Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We Got Phished

exploratorium.edu

Post reply on HN
Print view View original

91–100 of 156 posts

Re: We Got Phished

#91

Post by lucb1e »

emodendroket wrote: post #43
minimaxir wrote: post #2

It's worth nothing the new user-image-before-password-input for Google is an anti-phishing feature. Of course, most people won't think that deeply when prompted with a password request and a similar UI.

But it's also the default behavior if you sign on from a computer Google doesn't recognize, so it's not really strange to see the grey icon instead.

> a computer Google doesn't recognize

If Google can recognize your computer without being logged in, it's time to up your privacy settings.

Re: We Got Phished

#92

Post by bjackman »

callesgg wrote: post #84

At my company we get these things 2-3 times a year. Surprisingly many people understand that there is something fishy. But "Surprisingly many" is not enough. 2FA is not enough here a user that does not have the required knowledge to see what is phishing and what is not will most likely enter the 2FA key giving the bad guys the auth tokens anyway.

At my workplace we hire a company to do occasional phishing attacks on employees. If you get got (I have been got) you are briefly made to feel foolish and have to do a training course. They release stats and like you I was surprised how few people fall for it. But people always fall for it. I think this forced exposure to phishing attacks is an excellent idea.

Re: We Got Phished

#93

Post by bjackman »

callesgg wrote: post #84

At my company we get these things 2-3 times a year. Surprisingly many people understand that there is something fishy. But "Surprisingly many" is not enough. 2FA is not enough here a user that does not have the required knowledge to see what is phishing and what is not will most likely enter the 2FA key giving the bad guys the auth tokens anyway.

At my workplace we hire a company to do occasional phishing attacks on employees. If you get got (I have been got) you are briefly made to feel foolish and have to do a training course. They release stats and like you I was surprised how few people fall for it. But people always fall for it. I think this forced exposure to phishing attacks is an excellent idea.

Re: We Got Phished

#94

Post by shawkinaw »

Swizec wrote: post #89
shawkinaw wrote: post #81

It seems to me that browsers could be smarter about this kind of thing. Like, "Hey, you just put your Gmail credentials into a non-Gmail login form, did you really mean to do that?" Obviously in the HN-type crowd, you know to always carefully check the URL of links and form submissions. But I just don't know how realistic it is for that to be expected of an average user.

> Obviously in the HN-type crowd, you know to always carefully check the URL of links and form submissions. But I just don't know how realistic it is for that to be expected of an average user. How often do you actually check super carefully? I'm pretty sure I'm not as careful as I know I should be. Especially when busy and distracted and thinking about other things.

I always check email links carefully before clicking them. I'm a little more lax about other ones though :)

Re: We Got Phished

#95

Post by pauldancstep »

nmc wrote: post #23
phn wrote: post #22

Earlier quoted context omitted.

Or it could come from an already infected account, which might make the e-mail even less suspicious.

Yes but this would just mean an even bigger part of the story is missing — how that one got compromised.

Hi, I'm the author of that blog post. The backstory is that, indeed, the "familiar mailing list" had been compromised; the attack was conveyed to us in much the same way as we passed it on to others.

Re: We Got Phished

#97

Post by laurencei »

ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

Does 2 factor prevent phishing though?

If I was going to do a Google Phishing page - I would take the username + password that the user supplied into MY fake page, and POST/CURL that to the Google login.

If Google returns asking for a 2factor to MY fake, I would display the 2 factor prompt to the user, and get them to type the 2-factor into my page, which I would pass back to Google.

Basically you can use a phishing page as a MITM attack.

When you auth against Google with 2-factor, there is a "remember this computer" option - giving the attacker at least 30 days of access to your email without needing a further 2-factor code.

So if the person is tricked enough to type their username+password into a fake google page, they are just as likely to follow through with their 2-factor code.

Re: We Got Phished

#98

Post by andrewla »

kovek wrote: post #70
ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

Well, on a phishing page the user could still type in the username and password before clicking submit. Only after submitting the username and password do authentication layers require the user to interact with their mobile device (which is usually how it works). Some users might forget that they are supposed to 2FA (say, on their first few days at the job). What if the password input would only be shown after the us…

Adding 2fa does not completely close the exploit window, but it does reduce it considerably. Even if the phishing page prompted for 2fa, those credentials would only be valid for the next ~60-120 seconds, so any attack would have to be staged very quickly.

In this example, they waited three days before trying to utilize the broken account; with 2fa they would not have that luxury.

And this (asking for 2fa in the phishing page) would entail a risk as well; if they prompted a user who did not have 2fa for their 2fa credentials, then they would immediately be (at best) confused, and possibly suspicious, so they would have to decide to take the risk as to whether to attempt to target 2fa'ed accounts. And if they don't offer a 2fa prompt, then the phishing attempt has fizzled, as even with the password, they only have one factor.

Any sort of re-ordering of the login process by the good guys is only effective if the customer is extremely suspicious of changes in the login process, which nobody will be. The phishing site is under no obligation to match their flow to that of the faked website unless not matching by itself would be suspicious.

Re: We Got Phished

#99

Post by wojcikstefan »

kovek wrote: post #70
ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

Well, on a phishing page the user could still type in the username and password before clicking submit. Only after submitting the username and password do authentication layers require the user to interact with their mobile device (which is usually how it works). Some users might forget that they are supposed to 2FA (say, on their first few days at the job). What if the password input would only be shown after the us…

I think the point here is that, even if you give away your password, the attacker won't be able to access your account, because you're protected by 2FA.

If 2FA was supposed to protect your password from being phished, then it would have to prompt you for your 2FA code every time you log in, which would be pretty annoying.

Re: We Got Phished

#100

Post by ASalazarMX »

It's surprising that a dedicated phisher would go so blatantly overboard, knowing it would stand like a sore thumb. This wasn't spearphishing, it was regular phishing in a pond.
Post reply on HN