4 ms·

No, Reddit. Phising is not a sophisticated attack. Working in the cyber industry, it's so frustrating to see companies claim that they were done over by "sophi

No, Reddit. Phising is not a sophisticated attack. Working in the cyber industry, it's so frustrating to see companies claim that they were done over by "sophisticated attacks" like phising! I understand it from the PR points angle, but I always cringe. I hope others see through it too. I guess we'll wait to see what they actually stole when they post the ransom.

blitzar 4y ago
It is almost as annoying as when hack / breach turns out to be someone scrapped every profile on the site.
sneak 4y ago
Right? This is completely eliminated by using U2F tokens. If you aren't using hardware auth to authenticate to corporate internal resources, your IT department is negligent or incompetent or both. I literally have advanced protection turned on for a small four person single location retail operation I am involved with, simply for the PII of a few hundred people that they have to handle. The little USB/NFC fobs are $15. There is no excuse other than incompetence.
- NoPicklez 4y ago
  Using MFA is absolutely a must. But not using hardware based 2FA doesn't make the IT department, completely negligent or incompetent. Most companies I know if they are using MFA are using Microsoft Authenticator soft tokens through their enterprise 365 environments.
  - remram 4y ago
    MFA is extremely vulnerable to fishing, ie. man-in-the-middle. It is pretty useless, hardware token or not. U2F/webauthn mostly fixes that.
  - sneak 4y ago
    The Reddit hack in question phished the user-input MFA (presumably TOTP) string.
    - NoPicklez 4y ago
      My point being is that by not having hardware based MFA, but still have a form of soft token MFA doesn't make the IT personnel completely incompetent or negligent. Not requiring MFA at all and having weak passwords would be an example of that.
      - sneak 4y ago
        Then why are they still getting owned via common/routine phishing attacks? Ones that are entirely, cheaply, and easily preventable?
        iinnPP 4y ago
        Because they don't pay a competent person to do their security or because the person they paid isn't able/willing to make decisions. Phishing is not obviously sophisticated but an argument could be made. The problem with letting that kind of language slide is that it skirts responsibility. Society has a huge accountability problem currently and there isn't really an end in sight. There's no need to continue allowing corporations to use such language and continuing the problem. If a solution to phishing is available and not used, the easy mode hack is attributed to the security of the people so responsible. They took a risk and that went bad. Fire them(the people ACTUALLY RESPONSIBLE) and move forward with a better model of security. The person actually responsible is the person(s) who made the final call on using security susceptible to phishing attacks where a better option exists.
ReflectedImage 4y ago
Most attacks are Phishing whether it's from hackers in basements or hackers in secret government bunkers. At the moment, it's the easiest way into a network. So everyone is doing it.
chaoz_ 4y ago
Yes, it is sophisticated. Phishing emails are opened more often then regular mail (assuming it’s in your inbox) and click-rate is pretty high. You might be good at cracking phishing simulation at your workplace, but many people won’t know if “amazon.example.com” or “example.amazon.com” is real. This is of course something good filter will pick up, but consider how hard it is to make sure 0 employees fall to the attack. Also, even 2FA can get compromised with notification spam, that’s how it played out in one of the attacks couple of years ago.
- ruskyhacker 4y ago
  No, it's not sophisticated. They're using "sophisticated" inappropriately here for pure PR. Just because phishing is common, doesn't make it sophisticated.
  - dvngnt_ 4y ago
    spearfishing is
- lvxferre 4y ago
  >Yes, it is sophisticated. Phishing emails are opened more often then regular mail and click-rate is pretty high. You're confusing "sophisticated" with "efficient". Phishing is efficient but unsophisticated; it boils down to one of the oldest tricks ever, to make you believe that $foo is $bar.
  - deleted 4y ago
    [deleted]
Cpoll 4y ago
Phishing _can_ be more or less "sophisticated" (obviously some of this is a semantic argument) attack, it depends on the details. For example, if you select a target and collect information in order to tailor the attack, or you use inside information to prey on a flaw (such as security fatigue), that's at least more sophisticated than a typical phishing email. Not that I disagree with your take about the PR angle.
runamok 4y ago
They somehow replicated the intranet site so I'd call that somewhat sophisticated. That kind of feels like they had insider knowledge. > As in most phishing campaigns, the attacker sent out plausible-sounding prompts pointing employees to a website that cloned the behavior of our intranet gateway, in an attempt to steal credentials and second-factor tokens.
lvxferre 4y ago
>No, Reddit. Phising is not a sophisticated attack. You're right, it isn't. It's just Reddit admins lying through their teeth, it's their usual. Almost like they take most of the current Reddit userbase as braindead. (Spoilers: they might be right.) In this specific case they're lying to not make it so obvious that they're pretty much incompetent to manage their site.
bearmode 4y ago
I'd argue that cloning their intranet site takes this up a notch from regular phishing
John23832 4y ago
Nobody gets phished with a plain text email/site that says “give me your system access”. Creating a replication of their intranet gateway requires recon to know what gateway they use, (if they use a custom api) recreate that api, and finding who to actually send the fake page to. I’d call this spear fishing. That’s sophistication. Recon and tailoring to the target is sophisticated. It may not be super complicated, but it shows sophistication. Sophistication is a spectrum between ”hey mister, and I have your credentials?” and nationstate APT’s.

blitzar 4y ago

It is almost as annoying as when hack / breach turns out to be someone scrapped every profile on the site.

sneak 4y ago

Right? This is completely eliminated by using U2F tokens. If you aren't using hardware auth to authenticate to corporate internal resources, your IT department is negligent or incompetent or both. I literally have advanced protection turned on for a small four person single location retail operation I am involved with, simply for the PII of a few hundred people that they have to handle. The little USB/NFC fobs are $15. There is no excuse other than incompetence.

NoPicklez 4y ago
Using MFA is absolutely a must. But not using hardware based 2FA doesn't make the IT department, completely negligent or incompetent. Most companies I know if they are using MFA are using Microsoft Authenticator soft tokens through their enterprise 365 environments.
- remram 4y ago
  MFA is extremely vulnerable to fishing, ie. man-in-the-middle. It is pretty useless, hardware token or not. U2F/webauthn mostly fixes that.
- sneak 4y ago
  The Reddit hack in question phished the user-input MFA (presumably TOTP) string.
  - NoPicklez 4y ago
    My point being is that by not having hardware based MFA, but still have a form of soft token MFA doesn't make the IT personnel completely incompetent or negligent. Not requiring MFA at all and having weak passwords would be an example of that.
    - sneak 4y ago
      Then why are they still getting owned via common/routine phishing attacks? Ones that are entirely, cheaply, and easily preventable?
      - iinnPP 4y ago
        Because they don't pay a competent person to do their security or because the person they paid isn't able/willing to make decisions. Phishing is not obviously sophisticated but an argument could be made. The problem with letting that kind of language slide is that it skirts responsibility. Society has a huge accountability problem currently and there isn't really an end in sight. There's no need to continue allowing corporations to use such language and continuing the problem. If a solution to phishing is available and not used, the easy mode hack is attributed to the security of the people so responsible. They took a risk and that went bad. Fire them(the people ACTUALLY RESPONSIBLE) and move forward with a better model of security. The person actually responsible is the person(s) who made the final call on using security susceptible to phishing attacks where a better option exists.

ReflectedImage 4y ago

Most attacks are Phishing whether it's from hackers in basements or hackers in secret government bunkers. At the moment, it's the easiest way into a network. So everyone is doing it.

chaoz_ 4y ago

Yes, it is sophisticated. Phishing emails are opened more often then regular mail (assuming it’s in your inbox) and click-rate is pretty high. You might be good at cracking phishing simulation at your workplace, but many people won’t know if “amazon.example.com” or “example.amazon.com” is real. This is of course something good filter will pick up, but consider how hard it is to make sure 0 employees fall to the attack. Also, even 2FA can get compromised with notification spam, that’s how it played out in one of the attacks couple of years ago.

ruskyhacker 4y ago
No, it's not sophisticated. They're using "sophisticated" inappropriately here for pure PR. Just because phishing is common, doesn't make it sophisticated.
- dvngnt_ 4y ago
  spearfishing is
lvxferre 4y ago
>Yes, it is sophisticated. Phishing emails are opened more often then regular mail and click-rate is pretty high. You're confusing "sophisticated" with "efficient". Phishing is efficient but unsophisticated; it boils down to one of the oldest tricks ever, to make you believe that $foo is $bar.
- deleted 4y ago
  [deleted]

Cpoll 4y ago

Phishing _can_ be more or less "sophisticated" (obviously some of this is a semantic argument) attack, it depends on the details. For example, if you select a target and collect information in order to tailor the attack, or you use inside information to prey on a flaw (such as security fatigue), that's at least more sophisticated than a typical phishing email. Not that I disagree with your take about the PR angle.

runamok 4y ago

They somehow replicated the intranet site so I'd call that somewhat sophisticated. That kind of feels like they had insider knowledge. > As in most phishing campaigns, the attacker sent out plausible-sounding prompts pointing employees to a website that cloned the behavior of our intranet gateway, in an attempt to steal credentials and second-factor tokens.

lvxferre 4y ago

>No, Reddit. Phising is not a sophisticated attack. You're right, it isn't. It's just Reddit admins lying through their teeth, it's their usual. Almost like they take most of the current Reddit userbase as braindead. (Spoilers: they might be right.) In this specific case they're lying to not make it so obvious that they're pretty much incompetent to manage their site.

bearmode 4y ago

I'd argue that cloning their intranet site takes this up a notch from regular phishing

John23832 4y ago

Nobody gets phished with a plain text email/site that says “give me your system access”. Creating a replication of their intranet gateway requires recon to know what gateway they use, (if they use a custom api) recreate that api, and finding who to actually send the fake page to. I’d call this spear fishing. That’s sophistication. Recon and tailoring to the target is sophisticated. It may not be super complicated, but it shows sophistication. Sophistication is a spectrum between ”hey mister, and I have your credentials?” and nationstate APT’s.