- cross-posted to:
- technology@lemmit.online
- cross-posted to:
- technology@lemmit.online
You must log in or register to comment.
At least it wasn’t due to a user input sanitization issue
Hi, I’m Steve from corp. I need your password to verify some settings…
jee… is that easy? what’s your password OP?
hunter2, but don’t tell anyone because it’s a secret.
All I see is ******2
Ahh, I’m home finally
RIP
bash.orgEDIT: Nice, there’s a bunch of mirrors.
Weird, because all I see is hunter*
correcthorsebatterystaple
Yup, it is. Social engineering is by far the most effective means of gaining unlawful access to any system.
Humans are always the weakest link.
Exactly. Many breaches follow this pattern:
- Learn the name and some basic details about the secretary or something
- Call corporate tech support asking for a password reset claiming to be the secretary
- Access important stuff since secretaries have a surprising amount of access
Replace “secretary” with some other relevant individual who has a surprising amount of access and wouldn’t attract attention.
