Technology

glares in the general direction of the White House

Pobody's Nerfect

You're either perfect, or you're not me.

Only just today?

I almost fell for a bank scam a couple years back. Basically, I had just gotten a new phone w/ GrapheneOS, which doesn't have Google's scam number protection (I was well aware, that's not the issue) and I hadn't yet transferred my contacts, and I received a call about a fraud alert on a card. This has happened a few times, and usually it's a pretty straightforward call where they verify my identity before asking me about certain transactions. As a bit of background, I was on vacation at the time and I got the call while waiting in the parking lot while my SO ordered something at a food truck.

Anyway, the call progressed like this:

1. Mentioned , which I have
2. Asked to verify my identity with a code to my phone - standard
3. Went over a couple suspicious transactions, which I confirmed wasn't me
4. Asked to verify my identity again, and that's where I got suspicious, so I didn't provide it

I immediately called my bank and sorted things out, and we figured out nothing was stolen because I didn't provide the second code (that was to link an external account to suck my money out). Because I was in an unfamiliar setting and honestly pretty tired (we drove all day the day before), I just skimmed the text in step 2 w/o reading that it was a user-initiated code (i.e. for a password reset) instead of a bank initiated code (i.e. verify identity).

I consider myself a pretty security-conscious person. I use a password manager, MFA everywhere I can (preferring TOTP), I'm a lead backend SW engineer who has caught multiple security issues, etc. However, I fell for the scam and missed the safeguard that should have protected me. Fortunately it all worked out, but I did have to change all of my account numbers and login, which wasn't particularly fun while on vacation. That bank is fortunately one of the few that supports TOTP in my country, though I had avoided setting it up because it required a special app (Symantec VIP) and calling in (no self-service). I now have it set up and feel much better about my account security.

That's exactly the issue, how do you prosecute hackers from countries that either a) don't care because they're collapsing/at war/etc or b) actively encourage hackers like DPRK, Russia, China.

There's no way to realistically police it without some One World Government type shit. All we can do is practice good security.

I'm just glad I got my parents trained enough to immediately contact me for anything that seems "off". The result is that they panic needlessly almost daily, but I still prefer that over getting the dreaded "they emptied all our accounts" call.

Perhaps Jason Statham can be part of the solution, a la The Beekeeper

If anyone hasn't seen the videos Jim Browning did a while back about gaining access to a india scam call centers network and subsequently, thier cameras, its a fascinating watch but also pretty concerning.

https://youtube.com/playlist?list=PLBNmQJqxpaMaxqghShRiOnHUjO00ZCsor

One of the worst parts is that sometimes the police are on the scammers payroll, making it hard to take action. It would likely take an international effort to even make a dent against these kinds of places. They make a ton of money off these scams so its going to keep happening.

police excelling at anything other than enforcing a state monopoly on violence

I, too, would love to live in a fantasy world

I just never click links in email.

Exactly. Put as many obstacles as possible into the path of scammers, and give yourself as many chances as possible to stop said scammers, and all without making services too annoying to use.

MFA + password manager seems to work well.

FIDO2 and security keys are the closest things we have to a solution. Unfortunately far too few companies support them. It would have saved him here because each credential only works with the proper URL for it.

I work for a managed service provider, and security for our clients is one of our most important goals.

Our CEO accidentally got phished then sent out emails to all our clients. We rolled with it by explaining kinda what you just said.

If you look at the headers, you can tell which ones are fake phishing and real phishing.

He mentioned that he does and the password manager didn't prompt to autocomplete the password automatically, so he had to force it.

The thing that should have saved my bacon was the credentials not auto-filling from 1Password, so why didn't I stop there? Because that's not unusual. There are so many services where you've registered on one domain (and that address is stored in 1Password), then you legitimately log on to a different domain.

Not everyone uses a browser extension for their password manager.

Depends... if you use an offline password manager ( like keepass), you can ask it to autotype your credentials into anything... if that's what you ask it to do (ie it's not a fault)

Main point though: don't reuse the same credentials across different sites.

They'll get 1 site, but not all the rest of them...