News for hackers. Stuff that matters.

A comment on Lapsus$ and SolarWinds hackers both use the same old trick to bypass MFA. Parent comment

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by lupire on Thursday March 31, 2022 @08:21AM (#30866345)
If a hacker uses my account to hack my employer via Microsoft's terrible MFA, it's not my problem. The buck stops, as always, with the person who cares about the resource being accessed, or who is made to care by being legally liable.

For a disgruntled employee (most employees), getting hacked is a win-win.

[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by bayindirh on Thursday March 31, 2022 @08:27AM (#30866400)
That's an interesting take.

Let's change names.

What if it's Google, Blizzard / Epic (Battle.net), and something personal? These services use the same flows.

Or worse, what if it's your e-Government app, and you lose all your identifying information and somebody can become "you" with all the information they got?

Will you say "Meh, it's a personal account, and I gave access via MFA, but who cares, it's not my problem?".

[ Parent | on HN ]