized party socially engineered a customer support employee by phone and obtained access to certain customer support systems." I guess the customer support system was open to the internet. In this day an age, how do you properly do perimeter fencing (as well as zero trust) for SaaS software?

bink 5y ago
I'm not sure this is saying they stole credentials and used them from outside the customer support rep's computer. It could be that they tricked the support rep into installing malware and followed them into the systems.
nyxaiur 5y ago
You can't move fast and break things with fences around.
nijave 5y ago
2FA with hard tokens seems common. There's also authenticating gateways/proxies and SASE products
- jimmydorry 5y ago
  2FA doesn't seem like a golden bullet here, where if I understand the attack vector correctly, the malicious party convinced support to grant them access (presumably since they claimed to be working from home). If they issued 2FA hard tokens, the attacker would have to wait a few days for them to arrive, but they would be allowed in all the same.
  - doubled112 5y ago
    I'm mostly playing devil's advocate, but there could definitely be a process around that 2FA token that isn't there for a password reset. Verifying the employee's mailing address vs just replying to them over the phone or email sounds like a hurdle. Might not be the same person shipping out the token, so now you have to prove it to two people. Blockers like that.
  - omegalulw 5y ago
    > If they issued 2FA hard tokens, the attacker would have to wait a few days for them to arrive, but they would be allowed in all the same. Nope. You won't ship keys to some random address - you will do it to the address on file. Presumably, changing address on file would be guarded by rigorous processes.
    - jimmydorry 5y ago
      Much like giving keys to the kingdom (access to internal systems) was guarded by a rigorous process. xD
jimmydorry 5y ago
Good question. In the COVID-19 age and WFH era, companies should consider adding support policies that require visual identification (video call with photo ID on company file to compare against) as a bare minimum for giving someone remote access via support ticket.
- mam4 5y ago
  and then, the deepfakes
- ljm 5y ago
  Companies should keep their critical infra behind their own VPN as much as they possibly can and for the things that can't be VPN'd, use an SSO with strong MFA support. Especially for remote work - any critical or internal infra should be behind a company-operated VPN, with the VPN-access gated by MFA. It's obviously not foolproof because the more SaaS you add, the more vulnerable you are, especially because security in HN-land is something you only worry about after-the-fact because it's not MVP or quick to market. But asking for more personal info is perhaps the worst possible conclusion you could take from this. At some point you have to stop asking your users to take responsibility for your own shoddy security.
  - wil421 5y ago
    Bingo. The company I work for even gives certain locales, that are prone to IP theft, VDI only access to company systems. They are given a laptop with nothing on it except tools to access the VPN and VDI.
    - niros_valtos 5y ago
      When security impacts productivity it becomes a difficult battle. Zero trust tries to solve the VPN requirement, but as we all know, the devil is in the implementation details…
  - sofixa 5y ago
    Zero trust has been gaining more and more popularity over the traditional hiding behind a VPN and trusting everything behind it. A VPN, if there's one ( it's still useful and avoids unauthenticated exploits on software), should be the first line of defence.
api 5y ago
Defense in depth. Put it on something like ZeroTier, but still secure it with hard key 2FA as if it's on the open Internet. The key is always to make an attacker jump over more than one hurdle to get to anything. It's preferable if those hurdles are as isolated from one another as possible: different systems, different vendors, administrated by different people (multiple social engineering points), etc. BTW I personally dislike this trend of trusting a single third party 2FA provider for access control to every system. It's incredibly convenient but it gives me the wim-wams. I'm waiting for a story like "Okta announces compromise, tens of thousands of sites may be at risk..." Never trust just one thing no matter what that one thing is.
wil421 5y ago
The customer support systems we run do not have local logins and we use SSO and an identity provider that is only accessible on our company VPN. Other safeguards apply as well. Since the company sells banking software and payment systems account numbers, cc numbers, and other identifiers are put into “sensitive” fields that are encrypted on our SaaS providers servers. We have a proxy server that decrypts the data in transit at our networks edge. Even the SaaS provider doesn’t have the keys to see these types of fields.
ryanar 5y ago
One solution is to integrate with one of the up-and-coming zero trust products. This is a new space that was started by the company I work for strongDM, and there are a number of startups competing in this space. I would highly recommend looking into it if you want to be more secure than a VPN's model of once you are inside the wall you are trusted.

by emreb 5y ago

bink 5y ago

I'm not sure this is saying they stole credentials and used them from outside the customer support rep's computer. It could be that they tricked the support rep into installing malware and followed them into the systems.

nyxaiur 5y ago

You can't move fast and break things with fences around.

nijave 5y ago

2FA with hard tokens seems common. There's also authenticating gateways/proxies and SASE products

jimmydorry 5y ago
2FA doesn't seem like a golden bullet here, where if I understand the attack vector correctly, the malicious party convinced support to grant them access (presumably since they claimed to be working from home). If they issued 2FA hard tokens, the attacker would have to wait a few days for them to arrive, but they would be allowed in all the same.
- doubled112 5y ago
  I'm mostly playing devil's advocate, but there could definitely be a process around that 2FA token that isn't there for a password reset. Verifying the employee's mailing address vs just replying to them over the phone or email sounds like a hurdle. Might not be the same person shipping out the token, so now you have to prove it to two people. Blockers like that.
- omegalulw 5y ago
  > If they issued 2FA hard tokens, the attacker would have to wait a few days for them to arrive, but they would be allowed in all the same. Nope. You won't ship keys to some random address - you will do it to the address on file. Presumably, changing address on file would be guarded by rigorous processes.
  - jimmydorry 5y ago
    Much like giving keys to the kingdom (access to internal systems) was guarded by a rigorous process. xD

jimmydorry 5y ago

Good question. In the COVID-19 age and WFH era, companies should consider adding support policies that require visual identification (video call with photo ID on company file to compare against) as a bare minimum for giving someone remote access via support ticket.

mam4 5y ago
and then, the deepfakes
ljm 5y ago
Companies should keep their critical infra behind their own VPN as much as they possibly can and for the things that can't be VPN'd, use an SSO with strong MFA support. Especially for remote work - any critical or internal infra should be behind a company-operated VPN, with the VPN-access gated by MFA. It's obviously not foolproof because the more SaaS you add, the more vulnerable you are, especially because security in HN-land is something you only worry about after-the-fact because it's not MVP or quick to market. But asking for more personal info is perhaps the worst possible conclusion you could take from this. At some point you have to stop asking your users to take responsibility for your own shoddy security.
- wil421 5y ago
  Bingo. The company I work for even gives certain locales, that are prone to IP theft, VDI only access to company systems. They are given a laptop with nothing on it except tools to access the VPN and VDI.
  - niros_valtos 5y ago
    When security impacts productivity it becomes a difficult battle. Zero trust tries to solve the VPN requirement, but as we all know, the devil is in the implementation details…
- sofixa 5y ago
  Zero trust has been gaining more and more popularity over the traditional hiding behind a VPN and trusting everything behind it. A VPN, if there's one ( it's still useful and avoids unauthenticated exploits on software), should be the first line of defence.

api 5y ago

Defense in depth. Put it on something like ZeroTier, but still secure it with hard key 2FA as if it's on the open Internet. The key is always to make an attacker jump over more than one hurdle to get to anything. It's preferable if those hurdles are as isolated from one another as possible: different systems, different vendors, administrated by different people (multiple social engineering points), etc. BTW I personally dislike this trend of trusting a single third party 2FA provider for access control to every system. It's incredibly convenient but it gives me the wim-wams. I'm waiting for a story like "Okta announces compromise, tens of thousands of sites may be at risk..." Never trust just one thing no matter what that one thing is.

wil421 5y ago

The customer support systems we run do not have local logins and we use SSO and an identity provider that is only accessible on our company VPN. Other safeguards apply as well. Since the company sells banking software and payment systems account numbers, cc numbers, and other identifiers are put into “sensitive” fields that are encrypted on our SaaS providers servers. We have a proxy server that decrypts the data in transit at our networks edge. Even the SaaS provider doesn’t have the keys to see these types of fields.

ryanar 5y ago

One solution is to integrate with one of the up-and-coming zero trust products. This is a new space that was started by the company I work for strongDM, and there are a number of startups competing in this space. I would highly recommend looking into it if you want to be more secure than a VPN's model of once you are inside the wall you are trusted.