Lapsus$ and SolarWinds hackers both use the same old trick to bypass MFA

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by AussieWog93 on Wednesday March 30, 2022 @06:33PM (#30861662)

Google did something even worse with old Google Drive links.

I published a link to some documentation back in 2017, and set the permissions of the link to "view".

Google, in their infinite wisdom, decided that somehow this link wasn't secure enough and now send notifications to my tablet every time someone clicks to manually authorise access.

This would be a pain in the arse at best, but they've somehow managed to fuck things up even more. By default, the permissions I'm granting to the user through these notifications is set to "edit".

Just to reiterate, they've "improved security" by spamming me with notifications to grant random members of the public full edit permissions on document that was intended from day one to be publicly accessible.

I just weep sometimes.

[ Parent | on HN ]

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by 2arrs2ells on Wednesday March 30, 2022 @07:42PM (#30862191)

This might be the individuals clicking to request edit access on the Doc: https://support.google.com/docs/answer/6239515?hl=en&co=GENI...

[ Parent | on HN ]

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by AussieWog93 on Wednesday March 30, 2022 @09:03PM (#30862705)

It wasn't that. They sent me an email to tell me that I needed to regenerate the link for security purposes and after date x it would no longer function as normal.

[ Parent | on HN ]

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by Plasmoid2000ad on Thursday March 31, 2022 @05:36AM (#30865364)

I think that was for a simpler problem, that shared urls were not unique enough, and could be guessed or brute forced to get random peoples shared items. The articles published by google seemed to warn that there was an expectation gap on the amount of privacy people should have expected to have on them.

[ Parent | on HN ]

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by yuliyp on Thursday March 31, 2022 @01:16AM (#30864033)

That might be a "we need to change how we're generating URLs because we want to refactor stuff / not support the old format because it was too guessable or something" thing.

[ Parent | on HN ]

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by jkaptur on Wednesday March 30, 2022 @09:47PM (#30863006)

For context on what's happening here: https://support.google.com/a/answer/10685032

(Disclosure: I work at Google. I used to work on Docs & Drive, but don't anymore and don't have any special knowledge about this).

[ Parent | on HN ]

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by lupire on Thursday March 31, 2022 @08:30AM (#30866415)

That's people requesting Edit permissions.

You can disable Edit requests (and avoid "link" sharing) by Publishing the file, which is different from sharing a /view link.

https://support.google.com/docs/thread/28614984/remove-reque...

[ Parent | on HN ]