4 ms·

Is clicking on a link really “hacking”? > The accounting lead mistakenly shared a link with edit access in a public channel in discord. The hacker gained edit

Is clicking on a link really “hacking”? > The accounting lead mistakenly shared a link with edit access in a public channel in discord. The hacker gained edit role via the link.

rwalle 4y ago
One way or another, the bad guys are getting their money. Talk to anyone and they'll tell you this is hacking. Many incidents that are more technical and involves exploiting vulnerability also begin with social engineering.
johndough 4y ago
> After gaining the access, the hacker inserted a 76 ETH payment to himself in the sheet, and set it invisible It might not be a real hack in the traditional sense, but hiding critical information so a human makes an incorrect choice is good enough to be considered social engineering for me.
- fuckingmorons 4y ago
  [dead]
NoZebra120vClip 4y ago
Imagine the number of people who have ownership of business-critical documents in the cloud. Now imagine a venn diagram with the number of people who don't realize that granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity.
- TheDong 4y ago
  > granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity. That's like saying passwords are "security through obscurity" because they're also "obscure" random strings, just like URLs. To try and make my point more clear: Basic auth password url: https://username:randomSecurePassword@webpage.com https://username:randomSecurePassword@webpage.com Google docs edit url: https://docs.google.com/randomLongString/edit https://docs.google.com/randomLongString/edit How are those two things different, other than one is a password which might be short and insecure, and the other has plenty of entropy? Will you also argue that all shared secrets are security by obscurity?
  - BobbyJo 4y ago
    > How are those two things different How they're used? I mean, we can argue that pizzas are wheels because they're circles, but, until you throw one on a car and get where you're going, no one will take it seriously. URLs get shared, passed around, posted in chats, etc. Passwords don't, or at least everyone knows they're doing something wrong if they do. In the case of the this doc, if it was privately shared, I don't think anyone would have mistakenly posted their Google password the same way.
    - shkkmo 4y ago
      Then it sounds like both passwords and gdoc authorization links depend on security through obscurity, but people are less aware of that fact for the links. There is a point here that the difference between access level grants is not clear enough and the urls should have a clearer demarcation of the level granted, (e.g. sheets.google.com/danger-allows-editing/{secureToken} or sheets.google.com/allows-viewing/{secureToken}.)
      - BobbyJo 4y ago
        If you're going to classify passwords as security through obscurity, then how would you accomplish security through any other means? All forms of digital security require information asymmetry (IE someone holding information not known to others). The only other security I can think of is physical, and most of that is designed around information asymmetry as well (key cards, door codes). STO to me generally indicates there is some backward engineering process, or some vital related knowledge, that can break it, which is specifically not the case here. Secrets are specifically designed to have common forms and functions, you only keep the value itself, or values they were derived from, secret. Obscurity and secrecy have slightly different meanings.
        shkkmo 4y ago
        > If you're going to classify passwords as security through obscurity Sorry if this wasn't clear. I was trying to adopt your apparent definition to point out that, passwords and authorizing-links can have identical functional forms. Both depend on maintaining the secrecy of a specific piece on non-design / non-implementation knowledge. To make this clearer, let's say that your document's authorization link is determined by hashing the document id. If you don't use a salt, then the security of the system depends on the obscurity of your choice of hashing function. If you do use a salt, then your security also depends on the secrecy (and strength) of the salt value. Since the issue in this case wasn't people reverse engineering the means of generating links to uncover it, the issue was not a dependence on obscurity of design and implementation. The issue was that the users of the system were not aware or forgot that authorization links were a secret or confusion about what level of secrecy was needed for a specific link. This is why I specifically called out a possible design change to the authorization links that would reduce the likelihood of similar human error. Edit: In general, "security through obscurity" is both a nebulous term and one that often doesn't mean use of obscurity of design/implementation a portion of the security stance, but rather an over-reliance on obscurity of design/implementation without other security measures, such as the use and careful management of strong secrets such as passwords/keys. This potential confusion makes me view the "security through obscurity" term as more of a buzzword than a specific security criticism.
- ceejayoz 4y ago
  If the super long string on a Google doc is “security through obscurity”, so are passwords, 2FA codes, and ssh keys.
  - Nextgrid 4y ago
    One persists in your browser history and is easy to copy/paste into the wrong place, the other is not (good luck copying a password field without technical workarounds such as changing the field type in the developer tools).
  - NoZebra120vClip 4y ago
    A Google Doc ID (or Drive/Sheets/Slides) is a single identifier which denotes a resource in the cloud. It is a name; it is not intended as a secret. "Anyone with the Link" really means anyone. In fact, I would say that "Anyone with the Link" access modes are a hack and a workaround for people who do not have Google accounts. If you rely on privacy, use Google accounts. So if you created a secret, clandestine, world-readable, anyone-comments, blog post with the slug "http://example.com/correct-horse-battery-staple/ http://example.com/correct-horse-battery-staple/" would you really complain when someone brute-force or outright guessed your blog post? YouTube has "unlisted" videos which are unsearchable and unreachable unless you've been shared a link, but do people freak out when someone stumbles across this shared by others? Just because a Google Workspaces ID is a long, jumbled-up, base-64 string doesn't mean it is a password or a cryptographically secure secret. It's quite different. It's meant to be well-known by anyone who is intended to have access. The "Anyone with the Link" access simply relies on a circle of friends/colleagues keeping the URL to themselves.
gus_massa 4y ago
I'm not sure if something like this also happened here, but I have sometimes a document shared with a few coworkers. While discussing it by email, I have to send them (again) the link because otherwise they can't find it. Each time, gmail says that "John" will not be able to see the document and offers to make it readable/editable for anyone with a link. It appears in a modal window that blocks sending the message. I must read carefully the modal window to click the correct button. "John" can see the doc because he has a google account, but I'm sending the message to his yahoo email because it's his preferred email. Anyway, I only have a draft of a math midterm for next week. If a hundred of thousands of dollars were in the line, I'd be very nervous.

Is clicking on a link really “hacking”? > The accounting lead mistakenly shared a link with edit access in a public channel in discord. The hacker gained edit role via the link.

rwalle 4y ago

One way or another, the bad guys are getting their money. Talk to anyone and they'll tell you this is hacking. Many incidents that are more technical and involves exploiting vulnerability also begin with social engineering.

johndough 4y ago

> After gaining the access, the hacker inserted a 76 ETH payment to himself in the sheet, and set it invisible It might not be a real hack in the traditional sense, but hiding critical information so a human makes an incorrect choice is good enough to be considered social engineering for me.

fuckingmorons 4y ago
[dead]

NoZebra120vClip 4y ago

Imagine the number of people who have ownership of business-critical documents in the cloud. Now imagine a venn diagram with the number of people who don't realize that granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity.

TheDong 4y ago
> granting any permission at all to "Anyone who has this link" is, in the end, security through obscurity. That's like saying passwords are "security through obscurity" because they're also "obscure" random strings, just like URLs. To try and make my point more clear: Basic auth password url: https://username:randomSecurePassword@webpage.com https://username:randomSecurePassword@webpage.com Google docs edit url: https://docs.google.com/randomLongString/edit https://docs.google.com/randomLongString/edit How are those two things different, other than one is a password which might be short and insecure, and the other has plenty of entropy? Will you also argue that all shared secrets are security by obscurity?
- BobbyJo 4y ago
  > How are those two things different How they're used? I mean, we can argue that pizzas are wheels because they're circles, but, until you throw one on a car and get where you're going, no one will take it seriously. URLs get shared, passed around, posted in chats, etc. Passwords don't, or at least everyone knows they're doing something wrong if they do. In the case of the this doc, if it was privately shared, I don't think anyone would have mistakenly posted their Google password the same way.
  - shkkmo 4y ago
    Then it sounds like both passwords and gdoc authorization links depend on security through obscurity, but people are less aware of that fact for the links. There is a point here that the difference between access level grants is not clear enough and the urls should have a clearer demarcation of the level granted, (e.g. sheets.google.com/danger-allows-editing/{secureToken} or sheets.google.com/allows-viewing/{secureToken}.)
    - BobbyJo 4y ago
      If you're going to classify passwords as security through obscurity, then how would you accomplish security through any other means? All forms of digital security require information asymmetry (IE someone holding information not known to others). The only other security I can think of is physical, and most of that is designed around information asymmetry as well (key cards, door codes). STO to me generally indicates there is some backward engineering process, or some vital related knowledge, that can break it, which is specifically not the case here. Secrets are specifically designed to have common forms and functions, you only keep the value itself, or values they were derived from, secret. Obscurity and secrecy have slightly different meanings.
      - shkkmo 4y ago
        > If you're going to classify passwords as security through obscurity Sorry if this wasn't clear. I was trying to adopt your apparent definition to point out that, passwords and authorizing-links can have identical functional forms. Both depend on maintaining the secrecy of a specific piece on non-design / non-implementation knowledge. To make this clearer, let's say that your document's authorization link is determined by hashing the document id. If you don't use a salt, then the security of the system depends on the obscurity of your choice of hashing function. If you do use a salt, then your security also depends on the secrecy (and strength) of the salt value. Since the issue in this case wasn't people reverse engineering the means of generating links to uncover it, the issue was not a dependence on obscurity of design and implementation. The issue was that the users of the system were not aware or forgot that authorization links were a secret or confusion about what level of secrecy was needed for a specific link. This is why I specifically called out a possible design change to the authorization links that would reduce the likelihood of similar human error. Edit: In general, "security through obscurity" is both a nebulous term and one that often doesn't mean use of obscurity of design/implementation a portion of the security stance, but rather an over-reliance on obscurity of design/implementation without other security measures, such as the use and careful management of strong secrets such as passwords/keys. This potential confusion makes me view the "security through obscurity" term as more of a buzzword than a specific security criticism.
ceejayoz 4y ago
If the super long string on a Google doc is “security through obscurity”, so are passwords, 2FA codes, and ssh keys.
- Nextgrid 4y ago
  One persists in your browser history and is easy to copy/paste into the wrong place, the other is not (good luck copying a password field without technical workarounds such as changing the field type in the developer tools).
- NoZebra120vClip 4y ago
  A Google Doc ID (or Drive/Sheets/Slides) is a single identifier which denotes a resource in the cloud. It is a name; it is not intended as a secret. "Anyone with the Link" really means anyone. In fact, I would say that "Anyone with the Link" access modes are a hack and a workaround for people who do not have Google accounts. If you rely on privacy, use Google accounts. So if you created a secret, clandestine, world-readable, anyone-comments, blog post with the slug "http://example.com/correct-horse-battery-staple/ http://example.com/correct-horse-battery-staple/" would you really complain when someone brute-force or outright guessed your blog post? YouTube has "unlisted" videos which are unsearchable and unreachable unless you've been shared a link, but do people freak out when someone stumbles across this shared by others? Just because a Google Workspaces ID is a long, jumbled-up, base-64 string doesn't mean it is a password or a cryptographically secure secret. It's quite different. It's meant to be well-known by anyone who is intended to have access. The "Anyone with the Link" access simply relies on a circle of friends/colleagues keeping the URL to themselves.

gus_massa 4y ago

I'm not sure if something like this also happened here, but I have sometimes a document shared with a few coworkers. While discussing it by email, I have to send them (again) the link because otherwise they can't find it. Each time, gmail says that "John" will not be able to see the document and offers to make it readable/editable for anyone with a link. It appears in a modal window that blocks sending the message. I must read carefully the modal window to click the correct button. "John" can see the doc because he has a google account, but I'm sending the message to his yahoo email because it's his preferred email. Anyway, I only have a draft of a math midterm for next week. If a hundred of thousands of dollars were in the line, I'd be very nervous.