Comment by pfarnsworth | Hacker News Reader

Comment by pfarnsworth | Hacker News Reader

Parent Full thread

Social engineering in tech has been around since before Kevin Mitnick publicized it and went to jail (unjustly). Why do we keep making the same mistakes over and over again as an industry? We NEED UNIFORM security standards with ALL trusted companies with customer support, where we have tiers of support, and 1st tier doesn't have any access that could compromised security. Similar to ISO standards.

This means there can't be any "impedance" mismatching that can be used from one service to another. For example, one company gives out the last 4 digits of the credit card, and the other uses the last 4 as security info.

What we need is a uniform security standard and training for ALL customer support personnel so that you can use Apple to break into Amazon, or Digital Ocean or Namecheap. The staff need to be trained to never succumb to social engineering ever, and in fact make it impossible for 1st line support to reset anything. Have any security information get passed up to second tier support who are extremely well-trained. Etc.

And have this standardized so that there is incentive for customers to look for this certification so that we don't have to keep suffering the same mistakes over and over again.

> Kevin Mitnick publicized it and went to jail (unjustly)

You're joking right? He even fully admits that he did what they accused him of doing.

FWIW, I've only read Ghost in the Wire, but all he admits to there is that he broke into systems and download the source code för various systems. Nothing destructive, nothing he made any money off.

(the book is great, by the way, highly recommended)

Ever heard of a plea deal? He was obligated to 'admit wrongdoing' in order to get a reduced sentence. Sure, he could have stuck to his guns, but, jail has very bad internet.

I meant in his book and speeches he has since given he has admitted doing more or less what they accused him of doing.

I'd definitely agree that the solitary confinement was cruel and unusual. I'd also agree that the law wasn't mature enough when he was charged so he was charged with proxy-laws.

But ultimately he did do what they said he did, and some of it was pretty messed up. He would definitely be charged today with computer crimes (or generic crimes) for many of his exploits at the time.

I would imagine owning up to his "crimes" helps his business / brand. If he disclaimed all credit, he would be seen less an an expert in his field of work.

https://www.mitnicksecurity.com

Do you know anything about the case? They said he shouldn't even use the phone and spent time in solitary because they said he could cause a nuclear war. The entire case against him was horrifying to anyone that cares about human rights.

As a business, it costs more to piss off your customers regularly because they can't get into their accounts than it does to refund the rare victim of social engineering.

Sounds exactly like what I would expect from a lazy, shortsighted business who believed that a successful social engineering attempt wouldn't cost them more money.

While "security specialists" are using last digits of CC and mother's maiden name as secure info I'm not holding my breath

Talking about Kevin Minnick, I can really recommend his book Ghost in the Wires, both for the story and the numerous great examples of social engineering https://henrikwarne.com/2015/12/27/social-engineering-from-k...

We need automated security protocols with real humans only for emergencies, edge cases, or where things go wrong.

There is no reason for Namecheap to have a human in the loop for this, at this stage.

I like this idea. If you want to work as a CS rep and handle password resets, you need to have XYZ 1.0 security training, regardless of the company.

I hate to break it to you, but "uniform" security standards that are out there in the open would be like a whole can of worms.

That is like showing someone "here's a lock and what's inside of it."

In time, someone will pick that lock.

Uniformity is what you don't need, nor would you want to know the nuances of how security and privacy are handled at a company so that you know exactly what holes need to be exposed.

You can't standardize security. It's way too risky.

You're basically advocating for security through obscurity.

A standardized process design could be carefully examined and improved to plug the holes, so all you're left with are implementation bugs. You'll never get there with a thousand disparate processes: they'll have design and implementation bugs, as well situations where system compromises data used to secure another.

Plus, standardized processes would allow implementation of more expensive processes. For instance, you could have a higher-grade fallback "prove who you are" process that involves going to some designated office in-person with all the right documents. Not even Google would pay to setup such offices in every city, but if Google, Amazon, Online Banks, etc. all would use it, it might be possible.

That's exactly what I'm advocating. Standardization would expose millions of people to policies that can be exploited in time. It's better for all of us not to know.

I know, this is an issue some would disagree with. I do not think it's safe to standardize at all.

"Here's a lock and here's what inside it, but you still can't break it because you lack a separate secret of no mechanical relevance" is the only way to make a system secure. If it is possible at all, you WANT a system where knowledge of all the mechanics do not allow people to crack the safe.

See encryption. A secure crypto mechanism is not vulnerable to disclosure of its mechanism. The key is the secret. The mechanism is not. Having a secret mechanism that relies on its own secrecy means your main weakness is someone explaining how it works to the outside world.

RSA is perfectly well-known. So is rot13. rot13 is crap, disclosure or not. RSA is not as crap, disclosure or not.

Of course you can standardize security. This means that the same authentication methods would be used across the industry, and the agents would be trained to not leak those details through social engineering, etc. It would mean that there would be standards with respect to what information tier 1 agents have vs tier 2 agents, etc, with proper separation of duties, so that poorly trained tier 1 agents wouldn't have the ability to be socially engineered.

Your method of security through obscurity simply doesn't work because hackers will figure it out and exploit impedance mismatches between vendors.

Reply on news.ycombinator.com