26 ms·

"I can't believe they are thefts out there paying other thefts for theft-services..." Completely seriously, you and everyone else reading this need to not just

by jerf 2y ago

"I can't believe they are thefts out there paying other thefts for theft-services..." Completely seriously, you and everyone else reading this need to not just "know" this, but believe it and feel it. Too often I feel like programmers are like fat 50-year-olds talking smack on the locker room about how doomed the other team is because they know the importance of MD5-hashing passwords in the database, and they have no idea they're going out on to the field against an NFL team. Of course, where this metaphor breaks down is that these metaphorical lardasses will not be able to fail to notice them getting their asses handed to them, whereas in the security space, their real-world analogs may not even notice they were hacked. It's brutal out there. Even the open source tooling is far more sophisticated that most people reading this realize, and that constitutes the baseline, not the top end. There's an underground economy, and it is sponsored by many entities with deep pockets, including large-scale criminal enterprises, some of which can rival "real" companies in scale, and government-backed operations of all sorts. You're not up against a stray hacker bumbling into your system. If you've got assets worth anything, you're up against professional organizations. If you are responsible for anything that matters, take the threats seriously.

kurthr 2y ago
Absolutely, if there's a moderately anonymous way to get significant sums of money out of something, sophisticated attackers will spend significant effort and even % of funds to extract it. That includes bribery, phishing, spamming, as well as the usual hacking and cracking exploits. As you mention, the other issue is that this is often invisible (or even hidden by) to those who created the system that allowed the extraction.
14 2y ago
“If you got assists worth anything…” well finally I am in a positive position for being monetarily poor. The other great thing about being poor is I had to learn to be a backyard mechanic to fix my own broke down cars.
deleted 2y ago
[deleted]
fsckboy 2y ago
>Too often I feel like programmers are like fat 50-year-olds talking smack on the locker room about how doomed the other team is because they know the importance of MD5-hashing passwords in the database, and they have no idea they're going out on to the field against an NFL team. why did you go out of your way to insult fat 50 year olds? any NFL team would absolutely crush any allstar team of programmers in their 20s, even if they were selected for regularly doing triathlons and a lot of lifting. Any NFL team would beat the NCAA Division 1 champion football team. (for non-USA, that's a university team, the same teams that supply most of the players to the NFL, but only a fraction of even a championship team actually make it) I wouldn't bet against a fat 50 year old retired NFL players team against any "we know MD5 squad"
- jerf 2y ago
  Nobody is actually offended. You are only offended on behalf of hypothetical other people, seeing an opportunity to score political points. Not only am I not impressed, I am disgusted. Being offended on behalf of other hypothetical people to score political points at other people's expense is a scourge on our culture.
- deleted 2y ago
  [deleted]
- maximus-decimus 2y ago
  I think they meant more hobby leagues where people just play to hang out with friends and drink beer.
- RIMR 2y ago
  You do realize that it was a metaphor, right?
bluejekyll 2y ago
You make a great point, but you’ve done it while insulting an entire group of people, which is unnecessary.
- RIMR 2y ago
  He wasn't calling you a fat 50 year old, he was just conjuring up a metaphor of an overweight middle aged guy thinking he can take on a pro NFL team. I thought it was a humorous way to convey the difference in strategies between corpo IT and organized cybercriminals, and the unearned confidence of the former.
Jenk 2y ago
I'm gravely naive to modern security methods (both defense and offence) but I work closely with some infosec guys in a big-fish company and they often share tales/experiences that I find fascinating because of their ingenuity and temerity. Some examples: We have had multiple attempts to use AI as imposters to convince well-wishing colleagues into doing things they shouldn't - a complicated technique that has seen success for the hackers on some occassions[0] - which requires infilitrating numerous accounts etc. This one is the "hollywood romanticized" idea of hacking because it is in realtime with actual people operating the stolen accounts, but using AI to mask their appearance and voice. Sleeper infiltration - someone will find and breach an exploit, only to patch it, but leave a new backdoor. They then let it sleep for many months, eventually coming back to use it only to (attempt to) completely remove any trace of their presence. inb4 anyone says "ah but they probably copied/did something else you don't know about!" We've had those, too, but some really do just exploit, patch, then leave. Probably to deny someone else or something. A really fascinating moment for me was watching a seceng spinup a honeypot and it took less than a minute for some attacks to start hitting it. [0]: https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-k...
slaymaker1907 2y ago
Talking about tooling, it’s kind of incredible how good John the Ripper is at cracking passwords. I think a lot of people would benefit tremendously from seeing how fast their “clever” tricks for coming up with passwords are demolished.

by jerf 2y ago

kurthr 2y ago

Absolutely, if there's a moderately anonymous way to get significant sums of money out of something, sophisticated attackers will spend significant effort and even % of funds to extract it. That includes bribery, phishing, spamming, as well as the usual hacking and cracking exploits. As you mention, the other issue is that this is often invisible (or even hidden by) to those who created the system that allowed the extraction.

14 2y ago

“If you got assists worth anything…” well finally I am in a positive position for being monetarily poor. The other great thing about being poor is I had to learn to be a backyard mechanic to fix my own broke down cars.

deleted 2y ago

[deleted]

fsckboy 2y ago

>Too often I feel like programmers are like fat 50-year-olds talking smack on the locker room about how doomed the other team is because they know the importance of MD5-hashing passwords in the database, and they have no idea they're going out on to the field against an NFL team. why did you go out of your way to insult fat 50 year olds? any NFL team would absolutely crush any allstar team of programmers in their 20s, even if they were selected for regularly doing triathlons and a lot of lifting. Any NFL team would beat the NCAA Division 1 champion football team. (for non-USA, that's a university team, the same teams that supply most of the players to the NFL, but only a fraction of even a championship team actually make it) I wouldn't bet against a fat 50 year old retired NFL players team against any "we know MD5 squad"

jerf 2y ago
Nobody is actually offended. You are only offended on behalf of hypothetical other people, seeing an opportunity to score political points. Not only am I not impressed, I am disgusted. Being offended on behalf of other hypothetical people to score political points at other people's expense is a scourge on our culture.
deleted 2y ago
[deleted]
maximus-decimus 2y ago
I think they meant more hobby leagues where people just play to hang out with friends and drink beer.
RIMR 2y ago
You do realize that it was a metaphor, right?

bluejekyll 2y ago

You make a great point, but you’ve done it while insulting an entire group of people, which is unnecessary.

RIMR 2y ago
He wasn't calling you a fat 50 year old, he was just conjuring up a metaphor of an overweight middle aged guy thinking he can take on a pro NFL team. I thought it was a humorous way to convey the difference in strategies between corpo IT and organized cybercriminals, and the unearned confidence of the former.

Jenk 2y ago

I'm gravely naive to modern security methods (both defense and offence) but I work closely with some infosec guys in a big-fish company and they often share tales/experiences that I find fascinating because of their ingenuity and temerity. Some examples: We have had multiple attempts to use AI as imposters to convince well-wishing colleagues into doing things they shouldn't - a complicated technique that has seen success for the hackers on some occassions[0] - which requires infilitrating numerous accounts etc. This one is the "hollywood romanticized" idea of hacking because it is in realtime with actual people operating the stolen accounts, but using AI to mask their appearance and voice. Sleeper infiltration - someone will find and breach an exploit, only to patch it, but leave a new backdoor. They then let it sleep for many months, eventually coming back to use it only to (attempt to) completely remove any trace of their presence. inb4 anyone says "ah but they probably copied/did something else you don't know about!" We've had those, too, but some really do just exploit, patch, then leave. Probably to deny someone else or something. A really fascinating moment for me was watching a seceng spinup a honeypot and it took less than a minute for some attacks to start hitting it. [0]: https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-k...

slaymaker1907 2y ago

Talking about tooling, it’s kind of incredible how good John the Ripper is at cracking passwords. I think a lot of people would benefit tremendously from seeing how fast their “clever” tricks for coming up with passwords are demolished.