5 ms·

> It's all been social engineering. Are you saying the software developers should have programmed all the humans in these organizations better? They should hav

by sobkas 5y ago

> It's all been social engineering. Are you saying the software developers should have programmed all the humans in these organizations better? They should have used login mechanism that didn't failed so spectacularly as passwords. Anything that forces server to prove its identity to client, should be a good start.

otterley 5y ago
According to the Microsoft analysis of LAPSUS$, they are able to breach MFA-protected accounts as well, through various techniques. https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/ https://www.microsoft.com/security/blog/2022/03/22/dev-0537-...
- sobkas 5y ago
  >Multifactor authentication (MFA) is one of the primary lines of defense against DEV-0537. While this group attempts to identify gaps in MFA, it remains a critical pillar in identity security for employees, vendors, and other personnel alike. See the following recommendations to implement MFA more securely Ah, MFA because bolting more passwords(things user knows and by knowing is able to prove his identity) on top of first one is a great idea. I'm sure no bad actor will try to get this information too. MFA might or might not authenticate server. And relaying on user action for security is asking for problems. Does user is a security expert to be able to choose appropriate action? Because sometimes even security experts get phished. I'm thinking about something simple, that have minimal user interactivity. Something like WireGuard, but not with random keys in plain text. There are ways to prove identity/exchange keys without directly using private keys. Something like tpm/yubikey.
libraryatnight 5y ago
Low to mid-tier support agents are being targeted directly. Sometimes they get phished (yes people will give you MFA codes and authorize push notifications if asked), sometimes they get social engineered, and sometimes they just solicit and pay them. Not just speaking of LAPSUS$ here.
waste_monk 5y ago
Maybe Okta should have installed Duo or some other MFA solution :^)

by sobkas 5y ago

otterley 5y ago

According to the Microsoft analysis of LAPSUS$, they are able to breach MFA-protected accounts as well, through various techniques. https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/ https://www.microsoft.com/security/blog/2022/03/22/dev-0537-...

sobkas 5y ago
>Multifactor authentication (MFA) is one of the primary lines of defense against DEV-0537. While this group attempts to identify gaps in MFA, it remains a critical pillar in identity security for employees, vendors, and other personnel alike. See the following recommendations to implement MFA more securely Ah, MFA because bolting more passwords(things user knows and by knowing is able to prove his identity) on top of first one is a great idea. I'm sure no bad actor will try to get this information too. MFA might or might not authenticate server. And relaying on user action for security is asking for problems. Does user is a security expert to be able to choose appropriate action? Because sometimes even security experts get phished. I'm thinking about something simple, that have minimal user interactivity. Something like WireGuard, but not with random keys in plain text. There are ways to prove identity/exchange keys without directly using private keys. Something like tpm/yubikey.

libraryatnight 5y ago

Low to mid-tier support agents are being targeted directly. Sometimes they get phished (yes people will give you MFA codes and authorize push notifications if asked), sometimes they get social engineered, and sometimes they just solicit and pay them. Not just speaking of LAPSUS$ here.

waste_monk 5y ago

Maybe Okta should have installed Duo or some other MFA solution :^)