5 ms·

I'm always on the edge of my seat waiting to learn what mind-blowing technique the "band of elite hackers working for Russia’s Foreign Intelligence Service" cam

I'm always on the edge of my seat waiting to learn what mind-blowing technique the "band of elite hackers working for Russia’s Foreign Intelligence Service" came up with. And it's always something along the lines of "they kept sending emails until somebody clicked the link."

mooreds 5y ago
Humans are the weakest link. Either the human clicking, or the person who designed the system that allowed them to click.
- anyfactor 5y ago
  If a system doesn't consider the human element in it's design the system as a whole is weak. There is no computer vs human. I am tired of hearing computers doesn't make mistakes and it is only humans that do. Even if they found a bug in kernel or some obscure memory fault, some people will spin it up as human mistake and chalk it up and move on. System designs needs to be holistic and accountable to errors. Everyone thinks they are smart but constant attacks only need you to be careless for a mere moment.
sva_ 5y ago
Often, yes. Maybe even most commonly. But not always. The NSO's zero-click iMessage exploit uncovered by Google Project Zero & Citizen Lab was absolutely mindblowing to me. [Of course, NSO Group is not "Russia's Foreign Intelligence Service", but I presume that wasn't your point.] https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
- thrashh 5y ago
  Another classic buffer overflow Making file format parsers sketchy since file format parsers started existing
  - tialaramex 5y ago
    Indeed, you should be Wrangling Untrusted File Formats Safely https://github.com/google/wuffs https://github.com/google/wuffs
rmbyrro 5y ago
Yeah, it's not how smart they are, it's how dumb other people are. I mean, if I start receiving a bomb of MFA requests at 1 AM, I'd get up immediately, log my account, change password and let the provider know my account was likely under attack. Even if I didn't care, I'd just turn off the phone and go back to sleep. I'd NEVER click an authentication request which I didn't acknowledge. I can't understand why someone would do that. People are really careless...
- dmm 5y ago
  > I can't understand why someone would do that. People are really careless... A lot of of it is probably carelessness but there are a lot of configurations out there that train users to accept random MFA requests. For example, some vpn configurations send MFA requests when they reauth at essentially random times.
  - whimsicalism 5y ago
    Presumably the signal would be that you can no longer connect to VPN internal webpages? Why you would accept random MFA at 1 AM(!) is beyond me.
    - Symbiote 5y ago
      At 1am, I could easily fumble and press the wrong button. I might not even know what I'd accepted
    - bentcorner 5y ago
      It's pretty easy - you're asleep, phone sound/vibration wakes you up, you're on call so you pick up the phone, it face unlocks, through your unfocused eyes you see a thumbprint icon and aren't sure if face unlocked worked in the dark, so you touch it. A second later you're wide awake and wondering what the hell was that mfa for...
- gsich 5y ago
  Because in the end, the company doesn't matter.
baxtr 5y ago
It depends. The better ones get more sophisticated as controls in companies are being put into place and people get more and more aware.
whimsicalism 5y ago
Not always https://www.techtarget.com/searchsecurity/news/252515092/North-Korean-hackers-exploited-Chrome-zero-day-bug-for-six-weeks https://www.techtarget.com/searchsecurity/news/252515092/Nor...

mooreds 5y ago

Humans are the weakest link. Either the human clicking, or the person who designed the system that allowed them to click.

anyfactor 5y ago
If a system doesn't consider the human element in it's design the system as a whole is weak. There is no computer vs human. I am tired of hearing computers doesn't make mistakes and it is only humans that do. Even if they found a bug in kernel or some obscure memory fault, some people will spin it up as human mistake and chalk it up and move on. System designs needs to be holistic and accountable to errors. Everyone thinks they are smart but constant attacks only need you to be careless for a mere moment.

sva_ 5y ago

Often, yes. Maybe even most commonly. But not always. The NSO's zero-click iMessage exploit uncovered by Google Project Zero & Citizen Lab was absolutely mindblowing to me. [Of course, NSO Group is not "Russia's Foreign Intelligence Service", but I presume that wasn't your point.] https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

thrashh 5y ago
Another classic buffer overflow Making file format parsers sketchy since file format parsers started existing
- tialaramex 5y ago
  Indeed, you should be Wrangling Untrusted File Formats Safely https://github.com/google/wuffs https://github.com/google/wuffs

rmbyrro 5y ago

Yeah, it's not how smart they are, it's how dumb other people are. I mean, if I start receiving a bomb of MFA requests at 1 AM, I'd get up immediately, log my account, change password and let the provider know my account was likely under attack. Even if I didn't care, I'd just turn off the phone and go back to sleep. I'd NEVER click an authentication request which I didn't acknowledge. I can't understand why someone would do that. People are really careless...

dmm 5y ago
> I can't understand why someone would do that. People are really careless... A lot of of it is probably carelessness but there are a lot of configurations out there that train users to accept random MFA requests. For example, some vpn configurations send MFA requests when they reauth at essentially random times.
- whimsicalism 5y ago
  Presumably the signal would be that you can no longer connect to VPN internal webpages? Why you would accept random MFA at 1 AM(!) is beyond me.
  - Symbiote 5y ago
    At 1am, I could easily fumble and press the wrong button. I might not even know what I'd accepted
  - bentcorner 5y ago
    It's pretty easy - you're asleep, phone sound/vibration wakes you up, you're on call so you pick up the phone, it face unlocks, through your unfocused eyes you see a thumbprint icon and aren't sure if face unlocked worked in the dark, so you touch it. A second later you're wide awake and wondering what the hell was that mfa for...
gsich 5y ago
Because in the end, the company doesn't matter.

baxtr 5y ago

It depends. The better ones get more sophisticated as controls in companies are being put into place and people get more and more aware.

whimsicalism 5y ago

Not always https://www.techtarget.com/searchsecurity/news/252515092/North-Korean-hackers-exploited-Chrome-zero-day-bug-for-six-weeks https://www.techtarget.com/searchsecurity/news/252515092/Nor...