Comment by tialaramex | Hacker News Reader

Comment by tialaramex | Hacker News Reader

Parent Full thread

I'm interested in what sort of "multifactor authentication token" and how IT support were able to grant this request.

Are we talking about a physical token like an old-fashioned SecurID OTP keyfob or a Yubikey? Or something custom?

Or are we just talking about a code that real employees get via TOTP or worse SMS?

It seems like the same week large employers figured out they would need to FedEx the new guy a laptop since he can't come to the office, they would likewise realise they want to make sure they FedEx that laptop to his actual home, not some building site a scammer told them to send it to. And so you'd hope that physical tokens likewise can't just be sent to some random social engineer based on one chat.

Even if you do succeed in getting them to FedEx the token to a building site, that's not a trivial extra step to retrieve. If some teenage "criminal mastermind" gives their parents home address to get the token delivered, they've also told cops where to start looking for the "hacker".

Whereas if it's just a code then I can more easily imagine IT support just pastes it into Slack for you.

It was probably a one-time-use bypass code offered by a 2FA provider.

sounds like it's a simple software token. Hackers needed an account for this, which they got by paying 10$ for stolen cookies lol. So now they can log into some random employees account, then get an admin issued 2FA code. Never seen these "bypass" codes before, but that's my best guess.

The stolen cookies imply full access to one of the employees machines.

How is something like this advertised on forums?

Valid auth token for employee at EA Games for sale? Does it list the expiration? Refunds if it isn’t valid at time of sale?

nah not to the full machine. This is just a Slack token. Someone basically had the employee click on something with XSS or some other way to steal cookies (idk there's a bunch of ways you can steal cookies out of someone's browser)

Token most likely refers to a software OTP token. That would require having an account, but the same would be true for a hardware token.

A simple Zoom call with your camera on for anything private could have stopped all of this.

Not really, IT generally have no idea what you look like. I suppose if the company provided your ID photo to tech support, then that could supplement this though. However, I've never seen a company do that.

I’ve definitely worked at companies with a formal corporate directory that had your name, phone #, office location, and badge photo. Seems less common in startups though.

Even just having your face recorded (after which, if it turned out you were a hacker, it could go on wanted posters or whatever) might be a significant deterrent.

I assume with some OS plug-in you can have an AI model slightly change your face enough to not be traced back to you

Does it look legit? Visual glitches would raise a red flag.

Having seen some of the filters people show off on TikTok... Yes. Yes they do.

we have a company directory with everyone's photo in it all employees can access. It's part of the HR onboard to put a photo in your profile day 1.

>Are we talking about a physical token like an old-fashioned SecurID OTP keyfob or a Yubikey? Or something custom?

I used to have a citrix fob that gave me a OTP but then my employer switched to azure and now it's all text message based. That was just last year.

Reply on news.ycombinator.com