News for hackers. Stuff that matters.

A comment on Hackers used Slack to break into EA Games. Parent comment

Re:Hackers used Slack to break into EA Games by tialaramex on Friday June 11, 2021 @06:26PM (#27479238)
I'm interested in what sort of "multifactor authentication token" and how IT support were able to grant this request.

Are we talking about a physical token like an old-fashioned SecurID OTP keyfob or a Yubikey? Or something custom?

Or are we just talking about a code that real employees get via TOTP or worse SMS?

It seems like the same week large employers figured out they would need to FedEx the new guy a laptop since he can't come to the office, they would likewise realise they want to make sure they FedEx that laptop to his actual home, not some building site a scammer told them to send it to. And so you'd hope that physical tokens likewise can't just be sent to some random social engineer based on one chat.

Even if you do succeed in getting them to FedEx the token to a building site, that's not a trivial extra step to retrieve. If some teenage "criminal mastermind" gives their parents home address to get the token delivered, they've also told cops where to start looking for the "hacker".

Whereas if it's just a code then I can more easily imagine IT support just pastes it into Slack for you.

[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by ferdowsi on Friday June 11, 2021 @08:17PM (#27480086)
It was probably a one-time-use bypass code offered by a 2FA provider.
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by fierro on Friday June 11, 2021 @11:29PM (#27481251)
sounds like it's a simple software token. Hackers needed an account for this, which they got by paying 10$ for stolen cookies lol. So now they can log into some random employees account, then get an admin issued 2FA code. Never seen these "bypass" codes before, but that's my best guess.
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by bredren on Friday June 11, 2021 @11:54PM (#27481390)
The stolen cookies imply full access to one of the employees machines.

How is something like this advertised on forums?

Valid auth token for employee at EA Games for sale? Does it list the expiration? Refunds if it isn’t valid at time of sale?

[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by fierro on Saturday June 12, 2021 @09:10PM (#27488904)
nah not to the full machine. This is just a Slack token. Someone basically had the employee click on something with XSS or some other way to steal cookies (idk there's a bunch of ways you can steal cookies out of someone's browser)
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by himinlomax on Friday June 11, 2021 @07:51PM (#27479925)
Token most likely refers to a software OTP token. That would require having an account, but the same would be true for a hardware token.
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by pwillia7 on Friday June 11, 2021 @08:12PM (#27480049)
A simple Zoom call with your camera on for anything private could have stopped all of this.
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by scoopertrooper on Saturday June 12, 2021 @12:30AM (#27481548)
Not really, IT generally have no idea what you look like. I suppose if the company provided your ID photo to tech support, then that could supplement this though. However, I've never seen a company do that.
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by ericbarrett on Saturday June 12, 2021 @12:35AM (#27481569)
I’ve definitely worked at companies with a formal corporate directory that had your name, phone #, office location, and badge photo. Seems less common in startups though.
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by Gaelan on Saturday June 12, 2021 @05:16AM (#27482992)
Even just having your face recorded (after which, if it turned out you were a hacker, it could go on wanted posters or whatever) might be a significant deterrent.
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by spacephysics on Saturday June 12, 2021 @06:55AM (#27483533)
I assume with some OS plug-in you can have an AI model slightly change your face enough to not be traced back to you
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by lobocinza on Saturday June 12, 2021 @01:07PM (#27485817)
Does it look legit? Visual glitches would raise a red flag.
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by Nexxxeh on Saturday June 12, 2021 @08:54PM (#27488795)
Having seen some of the filters people show off on TikTok... Yes. Yes they do.
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by pwillia7 on Tuesday June 15, 2021 @07:36PM (#27523012)
we have a company directory with everyone's photo in it all employees can access. It's part of the HR onboard to put a photo in your profile day 1.
[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by LegitShady on Friday June 11, 2021 @06:34PM (#27479329)
>Are we talking about a physical token like an old-fashioned SecurID OTP keyfob or a Yubikey? Or something custom?

I used to have a citrix fob that gave me a OTP but then my employer switched to azure and now it's all text message based. That was just last year.

[ Parent | on HN ]