Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Crooked Timber showed showed me a virus captcha, What now?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#41

Post by c0n5pir4cy »

deepsummer wrote: post #21
c0n5pir4cy wrote: post #12

Do you have any browser extensions enabled? I've seen similar before where it wasn't the page itself that injected it - rather it was injected by a compromised/sold extension that has permissions on all pages.

Not this time. Go to crookedtimber dot org and you can still see it. Just don't follow the instructions... but clean your browser afterwards! It even supports Macs. But the Mac clipboard content is just "Oops...". P.S.: even worse: the crookedtimber site itself is infected. No third-party attack. It registers a service worker on the user's browser that stays even when you leave the site. Be sure to clean up the stora…

So done a much deeper analysis - there is an loader injected at the Wordpress side which triggers a read of a payload from a smart contract on the Ethereum chain. It stores this in localStorage, registers a ServiceWorker etc so it is persistent.

It then spins up the ClickFix attack - limited to one time per day. I haven't dug into the payload given by the ClickFix attack yet.

For people that have visited while it exists:

1. On Chrome go to chrome://serviceworker-internals search for crookedtimber and unregister the ServiceWorker

2. On Firefox go to about:debugging#/runtime/this-firefox, search for crookedtimber and unregister the ServiceWorker.

If you want to be even safer - just clear all local data for CrookedTimber.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#42

Post by SirFatty »

kstrauser wrote: post #25
SirFatty wrote: post #15

Earlier quoted context omitted.

5. Paste the entire command on HN so the aspiring script kiddies have a launching point. 6. ? 7. Profit!

What’s the Venn diagram of 1) HN users, 2) on Windows, 3) willing to paste something tagged as malware into their own systems to verify? Given that the asker isn’t experienced enough to know for sure, erring on the side of giving all the information was the right call. If they didn’t, someone would be riding them about “how are we suppose to know if you don’t show us?”.

I guess it's ok then.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#43

Post by cybersec47 »

netsharc wrote: post #28
joombaga wrote: post #7

fine-work-team.com has been reported as suspicious. Cloudflare is blocking it now.

Heh, the URL OP gave returns an MP3 file (starts with hex FF FB), at the end it mentions "LAME3.100" and about half a kilobyte of U's. It plays in a media player too. But I guess if it was loaded via mshta it will respond with a different payload. Now watch the people with "overabundance of caution" tell me what I did was stupid...

> But I guess if it was loaded via mshta it will respond with a different payload.

No, the MP3 file is the payload, mshta ignores the binary noise and executes the HTML in it. The HTML is in the middle of the file (search for "DOCTYPE") and it contains an obfuscated VBScript.

Skipping many steps in the whole chain (registering a scheduled task to be executed 1 second later, disabling TLS certificate verification, corrupting the antimalware scan, deobfuscation/decryption, evasion delays, in-memory PE loading, etc.), it as a whole, roughly speaking:

- downloads second stage payload from gpurq.gravityzone.army/{id}

- downloads an image from i.ibb.co/Q7yqNJpr/init-block.jpg (public image hosting) with a steganographically hidden third stage payload

- decrypts and loads a native PE32, heavily obfuscated and without imports

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#44

Post by fallinghawks »

I ran into the same thing on a cooking blog (which I had visited many times before) a few weeks back. I was pretty mystified but like you, spidey sense kept me from running the code. It's insidious because it looks like it's coming from Captcha. I do have uBO Lite running on Chrome. Tried the website in Firefox and also got the same manual run thing.

I wasn't sure what to do about it. Obviously I was unable to notify the blog owner. I came back to the website about a week later and it didn't come up again.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#45

Post by gus_massa »

everdrive wrote: post #35
tasuki wrote: post #19

Earlier quoted context omitted.

> There is really _never_ a time when a CAPTCHA will require you to execute code on your machine. I think the concern is the user not knowing they're executing code on their machine. And as a counterexample: some captchas require you to compute something expensive to prove you're not a llm scraper or whatever. It's normal for captchas to require you to execute code on your machine, it's just usually done within the b…

>And as a counterexample: some captchas require you to compute something expensive to prove you're not a llm scraper or whatever. I've never run into one of these. What do they ask you to compute?

For example: https://anubis.techaro.lol/

Wikipedia has a good explanation: https://en.wikipedia.org/wiki/Anubis_(software)#Design

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#46

Post by OkayPhysicist »

iamnothere wrote: post #40
OkayPhysicist wrote: post #27

Earlier quoted context omitted.

Couldn't any exploit possible via that pathway also be executed based on a link? I don't see how a QR code makes the situation any worse.

Once users are habituated to scanning QR codes for verification, it becomes easier.

Users are habituated to clicking links (mostly from their email) as verification, too. QR codes get a weird amount of hate for something that basically amounts to a hyperlink you can transmit through meatspace.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#47

Post by iamnothere »

OkayPhysicist wrote: post #46
iamnothere wrote: post #40

Earlier quoted context omitted.

Once users are habituated to scanning QR codes for verification, it becomes easier.

Users are habituated to clicking links (mostly from their email) as verification, too. QR codes get a weird amount of hate for something that basically amounts to a hyperlink you can transmit through meatspace.

It’s because people don’t yet understand that scanning a code can be just as risky as clicking a link. They will trust whatever they see on the other side, while they may be more suspicious of what they see after following a hyperlink.

Re: Ask HN: Crooked Timber showed showed me a virus captcha, What now?

#50

Post by cavoirom »

tracker1 wrote: post #34
cavoirom wrote: post #30

Earlier quoted context omitted.

but people pipes a shell script from a URL to bash all the time. with enough practices, it becames second nature.

True enough... but even then, you can download and review the script before running. Usually it just detects your OS/Distro and then downloads and runs the appropriate installer. You can also do this by hand. For that matter, there's always a risk of downloading/installing anything from anywhere. There have been successful compromises of many application supply chains at this point in official release paths. You will…

I don't think so, the risk level is different. Pipe an unreviewed bash script from a URL is red flag, downloading an app from Apple App Store is safer. There are many other examples, I just want to tell: the risky level is not the same, each person has different take.
Post reply on HN