<story><title>Hackers used Slack to break into EA Games</title><url>https://www.vice.com/en/article/7kvkqb/how-ea-games-was-hacked-slack</url></story><parent_chain><item><author>hu3</author><text>This is a concern of mine on systems I design&amp;#x2F;maintain.&lt;p&gt;How do I mitigate a stolen cookie from successfully authenticating someone else?&lt;p&gt;Do I store user browser-agent&amp;#x2F;IP and check that on every request?</text></item><item><author>Thaxll</author><text>The thing is you need MFA to log into Slack but having a valid cookie bypass that.&lt;p&gt;On top of that once you&amp;#x27;re in Slack you can access every public channel, search string etc ... I can tell you that large compagny have a lot of thing displayed on Slack ( CI&amp;#x2F;CD pipelines results, credentials in logs, alerts ect ... ) you don&amp;#x27;t even need to talk to someone to have a lot of info.</text></item><item><author>danso</author><text>The problem probably isn&amp;#x27;t Slack itself, but EA&amp;#x27;s policies around Slack. I think it&amp;#x27;s not nothing that the social engineering happened over Slack. For starters, somehow login cookies to the Slack were stolen and then sold, and those were enough to get into the Slack. And then in 2 separate instances, the hackers were able to convince IT to give them 2 new tokens.&lt;p&gt;Maybe the IT team&amp;#x2F;policy is just weak across the board, and they would&amp;#x27;ve handed keys over the phone or through internal email. But it&amp;#x27;s not impossible for the IT team to have a complacent mindset around Slack.</text></item><item><author>barbazoo</author><text>Exactly, doesn&amp;#x27;t sound like this has anything to do with Slack in particular.</text></item><item><author>sxp</author><text>The key bit is &amp;quot;The hackers then requested a multifactor authentication token from EA IT support to gain access to EA&amp;#x27;s corporate network. The representative said this was successful two times.&amp;quot;&lt;p&gt;So this was primarily a social engineering hack after Slack was used to get access to a trusted messaging channel.</text></item></parent_chain><comment><author>martinald</author><text>I think we are living in a post &amp;quot;IP address&amp;quot; world to be to totally honest.&lt;p&gt;I can often switch thru many IP addresses in an hour (especially travelling) - various WiFi points, 4G, etc.  Services will appear incredibly broken these days if they require a new login per IP address.&lt;p&gt;Obviously you could force all traffic to be routed thru a VPN and list it there, but it seems people are moving away from that approach.&lt;p&gt;To me, the better question is how are these cookies get stolen in the first place?</text></comment>
<story><title>Hackers used Slack to break into EA Games</title><url>https://www.vice.com/en/article/7kvkqb/how-ea-games-was-hacked-slack</url></story><parent_chain><item><author>hu3</author><text>This is a concern of mine on systems I design&amp;#x2F;maintain.&lt;p&gt;How do I mitigate a stolen cookie from successfully authenticating someone else?&lt;p&gt;Do I store user browser-agent&amp;#x2F;IP and check that on every request?</text></item><item><author>Thaxll</author><text>The thing is you need MFA to log into Slack but having a valid cookie bypass that.&lt;p&gt;On top of that once you&amp;#x27;re in Slack you can access every public channel, search string etc ... I can tell you that large compagny have a lot of thing displayed on Slack ( CI&amp;#x2F;CD pipelines results, credentials in logs, alerts ect ... ) you don&amp;#x27;t even need to talk to someone to have a lot of info.</text></item><item><author>danso</author><text>The problem probably isn&amp;#x27;t Slack itself, but EA&amp;#x27;s policies around Slack. I think it&amp;#x27;s not nothing that the social engineering happened over Slack. For starters, somehow login cookies to the Slack were stolen and then sold, and those were enough to get into the Slack. And then in 2 separate instances, the hackers were able to convince IT to give them 2 new tokens.&lt;p&gt;Maybe the IT team&amp;#x2F;policy is just weak across the board, and they would&amp;#x27;ve handed keys over the phone or through internal email. But it&amp;#x27;s not impossible for the IT team to have a complacent mindset around Slack.</text></item><item><author>barbazoo</author><text>Exactly, doesn&amp;#x27;t sound like this has anything to do with Slack in particular.</text></item><item><author>sxp</author><text>The key bit is &amp;quot;The hackers then requested a multifactor authentication token from EA IT support to gain access to EA&amp;#x27;s corporate network. The representative said this was successful two times.&amp;quot;&lt;p&gt;So this was primarily a social engineering hack after Slack was used to get access to a trusted messaging channel.</text></item></parent_chain><comment><author>throwawayboise</author><text>If it&amp;#x27;s an internal corporate system where all the users sit at assigned machines and have fixed IP addresses, yes you can do stuff like IP address checking.&lt;p&gt;Otherwise you probably need short-lived cookies that get renewed by the client in the background, with a hard expiry of some reasonable &amp;quot;work day&amp;quot; length such as 8, 12, 16 hrs. Then even if it&amp;#x27;s stolen, there&amp;#x27;s a fairly short window of time that it&amp;#x27;s useful to anyone.</text></comment>