Hackers breach MailChimp's internal tools | Hacker News Reader

Hackers breach MailChimp's internal tools

bleepingcomputer.com

53 pointsprostoalex9 comments

"The incident was propagated by an external actor who conducted a successful social engineering attack on Mailchimp employees, resulting in employee credentials being compromised."

My dreams of some 4D-chess exploit were squashed 30 seconds into reading the article.

Why go through the window when someone will hold the door open for you?

Most hacking intrusions begin with social engineering....The last godlike 4D-chess exploit that I remember was Heartbleed in 2014[0].

[0] https://en.wikipedia.org/wiki/Heartbleed

Hubspot internal tools were accessed in the first half of March, also targeting crypto companies. https://hn.algolia.com/?q=hubspot+leak

With the active recruitment of low level support/engineering insiders as saboteurs what is the right way forward? More security or a better work environment?

Maybe auditing. When I was a wee lad on American Online in the 90s, our biggest desire was to steal the most 31337 screen names. One way of doing this was learning of people who worked at the call centers you’d call for account problems. Once you were friendly enough, you could sometimes convince them to pull an account’s information for you. Then you’d call the call center from a pay phone and, using the stolen information, reset the password. This allowed you to get on the account for a while to brag. In some cases, you could permanently steal the AOL Instant Messenger (AIM) version of the screen name unbeknownst to the original account owner.

Anyway, AOL recognized this insider threat and audited and reviewed any access to their internal account systems (called CRIS or Merlin IIRC), which pretty much killed the method of using insiders since they were caught and fired pretty quickly.

A lot of engineers will hyper-focus on building some labyrinthine security system to try and thwart employees leaking credentials, but understanding WHY an employee will willingly compromise their credentials is the true starting point. Phishing attempts may seem obvious to the tech-literate, but the average office or call center worker is probably more focused on pleasing their manager or not hurting their customer feedback rating than focusing on security. Maybe employees don't know about where to direct security concerns? Maybe they've had a negative interaction with the IT/security team at some point in the past? At a previous employer the security team would periodically send out a wave of phishing attempts to employees to see how they would react.

> some of their employees fell for a social engineering attack

This is becoming a more common trend - you no longer have to be a techie to "hack" - people skills are the up-and-coming essential tool.

Social engineering has _always_ been a huge factor, either allowing exploits or making them worse. This has been true in tech since at _least_ the 70s. Realistically it's been true as long as society bigger than a household has existed.

Reply on news.ycombinator.com