Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #2348

When two-factor authentication isn't enough

Show all headers | View raw

Saw this on news.ycombinator.com: a great blog post at Fastmail.fm.
It's an interesting story, well-told.

http://blog.fastmail.fm/2014/04/10/when-two-factor-authentication-is-not-enough/

TL;DR: This is the story of a failed attempt to steal FastMail’s
domains.

We don’t publish all attempts on our security, but this one stands out
for how much effort was put into the attack, and how far it went.

We’ve had a handful of minor attack attempts recently. Targetted
phishing emails to staff trying to steal credentials. An NTP-based DDOS
which was quickly mitigated by NYI, our excellent hosting service.

These sorts of attacks are the “background radiation” of the internet.
Along with port scans and entries in the web server logs from malware
trying us out to see if we’re vulnerable to old PHP bugs (hint, we’re
not). It’s the reality of being on the internet.

This blog post was first drafted before the Heartbleed fiasco.
Sometimes, no matter how careful you are, you get a nasty surprise. We
responded very quickly, as always. Anyway, on with this story.

About a month ago, our hostmaster@fastmail.fm account suddenly wound up
subscribed to hundreds of mailing lists. All these mailing lists failed
to use double or confirmed opt-in, so someone was simply able to enter
the email address into a form and sign us up, no confirmation required.
This really is poor practice, but it’s still pretty common out there. A
special shout-out goes to government and emergency response agencies in
the USA for their non-confirmation signup on mailing lists. Thanks guys.
-- 
RS Wood <rsw@therandymon.com>

Back to comp.misc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

When two-factor authentication isn't enough RS Wood <rsw@therandymon.com> - 2014-04-10 11:46 +0000
  Re: When two-factor authentication isn't enough "tdk" <forum.tdk@squte.com> - 2014-04-11 12:05 -0500
    Re: When two-factor authentication isn't enough Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2014-04-12 08:51 +0100

csiph-web