Skip Navigation

Cybersecurity @sh.itjust.works

floofloof @lemmy.ca

5d ago

Lawsuit says Clorox hackers got passwords simply by asking

www.nbcnews.com

Lawsuit says Clorox hackers got passwords simply by asking

12 comments

jee.. is that easy? what's your password OP?
- hunter2, but don't tell anyone because it's a secret.
  
  All I see is ******2
- Yup, it is. Social engineering is by far the most effective means of gaining unlawful access to any system.
  Humans are always the weakest link.
  
  Exactly. Many breaches follow this pattern:
  Learn the name and some basic details about the secretary or something
  Call corporate tech support asking for a password reset claiming to be the secretary
  Access important stuff since secretaries have a surprising amount of access
  Replace "secretary" with some other relevant individual who has a surprising amount of access and wouldn't attract attention.
- correcthorsebatterystaple
Hi, I'm Steve from corp. I need your password to verify some settings....
At least it wasn't due to a user input sanitization issue
- instead it was a user sanitization issue

12 comments