Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Crooked Timber showed showed me a virus captcha, What now?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#21

Post by deepsummer »

c0n5pir4cy wrote: post #12

Do you have any browser extensions enabled? I've seen similar before where it wasn't the page itself that injected it - rather it was injected by a compromised/sold extension that has permissions on all pages.

Not this time. Go to crookedtimber dot org and you can still see it. Just don't follow the instructions... but clean your browser afterwards!

It even supports Macs. But the Mac clipboard content is just "Oops...".

P.S.: even worse: the crookedtimber site itself is infected. No third-party attack. It registers a service worker on the user's browser that stays even when you leave the site. Be sure to clean up the storage data after visiting that site.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#22

Post by gus_massa »

everdrive wrote: post #4

This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine. The attack is basically getting someone to accidentally run malicious code. - ctrl + R brings up the Windows "run" dialogue. - the code executes a powershell command that reaches out to a remote server - if successful, the remote server answers and you have installed a dropper or somethi…

I've seen sites with similar fake captchas posted twice in the last month by old time regular users. My guess is that the sites were infected after they saw and decide to post it here.

As a workaround, is it possible to disable Ctr+R to add some friction in case I am distracted?

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#23

Post by kstrauser »

paulyy_y wrote: post #16
kstrauser wrote: post #9

Not directly answering your questions, but I just wanted to say: Great instincts! You saw something unusual, then 1. Stopped what you were doing. 2. Investigated to see if this was legitimate or malicious. 3. Identified a place to asked others about it. 4. Formulated a good question with enough background information to help people answer it. All around good job! Well done.

5. Put the malicious payload directly into work AI system. "Great instincts!" lmao

I do this literally several times a week. “Hey Droid, this looks like malware. What do you make of it?”

It’s the best sandbox I have near at hand for investigating things like that.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#24

Post by iamnothere »

Retr0id wrote: post #18

Google is trying to normalize a new "complete the captcha on your phone by scanning a QR code" flow, which I'm sure will be a whole new vector for scams.

Can’t wait for the first “scan this code to verify” scam that takes you to a mobile Chrome 0day

Or you could send them to download some spyware/adware Play Store app

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#25

Post by kstrauser »

SirFatty wrote: post #15
kstrauser wrote: post #9

Not directly answering your questions, but I just wanted to say: Great instincts! You saw something unusual, then 1. Stopped what you were doing. 2. Investigated to see if this was legitimate or malicious. 3. Identified a place to asked others about it. 4. Formulated a good question with enough background information to help people answer it. All around good job! Well done.

5. Paste the entire command on HN so the aspiring script kiddies have a launching point. 6. ? 7. Profit!

What’s the Venn diagram of 1) HN users, 2) on Windows, 3) willing to paste something tagged as malware into their own systems to verify?

Given that the asker isn’t experienced enough to know for sure, erring on the side of giving all the information was the right call. If they didn’t, someone would be riding them about “how are we suppose to know if you don’t show us?”.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#26

Post by c0n5pir4cy »

deepsummer wrote: post #21
c0n5pir4cy wrote: post #12

Do you have any browser extensions enabled? I've seen similar before where it wasn't the page itself that injected it - rather it was injected by a compromised/sold extension that has permissions on all pages.

Not this time. Go to crookedtimber dot org and you can still see it. Just don't follow the instructions... but clean your browser afterwards! It even supports Macs. But the Mac clipboard content is just "Oops...". P.S.: even worse: the crookedtimber site itself is infected. No third-party attack. It registers a service worker on the user's browser that stays even when you leave the site. Be sure to clean up the stora…

I'm not getting it at all! I'm guessing something about my environment has caused it to cloak itself.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#27

Post by OkayPhysicist »

iamnothere wrote: post #24
Retr0id wrote: post #18

Google is trying to normalize a new "complete the captcha on your phone by scanning a QR code" flow, which I'm sure will be a whole new vector for scams.

Can’t wait for the first “scan this code to verify” scam that takes you to a mobile Chrome 0day Or you could send them to download some spyware/adware Play Store app

Couldn't any exploit possible via that pathway also be executed based on a link? I don't see how a QR code makes the situation any worse.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#28

Post by netsharc »

joombaga wrote: post #7

fine-work-team.com has been reported as suspicious. Cloudflare is blocking it now.

Heh, the URL OP gave returns an MP3 file (starts with hex FF FB), at the end it mentions "LAME3.100" and about half a kilobyte of U's. It plays in a media player too.

But I guess if it was loaded via mshta it will respond with a different payload.

Now watch the people with "overabundance of caution" tell me what I did was stupid...

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#29

Post by deepsummer »

c0n5pir4cy wrote: post #26
deepsummer wrote: post #21

Earlier quoted context omitted.

Not this time. Go to crookedtimber dot org and you can still see it. Just don't follow the instructions... but clean your browser afterwards! It even supports Macs. But the Mac clipboard content is just "Oops...". P.S.: even worse: the crookedtimber site itself is infected. No third-party attack. It registers a service worker on the user's browser that stays even when you leave the site. Be sure to clean up the stora…

I'm not getting it at all! I'm guessing something about my environment has caused it to cloak itself.

Claude's analysis: "it skips logged-in WordPress users (wordpress_logged_in_* cookie), skips /wp-admin and /wp-login.php, and rate-limits to once per day per visitor via localStorage. That's why site admins don't see it — and why you only saw it on first load."

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#30

Post by cavoirom »

everdrive wrote: post #4

This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine. The attack is basically getting someone to accidentally run malicious code. - ctrl + R brings up the Windows "run" dialogue. - the code executes a powershell command that reaches out to a remote server - if successful, the remote server answers and you have installed a dropper or somethi…

but people pipes a shell script from a URL to bash all the time. with enough practices, it becames second nature.
Post reply on HN