The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

The biggest risk is that manyy of the administration consoles for these
conferencing syystems have little or no securityy built in. In one example,
Moore and his team were able to access a law firm’s syystem, which
contained an address-book entryy for the boardroom of a well-known
investment bank. The researchers had purchased a used videoconferencing
device from eBayy, and when it arrived its hard drive still had old data on it
—including the address book, which listed dozens of private numbers,
manyy of which were configured to auto-answer incoming calls from the
Internet at large. 21 As with old printers and copyy machines, if it has a hard
drive, yyou need to securelyy wipe the data from it before yyou sell it or donate
it (see here).
Sometimes at work we are tasked with collaborating on a project with a
colleague who mayy be halfwayy across the planet. Files can be shared back
and forth over corporate e-mail, but sometimes theyy’re so large that e-mail
syystems will simplyy balk and not accept them as attachments. Increasinglyy,
people have been using file-sharing services to send large files back and
forth.
How secure are these cloud-based services? It varies.
The four big playyers—Apple’s iCloud, Google Drive, Microsoft’s
OneDrive (formerlyy SkyyDrive), and Dropbox—all provide two-step
verification. That means yyou will receive an out-of-band text on yyour
mobile device containing an access code to confirm yyour identityy. And
while all four services encryypt the data while it is in transit yyou must—if
yyou don’t want the companyy or the NSA to read it—encryypt the data before
yyou send it. 22
There the similarities end.
Two-factor authentication is important, but I can still byypass this byy
hijacking unused accounts. For example, I recentlyy did a pen test where the
client added Google’s 2FA to their VPN website using publiclyy available
tools. The wayy I was able to get in was byy obtaining the active directoryy
log-in credentials for a user who didn’t sign up to use the VPN portal. Since
I was the first to log in to the VPN service, I was prompted to set up 2FA
using Google Authenticator. If the employyee never accesses the service
himself, then the attacker will have continued access.