Our Copyfish extension was stolen and adware-infested

#1

Post by timr » Sun, Jul 30, 2017, 9:50 PM UTC

Our Copyfish extension was stolen and adware-infested
a9t9.com

Re: Our Copyfish extension was stolen and adware-infested

#2

Post by sgroppino » Sun, Jul 30, 2017, 10:12 PM UTC

I'd have though that two-factor authentication could have prevented this type of attack?

Re: Our Copyfish extension was stolen and adware-infested

#3

Post by zootboy » Sun, Jul 30, 2017, 10:13 PM UTC

sgroppino wrote: post #2

I'd have though that two-factor authentication could have prevented this type of attack?

Not if the phising site asks for the 2FA token.

Re: Our Copyfish extension was stolen and adware-infested

#4

Post by giovannibajo1 » Sun, Jul 30, 2017, 10:17 PM UTC

sgroppino wrote: post #2

I'd have though that two-factor authentication could have prevented this type of attack?

Only with U2F, because the hardware dongle would refuse to provide the OTP to a different domain

Re: Our Copyfish extension was stolen and adware-infested

#5

Post by userbinator » Sun, Jul 30, 2017, 10:24 PM UTC

The somewhat obfuscated JS downloaded from unpkg.com has what appears to be a Google Analytics ID in it: UA-103045553-1. I'm not sure if that can help trace the origin.

Re: Our Copyfish extension was stolen and adware-infested

#6

Post by CM30 » Sun, Jul 30, 2017, 10:28 PM UTC

sgroppino wrote: post #2

I'd have though that two-factor authentication could have prevented this type of attack?

It could, and the plugin creators regret not having it active for everyone's account:

> Sigh... totally agree. I could add a longer story why just this account had no 2FA enabled, but the lesson learned is simple: From now on, we enable 2FA for every account that offers it.

So they won't make this mistake again.

Re: Our Copyfish extension was stolen and adware-infested

#7

Post by ivanbakel » Sun, Jul 30, 2017, 10:31 PM UTC

Good reminder that you should never be in the mindset of "expecting" a phish from any source - trust is how they get you. Also, if a message was really urgent, you wouldn't have to click-through to see it.

Re: Our Copyfish extension was stolen and adware-infested

#8

Post by sgroppino » Sun, Jul 30, 2017, 10:36 PM UTC

CM30 wrote: post #6

sgroppino wrote: post #2

I'd have though that two-factor authentication could have prevented this type of attack?

It could, and the plugin creators regret not having it active for everyone's account: > Sigh... totally agree. I could add a longer story why just this account had no 2FA enabled, but the lesson learned is simple: From now on, we enable 2FA for every account that offers it. So they won't make this mistake again.

Thanks - saw it now in the comments.

Re: Our Copyfish extension was stolen and adware-infested

#9

Post by userbinator » Sun, Jul 30, 2017, 10:38 PM UTC

zootboy wrote: post #3

sgroppino wrote: post #2

I'd have though that two-factor authentication could have prevented this type of attack?

Not if the phising site asks for the 2FA token.

The point of 2FA is challenge-response and the secret key is in the token. If a phishing site asks for 2FA it can get only one valid challenge-response pair, not the secret key.

Re: Our Copyfish extension was stolen and adware-infested

#10

Post by IncRnd » Sun, Jul 30, 2017, 10:40 PM UTC

> “Click here to read more details” the email said. The click opened the “Google” password dialog, and the unlucky team member entered the password for our developer account. This looked all legit to the team member, so we did not notice the pishing attack as such at this point. Pishing for Chrome extensions was simply not on our radar screen.

First, it is excellent that you disclosed the issue.

Second, based upon the quoted text you really aren't accepting responsibility for having been phished. The team member wasn't "unlucky." Your "radar" shouldn't trick you into thinking you won't be attacked.