91
Lawsuit says Clorox hackers got passwords simply by asking (www.nbcnews.com)
submitted 1 year ago by to c/cybersecurity@sh.itjust.works
12 comments fedilink hide all child comments

all 12 comments

sorted by: hot top controversial new old
[–] 23 points 1 year ago (8 children)

jee.. is that easy? what's your password OP?

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] [S] 43 points 1 year ago* (4 children)

    hunter2, but don't tell anyone because it's a secret.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 37 points 1 year ago (3 children)

    All I see is ******2

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 18 points 1 year ago (1 child)

    Yup, it is. Social engineering is by far the most effective means of gaining unlawful access to any system.

    Humans are always the weakest link.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 10 points 1 year ago

    Exactly. Many breaches follow this pattern:

    1. Learn the name and some basic details about the secretary or something
    2. Call corporate tech support asking for a password reset claiming to be the secretary
    3. Access important stuff since secretaries have a surprising amount of access

    Replace "secretary" with some other relevant individual who has a surprising amount of access and wouldn't attract attention.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 9 points 1 year ago

    Hi, I'm Steve from corp. I need your password to verify some settings....

  • permalink
  • fedilink
  • source
    •
    [–] 8 points 1 year ago (1 child)

    At least it wasn't due to a user input sanitization issue

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •