2 ms·
Information on the attack is scarce, but it sounds like attackers obtained credentials from prior breaches and used them against super funds. It is shameful th
by Khaine 2y ago
Information on the attack is scarce, but it sounds like attackers obtained credentials from prior breaches and used them against super funds. It is shameful that many of these funds have not yet implemented MFA in this day and age, but it's not like the actual fund got compromised.
Obviously, information at the moment is very light so this understanding may change, but this is the current position.
- yen223 2y agoConvincing and training old retirees to use 2FA is not something I will wish on my worst enemy.
- rwmj 2y agoThe way it's commonly implemented - through SMS - isn't secure anyway. It's relatively easy to persuade an overworked employee at the phone company to issue a new SIM card.
- goatsi 2y agoHaving to call/visit and social engineer an employee is an order of magnitude more work than just logging in with stolen credentials, which can be entirely automated. SMS 2FA is valuable when it can prevent credential stuffing attacks. It's a vulnerability when it can be used to reset passwords and recover accounts.
- Gigachad 2y agoI don’t think this is as true as it once was. These days this stuff is all handled by an automated system that makes you prove your identity / ownership of the number. And support staff likely aren’t given access to override this.