News for hackers. Stuff that matters.

A comment on Ottawa Bitcoin exchange defrauded of $100,000 in cyber currency. Parent comment

Re:Ottawa Bitcoin exchange defrauded of $100,000 in cyber cu... by mikeash on Tuesday March 18, 2014 @10:12AM (#7421999)
Don't most companies let you do a live chat without logging in first? One of the things you might want to handle with a live chat with tech support is "I can't log in", so it would be odd to restrict it to logged in users.

For this particular situation, I just went to rogers.com, "Contact Us", and followed the links to a live chat. Never asked me to log in, although it did ask me for contact info and I stopped at that point.

I don't know if that gets me access to the servers, but once you're in a company in any capacity you may be able to socially engineer yourself pretty far.

[ Parent | on HN ]
Re:Ottawa Bitcoin exchange defrauded of $100,000 in cyber cu... by Aqueous on Tuesday March 18, 2014 @11:07AM (#7422367)
Given how much physical security the article says they have, I seriously doubt that Rogers would take action on any server through the anonymous, public-facing live chat. It is possible, of course, but I wish the article would clear that up.
[ Parent | on HN ]
Re:Ottawa Bitcoin exchange defrauded of $100,000 in cyber cu... by fifty50chance on Tuesday March 18, 2014 @11:13AM (#7422397)
That's why it's so incredulous and negligent. Not a single verification and Rogers bypassed every security measure in place.
[ Parent | on HN ]