[HN Gopher] Kurt Got Got
___________________________________________________________________
Kurt Got Got
Author : tabletcorry
Score : 95 points
Date : 2025-10-08 21:02 UTC (1 hours ago)
(HTM) web link (fly.io)
(TXT) w3m dump (fly.io)
| jryio wrote:
| I'm always glad to see when companies, developers and CEOs make a
| heartfelt and humanistic mae culpa.
|
| We would like to think that we're the smart ones and above such
| low level types of exploits, but the reality is that they can
| catch us at any moment on a good or bad day.
|
| Good write up
| herval wrote:
| Great writeup, but also gotta say that's some excellent phishing
| tptacek wrote:
| This exact phish has been going around lately and we're not the
| only ones who got bit. But we didn't know that before it
| happened.
| ChrisMarshallNY wrote:
| I enjoyed the self-deprecating humor behind it.
|
| I have been almost got, a couple of times. I'm not sure, but I
| may have realized that I got got, about 0.5 seconds after
| clicking[0], and was able to lock down, before they were able
| to grab it.
|
| [0] https://imgur.com/EfQrdWY
| tptacek wrote:
| I want to say again that the key thing in this post is that
| anything "serious" at Fly.io couldn't have gotten phished: your
| SSO login won't work if you don't have mandatory phish-resistant
| 2FA set up for it. What went wrong here is that Twitter wasn't
| behind that perimeter, because, well, we have trouble taking
| Twitter seriously.
|
| We shouldn't have, and we do take it seriously now.
| latchkey wrote:
| [deleted]
| tptacek wrote:
| Twitter isn't an operational dependency of ours and we don't
| attest to it at all. It also doesn't require we do that: what
| SOC2 actually demands of vendor security practices is much
| more complicated (and performative) than that. If Twitter
| were a real vendor dependency of ours, most of what we'd need
| would be a SOC2 attestation from them.
| stavros wrote:
| Ever since I almost got phished (wasn't looking closely enough at
| the domain to notice a little stress mark over the "s" in the
| domain name, thankfully I was using a hardware wallet that
| prevented the attack entirely), I realized that anyone can get
| phished. They just rely on you being busy, or out, or tired, and
| just not checking closely enough.
|
| Use passkeys for everything, like Thomas says.
| ChrisMarshallNY wrote:
| If you grok Apple, I wrote up a tutorial on very basic PassKey
| implementation (for iOS apps), here:
| https://littlegreenviper.com/series/passkeys/
| stavros wrote:
| Very nice, thanks! By the way, the preferred capitalization
| is "passkeys", like "passwords". It's not supposed to be
| capitalized like a proper noun.
| ChrisMarshallNY wrote:
| I prefer all lowercase. Not sure where I got the CamelCase
| version, but it may have been from the Apple or FIDO docs.
| Y_Y wrote:
| Counterpoint: don't use passkeys, they're a confused mess and
| add limitations while not giving any benefits over a good long
| password in a password manager.
| bigyabai wrote:
| Yep. A technical half-baked solution to a problem that has
| been solved since it's inception. Really just feels like
| FAANG exists to invent new ways to charge rent...
| akerl_ wrote:
| What's the solution for preventing this kind of phishing
| attack?
| dewey wrote:
| They prevent you from being one of these, and copy pasting
| the password from password manager into the wrong input
| field. Something that still happens often with many websites
| not properly auto-filling from password managers.
|
| > They just rely on you being busy, or out, or tired, and
| just not checking closely enough
| o11c wrote:
| If you are "copy-pasting" you are not using your password
| manager correctly.
| dewey wrote:
| As I said in my comment above, sometimes it's necessary
| as websites break the auto fill, or mobile apps don't
| offer the password manager sheet.
| otterley wrote:
| This very story illustrates how people will override
| their password manager's builtin protections when panic
| ensues.
| madeofpalk wrote:
| If only everyone did everything perfectly all the time,
| we wouldn't have any issues!
| corndoge wrote:
| Yes, PKC authentication is good, but the way passkeys have
| been implemented is not great. Way too much trust built into
| the protocol; way too much power granted to relying parties;
| much harder for users to form a correct mental model.
| tptacek wrote:
| This whole story is about us getting zapped because we relied
| on a good long password in a password manager!
| dilyevsky wrote:
| So what happened exactly? Did Kurt enter his twitter
| password manually after clicking on that phishing link? Did
| he not get his sus detector going off after the password
| manager _didn 't_ suggest the password?
| stavros wrote:
| That happened to me as well, I put it down to "fucking
| password manager, it's broken again".
|
| For example, BitWarden has spent the past month refusing
| to auto fill fields for me. Bugs are really not uncommon
| at all, I'd think my password manager is broken before I
| thought I'm getting phished (which is exactly how they
| get you).
| dilyevsky wrote:
| Yeah i could totally see how someone in a bind working
| off of phone could get p0wned like that
| stavros wrote:
| For me it wasn't even a phone, it was on the desktop, I'm
| just so used to everything being buggy that it didn't
| trigger any alarms for me.
|
| Luckily the only things I don't use passkeys or hardware
| keys for are things I don't care about, so I can't even
| remember what was phished. It goes to show, though, that
| that's what saved me, not the password manager, not my
| strong password, nothing.
| otterley wrote:
| Yes, that's exactly what happened. The nature of panic is
| that it overrides people's better judgment.
| kgeist wrote:
| >I realized that anyone can get phished
|
| A few years ago, I managed to get our InfoSec head phished (as
| a test). No one is safe :)
| x0x0 wrote:
| ... could we get webauthn / yubikeys prioritized for fly? afaik
| (don't want to disable 2fa to find out), it only supports totp.
|
| For everyone reading though, you should try fly. Unaffiliated
| except for being a happy customer. 50 lines of toml is so so much
| better than 1k+ lines of cloudformation.
| tptacek wrote:
| We don't like TOTP, at all, for reasons even more obvious now,
| but our standard answer for advanced MFA has been OIDC, which
| is what most people should do rather than setting up bespoke
| U2F/FIDO2/Passkeys.
|
| We will get to this though.
|
| https://fly.io/blog/tokenized-tokens/
| tgsovlerkhgsel wrote:
| This is why properly working password managers are important, and
| why as a web site operator you should make sure to not break
| them. My password not auto-filling on a web site is a sufficient
| red flag to immediately become _very_ watchful.
|
| Code-based 2FA, on the other hand, is completely useless against
| phishing. If I'm logging in, I'm logging in, and you're getting
| my 2FA code (regardless of whether it's coming from an SMS or an
| app).
| akerl_ wrote:
| How does this square with the fact that the tech savvy person
| in the post was phished despite using a password manager.
| otterley wrote:
| Precisely. 1Password's browser integration would have noticed
| a domain mismatch and refused to autofill the password -- but
| in a panic, Kurt apparently opened 1Password and then
| copied/pasted the credentials manually.
| akerl_ wrote:
| Which is why a properly working password manager is not a
| strong defense against phishing.
| otterley wrote:
| Correct. The moral of the story is that hardware MFA
| and/or passkeys are a necessity in today's world. An
| infinitely complex password and 2FA are no match for
| attacks that leverage human psychology.
| onionisafruit wrote:
| It's a strong defense that this guy decided not to use
| akerl_ wrote:
| User security that doesn't meet real users where they are
| is just nerd theatre.
| sergiotapia wrote:
| This is how they got my Steam account credentials, although
| I realized the stupid shit I did the second I clicked
| submit form, and reset my password to random 32 characters
| using bitwarden. Me! Someone who is deeply technical AND
| paranoid.
|
| The key here is the hacker must create the most incisive,
| scary email that will short circuit your higher brain
| functions and get you to log in.
|
| I should have realized the fact that bitwarden did not
| autofill and take that as a sign.
| stavros wrote:
| Same thing happened to me (not with Steam), but it's also
| the thought that "this could never happen to me" that
| leads you to assign an almost zero probability to the
| problem being a phishing attempt.
| bradgessler wrote:
| When we did annual pen testing audits for my last company, the
| security audit company always offered to do phishing or social
| engineering attacks, but advised against it because they said it
| worked every single time.
|
| One of the most memorable things they shared is they'd throw USB
| sticks in the parking lot of the company they were pentesting and
| somebody would always put the thing into a workstation to see
| what as on it and get p0wned.
|
| Phishing isn't really that different.
|
| Great reminder to setup Passkeys: https://help.x.com/en/managing-
| your-account/how-to-use-passk...
| dilyevsky wrote:
| The stray USB stick is how Stuxnet allegedly got deployed. Tbh
| I doubt that works in this day and age.
| stavros wrote:
| Hah, watch me.
| roblabla wrote:
| A USB can pretend to be just about any type of device to get
| the appropriate driver installed and loaded. They can then
| send malformed packets to that driver to trigger some
| vulnerability and take over the system.
|
| There are a _lot_ of drivers for devices on a default windows
| install. There are a _lot more_ if you allow for Windows
| Update to install drivers for devices (which it does by
| default). I would not trust all of them to be secure against
| a malicious device.
|
| I know this is not how stuxxnet worked (instead using a
| vulnerability in how LNK files were shown in explorer.exe as
| the exploit), but that just goes to show how much surface
| there is to attack using this kind of USB stick.
|
| And yeah, people still routinely plug random USBs in their
| computers. The average person is simultaneously curious and
| oblivious to this kind of threat (and I don't blame them -
| this kind of threat is hard to explain to a lay person).
| amenghra wrote:
| If you are getting powned by running random executables found
| on usb drives, passkeys aren't going to save you. Same if the
| social engineering is going to get you to install random
| executables.
| silexia wrote:
| CEO here, I also almost got taken by a fake legal notice about a
| Facebook post. My password manager would not auto enter my
| password so I tried manually entering it like a dummy.
| Fortunately, it was the wrong one.
| latchkey wrote:
| This is exactly why I turned off auto enter.
| akerl_ wrote:
| Isn't turning off auto enter exacerbating the problem?
|
| The avenue for catching this is that the password manager's
| autofill won't work on the phishing site, and the user could
| notice that and catch that it's a malicious domain
| tptacek wrote:
| Yes. This is the problem with the "just use a password
| manager" answer to phishing-resistance. They can be a line
| of defense, situationally, but you have to have them
| configured just right, and if you're using phishing-
| resistant authentication you don't need that line of
| defense in the first place.
| latchkey wrote:
| Autofill doesn't always work for every site. So, now you're
| having to store in your mind where it works and where it
| doesn't. By disabling it, it forces you to go the extra
| step (command-shift-L) every time.
| akerl_ wrote:
| Autofill and the hotkey use the same mechanism, and
| neither is going to work on a phishing site.
| latchkey wrote:
| You're right. The point is that hotkey makes me think and
| observe more. Again, I don't have to remember if the site
| previous worked with autofill, or not.
| OkayPhysicist wrote:
| No, that's the opposite of the moral of that story. If the
| person you responded to had listened to the fact that the
| auto-enter _didn 't_ auto-enter, they wouldn't have been at
| any risk. Likewise in the article, the problem was that the
| CEO copy-pasted the password into the phishing page's
| password field, NOT that the auto-enter prompted him to do
| so.
| latchkey wrote:
| As I mention below: Autofill doesn't always work for every
| site. So, now you're having to store in your mind where it
| works and where it doesn't. By disabling it, it forces you
| to go the extra step (command-shift-L) every time.
| dyauspitr wrote:
| When did fly.io create their own crypto?
| __jonas wrote:
| That's some impressive work on the attackers part having that
| whole fake landing page ready to go, and a pretty convincing
| phishing email.
|
| I'm don't know much about crypto so I'm not sure what makes them
| call the scam 'not very plausible' and say it 'probably generated
| $0 for the attackers', is that something that can be verified by
| checking the wallet used in that fake landing page?
| paxys wrote:
| > This is, in fact, how all of our infrastructure is secured at
| Fly.io; specifically, we get everything behind an IdP (in our
| case: Google's) and have it require phishing-proof MFA.
|
| Every system is only as secure as its weakest link. If the
| company's _CEO_ is idiotic enough to pull credentials from
| 1Password and manually copy-past them on a random website whose
| domain does not match the service that issued it, what is to say
| they won 't do the same for an MFA token?
| tptacek wrote:
| The. whole. point. of. phishing-resistant. MFA. is. that. you.
| can't. do. the. same. thing.
| akerl_ wrote:
| FIDO2 won't send an authentication to a fake site, no matter
| what the human does.
|
| That's what makes it phishing-resistant.
| roblabla wrote:
| They literally explain in the article they're using FIDO MFA
| that is phishing proof as the key authenticates the website
| (it's not your run-of-the-mill sms 2FA, it's using WebAuthn to
| talk to your MFA).
|
| With this setup, you can't fuck up.
| nofriend wrote:
| > But if we'd actually done an ICO, you'd have lost all your
| money anyways.
|
| tru tru
| theturtle wrote:
| It's so easy to spot fucking dildos.
|
| The instant they use the shitty non-word "impactful," every other
| wordlike noise that comes out of their mouth or anus can and
| should be ignored.
| roughly wrote:
| I was reading this and wondering why it was posted so high (I
| didn't recognize the company name), and then I got to the name at
| the bottom. I think the lesson here is "if it could happen to
| Kurt, it could happen to anyone." Yeah, the consequences here
| were pretty limited, but everyone's got Some vulnerability, and
| it's usually in the junk pile in the corner that you're ignoring.
| If the attacker were genuinely trying to do damage (as opposed to
| just running a two-bit crypto scam), assuming the company's
| official account is a fine start to leverage for some social
| engineering.
| akerl_ wrote:
| I think you mean Kurt.
| stavros wrote:
| It would help if they mentioned his name anywhere in the
| post, title, or subtitle.
| roughly wrote:
| Yeah, that was definitely a pebkac on my part.
| stavros wrote:
| It's ok, I just couldn't pass up a good opportunity for
| snark!
| roughly wrote:
| You're right - I flagged on Thomas's name in the signature
| and because I've seen him around here, well, forever, but
| Kurt is also extremely savvy.
| tptacek wrote:
| No he's not! He got taken by this dumb phishing thing!
| pants2 wrote:
| This "content violation on your X post" phishing email is so
| common, we get about a dozen of those a week, and had to change
| the filters many times to catch them (because it's not easy to
| just detect the letter X and they keep changing the wording).
|
| We also ended up dropping our email security provider because
| they consistently missed these. We evaluated/trialed almost a
| dozen different providers and finally found one that did detect
| every X phishing email! (Check Point fyi, not affiliated)
|
| It was actually embarrassing for most of those security companies
| because the signs of phishing are very obvious if you look.
| rtpg wrote:
| Fly has consistently surprised me at how late they have been to
| doing the "standard company" stuff. Their sort of lack of support
| engineering teams for a while affected me way more though.
|
| You gotta take the Legos away from the CEO! Being CEO means you
| stop doing the other stuff! Sorry!
|
| And yes they have their silly disclaimer on their blog, but this
| is Yet Another "oh lol we made a whoopsie" tone that they've
| taken in the past several times for "real" issues. My favorite
| being "we did a thing, you should have read the forums where we
| posted about it, but clearly some of you didn't". You have my
| e-mail address!
|
| Please.... please... get real comms. I'm tired of the "oh lol
| we're just doing shit" vibes from the only place I can _barely_
| recommend as an alternative to Heroku. I don't need the cuteness.
| And 60% of that is because one of your main competitors has a
| totally unsearchable name.
___________________________________________________________________
(page generated 2025-10-08 23:01 UTC)