3 ms·

Hackers breach MailChimp's internal tools

53 points by prostoalex 5y ago

bredren 5y ago
Hubspot internal tools were accessed in the first half of March, also targeting crypto companies. https://hn.algolia.com/?q=hubspot+leak https://hn.algolia.com/?q=hubspot+leak
throwmeariver1 5y ago
With the active recruitment of low level support/engineering insiders as saboteurs what is the right way forward? More security or a better work environment?
- notadev 5y ago
  Maybe auditing. When I was a wee lad on American Online in the 90s, our biggest desire was to steal the most 31337 screen names. One way of doing this was learning of people who worked at the call centers you’d call for account problems. Once you were friendly enough, you could sometimes convince them to pull an account’s information for you. Then you’d call the call center from a pay phone and, using the stolen information, reset the password. This allowed you to get on the account for a while to brag. In some cases, you could permanently steal the AOL Instant Messenger (AIM) version of the screen name unbeknownst to the original account owner. Anyway, AOL recognized this insider threat and audited and reviewed any access to their internal account systems (called CRIS or Merlin IIRC), which pretty much killed the method of using insiders since they were caught and fired pretty quickly.
- wildrhythms 5y ago
  A lot of engineers will hyper-focus on building some labyrinthine security system to try and thwart employees leaking credentials, but understanding WHY an employee will willingly compromise their credentials is the true starting point. Phishing attempts may seem obvious to the tech-literate, but the average office or call center worker is probably more focused on pleasing their manager or not hurting their customer feedback rating than focusing on security. Maybe employees don't know about where to direct security concerns? Maybe they've had a negative interaction with the IT/security team at some point in the past? At a previous employer the security team would periodically send out a wave of phishing attempts to employees to see how they would react.
FerretFred 5y ago
> some of their employees fell for a social engineering attack This is becoming a more common trend - you no longer have to be a techie to "hack" - people skills are the up-and-coming essential tool.
- kadoban 5y ago
  Social engineering has _always_ been a huge factor, either allowing exploits or making them worse. This has been true in tech since at _least_ the 70s. Realistically it's been true as long as society bigger than a household has existed.
1B05H1N 5y ago
"The incident was propagated by an external actor who conducted a successful social engineering attack on Mailchimp employees, resulting in employee credentials being compromised." My dreams of some 4D-chess exploit were squashed 30 seconds into reading the article.
- meepmorp 5y ago
  Why go through the window when someone will hold the door open for you?
- mrkramer 5y ago
  Most hacking intrusions begin with social engineering....The last godlike 4D-chess exploit that I remember was Heartbleed in 2014[0]. [0] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed

53 points by prostoalex 5y ago

Hubspot internal tools were accessed in the first half of March, also targeting crypto companies. https://hn.algolia.com/?q=hubspot+leak https://hn.algolia.com/?q=hubspot+leak

throwmeariver1 5y ago

With the active recruitment of low level support/engineering insiders as saboteurs what is the right way forward? More security or a better work environment?

notadev 5y ago
Maybe auditing. When I was a wee lad on American Online in the 90s, our biggest desire was to steal the most 31337 screen names. One way of doing this was learning of people who worked at the call centers you’d call for account problems. Once you were friendly enough, you could sometimes convince them to pull an account’s information for you. Then you’d call the call center from a pay phone and, using the stolen information, reset the password. This allowed you to get on the account for a while to brag. In some cases, you could permanently steal the AOL Instant Messenger (AIM) version of the screen name unbeknownst to the original account owner. Anyway, AOL recognized this insider threat and audited and reviewed any access to their internal account systems (called CRIS or Merlin IIRC), which pretty much killed the method of using insiders since they were caught and fired pretty quickly.
wildrhythms 5y ago
A lot of engineers will hyper-focus on building some labyrinthine security system to try and thwart employees leaking credentials, but understanding WHY an employee will willingly compromise their credentials is the true starting point. Phishing attempts may seem obvious to the tech-literate, but the average office or call center worker is probably more focused on pleasing their manager or not hurting their customer feedback rating than focusing on security. Maybe employees don't know about where to direct security concerns? Maybe they've had a negative interaction with the IT/security team at some point in the past? At a previous employer the security team would periodically send out a wave of phishing attempts to employees to see how they would react.

FerretFred 5y ago

> some of their employees fell for a social engineering attack This is becoming a more common trend - you no longer have to be a techie to "hack" - people skills are the up-and-coming essential tool.

kadoban 5y ago
Social engineering has _always_ been a huge factor, either allowing exploits or making them worse. This has been true in tech since at _least_ the 70s. Realistically it's been true as long as society bigger than a household has existed.

1B05H1N 5y ago

"The incident was propagated by an external actor who conducted a successful social engineering attack on Mailchimp employees, resulting in employee credentials being compromised." My dreams of some 4D-chess exploit were squashed 30 seconds into reading the article.

meepmorp 5y ago
Why go through the window when someone will hold the door open for you?
mrkramer 5y ago
Most hacking intrusions begin with social engineering....The last godlike 4D-chess exploit that I remember was Heartbleed in 2014[0]. [0] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed