News for hackers. Stuff that matters.

A comment on Operation Luigi: How I hacked my friend without her noticing.

Re:Operation Luigi: How I hacked my friend without her noticing by devwastaken on Thursday August 03, 2017 @10:59AM (#14920133)
This is the best commentary on a real-life social engineering hack I've seen. Whats really interesting is how he was able to be undetected mostly, because services like linkedin only had an optional requirement for forcing all devices to re-login when a password was changed, and that the hacked individual wasn't using 2FA on her email.
[ Parent | on HN ]
Re:Operation Luigi: How I hacked my friend without her noticing by albertgoeswoof on Thursday August 03, 2017 @11:52AM (#14920618)
Agree this is excellent, and demonstrates how straightforward phishing really is. 2FA wouldn't save you here either, as that can easily be phished at the same time (except for U2F tokens).
[ Parent | on HN ]
Re:Operation Luigi: How I hacked my friend without her noticing by jethro_tell on Thursday August 03, 2017 @12:56PM (#14921306)
right the point of u2f is the physical token
[ Parent | on HN ]
Re:Operation Luigi: How I hacked my friend without her noticing by vertex-four on Thursday August 03, 2017 @06:35PM (#14924592)
The "point" of U2F instead of HOTP/TOTP is that the code you send to evilhacker.com can't be used on google.com - so getting a usable token by phishing is impossible. HOTP/TOTP are flawed in that you can send the generated code to evilhacker.com and they can use it to log in to google.com with you being none the wiser.
[ Parent | on HN ]
Re:Operation Luigi: How I hacked my friend without her noticing by albertgoeswoof on Thursday August 03, 2017 @06:35PM (#14924590)
Sort of - the point of u2f is challenge-response on the key, which is tied to the URI or https session, which makes it impossible to phish without a browser exploit
[ Parent | on HN ]
Re:Operation Luigi: How I hacked my friend without her noticing by EGreg on Thursday August 03, 2017 @02:21PM (#14922232)
How would you phish 2FA "at the same time"?
[ Parent | on HN ]
Re:Operation Luigi: How I hacked my friend without her noticing by albertgoeswoof on Thursday August 03, 2017 @02:31PM (#14922340)
You ask for the token as well and login with it at the same time.

It'll trip you up later if it asks again (e.g. When changing a password or setting up mail forwarding) but your session cookie will be valid for quite some time.

[ Parent | on HN ]
Re:Operation Luigi: How I hacked my friend without her noticing by lemoncucumber on Thursday August 03, 2017 @09:30PM (#14925643)
As I read the part about LinkedIn not mandatorily logging out all your devices, all I could think was that it wouldn't make a difference, because who actually engages with LinkedIn often enough to expect to remain logged in?

Maybe I'm assuming too much that other people are like me, but I interact with Facebook as many times per day as I do per year with LinkedIn.

[ Parent | on HN ]
Re:Operation Luigi: How I hacked my friend without her noticing by pmontra on Friday August 04, 2017 @01:24AM (#14926504)
There are people with the app installed on their phones. They are logged in all the time.
[ Parent | on HN ]
Re:Operation Luigi: How I hacked my friend without her noticing by lemoncucumber on Friday August 04, 2017 @02:19AM (#14926721)
Naturally, of course there are. But the whole article was written about hacking a typical internet user, and my point was that the percentage of people who a) have the LinkedIn app installed on their phone and b) actually open it with any regularity is small enough not to be representative of a typical internet user.
[ Parent | on HN ]
Re:Operation Luigi: How I hacked my friend without her noticing by carroccio on Thursday August 03, 2017 @09:19PM (#14925599)
Alex kuza55
[ Parent | on HN ]