3 ms·
Everything seems like obviously Rogers' fault up until this: "“It’s completely ridiculous,” said Grant. “All they did was go on the chat session and say, ‘Hi,
by Aqueous 13y ago
Everything seems like obviously Rogers' fault up until this:
"“It’s completely ridiculous,” said Grant. “All they did was go on the chat session and say, ‘Hi, I’m James Grant and I have a server with you’ and the data centre said, ‘Yes you do, what can we do for you?"
If Rogers is like many ISPs, where you can chat with a representative but only after you've logged into their online portal, this seems to suggest that the attacker had already passed through authentication into Grant's account on Rogers, which is why they did not do additional verification. I agree that additional verification, in a form not required in the initial login, should be done at the beginning of the chat, before taking any user-requested action. But the article doesn't specify how the hacker in question obtained access to Grant's Rogers account to begin with. Until we know that we can't fully ascertain the extent of Rogers' liability here.
- mikeash 13y agoDon't most companies let you do a live chat without logging in first? One of the things you might want to handle with a live chat with tech support is "I can't log in", so it would be odd to restrict it to logged in users. For this particular situation, I just went to rogers.com, "Contact Us", and followed the links to a live chat. Never asked me to log in, although it did ask me for contact info and I stopped at that point. I don't know if that gets me access to the servers, but once you're in a company in any capacity you may be able to socially engineer yourself pretty far.
- Aqueous 13y agoGiven how much physical security the article says they have, I seriously doubt that Rogers would take action on any server through the anonymous, public-facing live chat. It is possible, of course, but I wish the article would clear that up.
- fifty50chance 13y agoThat's why it's so incredulous and negligent. Not a single verification and Rogers bypassed every security measure in place.