Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Crooked Timber showed showed me a virus captcha, What now?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 51 posts

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#31

Post by tracker1 »

everdrive wrote: post #4

This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine. The attack is basically getting someone to accidentally run malicious code. - ctrl + R brings up the Windows "run" dialogue. - the code executes a powershell command that reaches out to a remote server - if successful, the remote server answers and you have installed a dropper or somethi…

I make it a rule never to give confidential information to an incoming call. I had a primary doctor whose office would send notification calls immediately asking for part of my social security number, I always hung up.... I figured out it was for the doctor later, and commented that it was ridiculous and I wouldn't ever receive any such notifications.

Just that simple practice has kept me reasonably safe, even from an AI scam once.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#33

Post by LikesPwsh »

everdrive wrote: post #4

This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine. The attack is basically getting someone to accidentally run malicious code. - ctrl + R brings up the Windows "run" dialogue. - the code executes a powershell command that reaches out to a remote server - if successful, the remote server answers and you have installed a dropper or somethi…

If one user makes the mistake, it would be fair to blame them.

Because thousands of users make the same mistake, blame needs to be directed at Windows UX.

MS could fix this easily by 1) moving Run to optional features and 2) removing online features from Start to make performance comparable.

The other "run" interfaces (terminal, conhost, Powershell) are sufficiently menacing to scare away non-devs already.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#34

Post by tracker1 »

cavoirom wrote: post #30
everdrive wrote: post #4

This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine. The attack is basically getting someone to accidentally run malicious code. - ctrl + R brings up the Windows "run" dialogue. - the code executes a powershell command that reaches out to a remote server - if successful, the remote server answers and you have installed a dropper or somethi…

but people pipes a shell script from a URL to bash all the time. with enough practices, it becames second nature.

True enough... but even then, you can download and review the script before running. Usually it just detects your OS/Distro and then downloads and runs the appropriate installer. You can also do this by hand.

For that matter, there's always a risk of downloading/installing anything from anywhere. There have been successful compromises of many application supply chains at this point in official release paths. You will accept some risk regardless of your approach.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#35

Post by everdrive »

tasuki wrote: post #19
everdrive wrote: post #4

This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine. The attack is basically getting someone to accidentally run malicious code. - ctrl + R brings up the Windows "run" dialogue. - the code executes a powershell command that reaches out to a remote server - if successful, the remote server answers and you have installed a dropper or somethi…

> There is really _never_ a time when a CAPTCHA will require you to execute code on your machine. I think the concern is the user not knowing they're executing code on their machine. And as a counterexample: some captchas require you to compute something expensive to prove you're not a llm scraper or whatever. It's normal for captchas to require you to execute code on your machine, it's just usually done within the b…

>And as a counterexample: some captchas require you to compute something expensive to prove you're not a llm scraper or whatever.

I've never run into one of these. What do they ask you to compute?

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#37

Post by c0n5pir4cy »

deepsummer wrote: post #29
c0n5pir4cy wrote: post #26

Earlier quoted context omitted.

I'm not getting it at all! I'm guessing something about my environment has caused it to cloak itself.

Claude's analysis: "it skips logged-in WordPress users (wordpress_logged_in_* cookie), skips /wp-admin and /wp-login.php, and rate-limits to once per day per visitor via localStorage. That's why site admins don't see it — and why you only saw it on first load."

Doing a bit of digging too - it also filters only to users running MacOS or Windows and skips everything else which is why it will be invisible to the devices I tried it on.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#38

Post by chrismorgan »

everdrive wrote: post #4

This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine. The attack is basically getting someone to accidentally run malicious code. - ctrl + R brings up the Windows "run" dialogue. - the code executes a powershell command that reaches out to a remote server - if successful, the remote server answers and you have installed a dropper or somethi…

> There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.

Oh yeah? What about Google saying “install the reCAPTCHA app in the App Store” https://reclaimthenet.org/google-broke-recaptcha-for-de-goog...>?

It’s absurd, but these nominally-security tools frequently genuinely train users to become susceptible to attacks.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#39

Post by nargek »

> How do you protect yourself ?

As a "end-user" one of the most effective way is to either disable js, which isn't the most practical thing for most of us. You can also use ublock-origin, it doesn't only block ads! You can also throw a lying-DNS in the chain, either by using something like Quad9 or a local resolver with appropriate blocklists (think of unbound or for a more user-friendly solution piehole)

Also an anti-virus can help detect the usual stealer that will be dropped by these FakeCaptcha/ClickFix attack, but they are also easily bypassed, that's why you need multiple layers of protection : each of them can and will fail

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#40

Post by iamnothere »

OkayPhysicist wrote: post #27
iamnothere wrote: post #24

Earlier quoted context omitted.

Can’t wait for the first “scan this code to verify” scam that takes you to a mobile Chrome 0day Or you could send them to download some spyware/adware Play Store app

Couldn't any exploit possible via that pathway also be executed based on a link? I don't see how a QR code makes the situation any worse.

Once users are habituated to scanning QR codes for verification, it becomes easier.
Post reply on HN