Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We Got Phished

exploratorium.edu

Post reply on HN
Print view View original

131–140 of 156 posts

Re: We Got Phished

#131

Post by acdha »

PretzelFisch wrote: post #125
acdha wrote: post #111

Earlier quoted context omitted.

This is where the type of MFA matters a lot: with a TOTP code, that phishing attack will be successful. With U2F, however, a per-host keypair is generated during the setup process and the public key is given to the remote server. Critically, the hostname as seen by your browser is part of the key identifier: see http://security.stackexchange.com/a/71704/311 That means that if in the future even if someone convinces y…

If a server is making the proxied request, would this still matter? The server will pretend to be a legit browser submission? In your link they mention reply. But what about a browser you control on the server?

Your browser connects to Google and tells the U2F token to auth using the www.google.com key: works

Your browser connects to www.google.com@phish.me but no matter whether you believe that site to be Google, the U2F process means that it can only use a key for phish.me, which won't work on the Google.com servers even if they relay it.

The only attack which still works is if they control DNS and can forge an SSL certificate, at which point we have much bigger problems than phishing.

Re: We Got Phished

#132

Post by maxt »

ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

If you accidentally delete the Google 2FA app, or your phone is stolen / lost, you have to regenerate all the tokens, which can be quite a pain. This happened to me once, and I was lucky I had several 'recovery codes' which I then used to reset the tokens. Personally I would stay clear from a Google-issued 2FA app as they have more reason to track you and the services you use.

Go for something like FreeOTP: https://freeotp.github.io/

Also 2FA can sometimes be overkill, especially if you're constantly logging into accounts which you know will get old and dusty over time (think Yahoo Mail for example)

Re: We Got Phished

#134

Post by codedokode »

This just shows that password-based authorization doesn't work for normal (not computed engineers) people and needs to be replaced with physical cryptographic keys. This is a script kiddie level attack any teenager can do and it succeeded.

Re: We Got Phished

#135

Post by jjnoakes »

andrewla wrote: post #98
kovek wrote: post #70

Earlier quoted context omitted.

Well, on a phishing page the user could still type in the username and password before clicking submit. Only after submitting the username and password do authentication layers require the user to interact with their mobile device (which is usually how it works). Some users might forget that they are supposed to 2FA (say, on their first few days at the job). What if the password input would only be shown after the us…

Adding 2fa does not completely close the exploit window, but it does reduce it considerably. Even if the phishing page prompted for 2fa, those credentials would only be valid for the next ~60-120 seconds, so any attack would have to be staged very quickly. In this example, they waited three days before trying to utilize the broken account; with 2fa they would not have that luxury. And this (asking for 2fa in the phis…

Why couldn't the attacker page pass on the 2fa token immediately to Google and log in as the victim? Then the attacker would have a month or so, not 30 seconds, with which to abuse their account

Re: We Got Phished

#136

Post by jjnoakes »

wojcikstefan wrote: post #99
kovek wrote: post #70

Earlier quoted context omitted.

Well, on a phishing page the user could still type in the username and password before clicking submit. Only after submitting the username and password do authentication layers require the user to interact with their mobile device (which is usually how it works). Some users might forget that they are supposed to 2FA (say, on their first few days at the job). What if the password input would only be shown after the us…

I think the point here is that, even if you give away your password, the attacker won't be able to access your account, because you're protected by 2FA. If 2FA was supposed to protect your password from being phished, then it would have to prompt you for your 2FA code every time you log in, which would be pretty annoying.

And even that isn't good enough when you get mitmd.

Re: We Got Phished

#137

Post by jlgaddis »

space99 wrote: post #15

I have seen the infosec future and the future is going to be domain whitelisting. Banks are already doing it.

In my vision of the future, most devices will not have a default gateway.

Instead, everything will be forced through application layer proxy servers which inspect the traffic and decide whether to let it pass. This would include domain whitelisting, as you mentioned, content filtering and inspection, and/or anything else the {company,"protection service",user} wanted to add.

I have no doubt that eventually, someday, we will live in a world where our electronic devices default to deny.

Re: We Got Phished

#139

Post by zaroth »

gog wrote: post #127
agwa wrote: post #32

Earlier quoted context omitted.

Then how does the image consistently display before the password has been provided? No matter what the answer is, I don't see how it could be an anti-phishing feature.

Because the image location is stored in a cookie from before the attack and this cookie will not be sent by a browser to a phishing site. Try from the incognito windows in your browser the image should not show up since no cookies are being sent in the incognito window.

I use fresh incognito tabs constantly. So I guess I'll never see the image, and never know something is amiss.

By I also never click an email link to login unless it's a plain text password reset. I receive authentic looking and topical Dropbox share requests from actual contacts (who have been hacked) trying to phish my Dropbox credentials maybe 4-5 times a year so I'm always on the lookout for it. This is a classic attack. Always check the URL!

Re: We Got Phished

#140

Post by dredmorbius »

torbjorn wrote: post #62
probably_wrong wrote: post #54

Earlier quoted context omitted.

I'm waiting for the day in which I can sign up for 2FA without giving my phone number. At this point, I believe they are holding it on purpose, as my phone number is a much more reliable unique identifier than my username and/or cookies. (Yes, you can use the Google authenticator, but no, you can't do it if you haven't given your phone number first) Edit: by "they" I mean GMail - other sites work just fine.

To use google authenticator you do not need to give out your number. Most sites will have a qr code you can scan with your phone and the google authenticator app uses that to generate 2fa codes that are valid within a certain time frame.

The workflow does not, and so far as I can tell, never has, support this. I've commented on it for years at G+.
Post reply on HN