▲ 106 ▼ What's up with all this data breaches and leaks? (lemmy.world) submitted 2 years ago by zilla@lemmy.world to c/nostupidquestions@lemmy.world 45 comments fedilink hide all child comments Was this always happening in this big scope? Leaks of games, data that is stolen, all these breaches in big companies. Feels like I see this everyday
[–] OsrsNeedsF2P@lemmy.ml 26 points 2 years ago (2 children) Security people can help, but often can't. The issue is with software design, and most companies struggle to properly fund that. permalink fedilink source parent hideshow 4 child comments replies: [–] edgemaster72@lemmy.world 13 points 2 years ago (3 children) In addition, I don't have data to back it up, but I feel like social engineering plays at least a part in many if not most of the big hacks we see happening permalink fedilink source parent hideshow 6 child comments replies: [–] FuglyDuck@lemmy.world 17 points 2 years ago Social Engineering is absolutely the lions share of how things get done. Remember: Never work the system if you can work the people running it. This is true of hacking, yes, but also just navigating all the bullshit bureaucracy that surrounds modern life. For hackers, cracking good passwords is almost impossible (this is to say, it is possible but it takes... a very long time. Longer than they have.) So they rely on people having terrible password discipline- they're using phishing schemes to get passwords and guess similar passwords at other places. They're also using social engineering to convince your cell phone company they're you..... at which point the cell phone CS rep becomes extremely helpful in bypassing any security that normally routes through your phone. (Like, say SMS 2fa. Or phone call 2fa,) permalink fedilink source parent [–] berkeleyblue@lemmy.world 3 points 2 years ago It does. And also just plain old bribing. I work for a big Tech Company, and while I‘m only a Retail employee, I have been offered quite some money throughout the years to share my logins (which honestly wouldn’t get you very far). People with more acces than me (Managment or Support employees) apparently received offers in upper 5 Digit territories. If you ask enough people, I‘m not 100% confident that all would say no to that. But to be fair, there’s a lot of hurdles now in between those things with acces being restricted to internal networks, multi factor and trusted device policies a real crackdown on who has access to what. Passwords allone don’t get you very far anymore. permalink fedilink source parent [–] LilB0kChoy@midwest.social 2 points 2 years ago Layer 8 is the hardest to secure. permalink fedilink source parent [–] netburnr@lemmy.world 1 point 2 years ago Yeah, it's a struggle with there are a dozen zero days a year for multiple brands/applications. I have at least 4 people always doing some sort of upgrade or patch being reported by infosec. permalink fedilink source parent
[–] edgemaster72@lemmy.world 13 points 2 years ago (3 children) In addition, I don't have data to back it up, but I feel like social engineering plays at least a part in many if not most of the big hacks we see happening permalink fedilink source parent hideshow 6 child comments replies: [–] FuglyDuck@lemmy.world 17 points 2 years ago Social Engineering is absolutely the lions share of how things get done. Remember: Never work the system if you can work the people running it. This is true of hacking, yes, but also just navigating all the bullshit bureaucracy that surrounds modern life. For hackers, cracking good passwords is almost impossible (this is to say, it is possible but it takes... a very long time. Longer than they have.) So they rely on people having terrible password discipline- they're using phishing schemes to get passwords and guess similar passwords at other places. They're also using social engineering to convince your cell phone company they're you..... at which point the cell phone CS rep becomes extremely helpful in bypassing any security that normally routes through your phone. (Like, say SMS 2fa. Or phone call 2fa,) permalink fedilink source parent [–] berkeleyblue@lemmy.world 3 points 2 years ago It does. And also just plain old bribing. I work for a big Tech Company, and while I‘m only a Retail employee, I have been offered quite some money throughout the years to share my logins (which honestly wouldn’t get you very far). People with more acces than me (Managment or Support employees) apparently received offers in upper 5 Digit territories. If you ask enough people, I‘m not 100% confident that all would say no to that. But to be fair, there’s a lot of hurdles now in between those things with acces being restricted to internal networks, multi factor and trusted device policies a real crackdown on who has access to what. Passwords allone don’t get you very far anymore. permalink fedilink source parent [–] LilB0kChoy@midwest.social 2 points 2 years ago Layer 8 is the hardest to secure. permalink fedilink source parent
[–] FuglyDuck@lemmy.world 17 points 2 years ago Social Engineering is absolutely the lions share of how things get done. Remember: Never work the system if you can work the people running it. This is true of hacking, yes, but also just navigating all the bullshit bureaucracy that surrounds modern life. For hackers, cracking good passwords is almost impossible (this is to say, it is possible but it takes... a very long time. Longer than they have.) So they rely on people having terrible password discipline- they're using phishing schemes to get passwords and guess similar passwords at other places. They're also using social engineering to convince your cell phone company they're you..... at which point the cell phone CS rep becomes extremely helpful in bypassing any security that normally routes through your phone. (Like, say SMS 2fa. Or phone call 2fa,) permalink fedilink source parent
[–] berkeleyblue@lemmy.world 3 points 2 years ago It does. And also just plain old bribing. I work for a big Tech Company, and while I‘m only a Retail employee, I have been offered quite some money throughout the years to share my logins (which honestly wouldn’t get you very far). People with more acces than me (Managment or Support employees) apparently received offers in upper 5 Digit territories. If you ask enough people, I‘m not 100% confident that all would say no to that. But to be fair, there’s a lot of hurdles now in between those things with acces being restricted to internal networks, multi factor and trusted device policies a real crackdown on who has access to what. Passwords allone don’t get you very far anymore. permalink fedilink source parent
[–] LilB0kChoy@midwest.social 2 points 2 years ago Layer 8 is the hardest to secure. permalink fedilink source parent
[–] netburnr@lemmy.world 1 point 2 years ago Yeah, it's a struggle with there are a dozen zero days a year for multiple brands/applications. I have at least 4 people always doing some sort of upgrade or patch being reported by infosec. permalink fedilink source parent