Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Copyfish extension was stolen and adware-infested

a9t9.com

Post reply on HN
Print view View original

31–40 of 217 posts

Re: Our Copyfish extension was stolen and adware-infested

#31

Post by laurencei »

sillysaurus3 wrote: post #19
ivanbakel wrote: post #7

Good reminder that you should never be in the mindset of "expecting" a phish from any source - trust is how they get you. Also, if a message was really urgent, you wouldn't have to click-through to see it.

I think I'm misreading your comment, but the best defense against phishing is to always be expecting a phishing attack from every source. Every time you're about to paste your password, glance at the url bar.

> Every time you're about to paste your password, glance at the url bar.

Actually - I disagree with this. You can no longer "glance" at the url bar to determine if you are on the right domain due to Unicode chars if you clicked a link.

The only safe way is to type the url yourself into the browser.

If it is a long link - then at least typing the base domain, and pasting the "rest" is probably safe?

Re: Our Copyfish extension was stolen and adware-infested

#32

Post by alecthomas »

staticautomatic wrote: post #17

Of course it's a phishing attack. Why would Google send you a bit.ly link to your own Google account?

"Note that the bitly link was not directly visible in the phishing email, as it was an HTML-email. That is another lesson learned: Back to standard, text-based email as the default."

Re: Our Copyfish extension was stolen and adware-infested

#33

Post by mikeash »

laurencei wrote: post #31
sillysaurus3 wrote: post #19

Earlier quoted context omitted.

I think I'm misreading your comment, but the best defense against phishing is to always be expecting a phishing attack from every source. Every time you're about to paste your password, glance at the url bar.

> Every time you're about to paste your password, glance at the url bar. Actually - I disagree with this. You can no longer "glance" at the url bar to determine if you are on the right domain due to Unicode chars if you clicked a link. The only safe way is to type the url yourself into the browser. If it is a long link - then at least typing the base domain, and pasting the "rest" is probably safe?

I use 1Password to autofill my passwords, which it won't do if the domain doesn't match, which should also work.

Re: Our Copyfish extension was stolen and adware-infested

#36

Post by sillysaurus3 »

laurencei wrote: post #31
sillysaurus3 wrote: post #19

Earlier quoted context omitted.

I think I'm misreading your comment, but the best defense against phishing is to always be expecting a phishing attack from every source. Every time you're about to paste your password, glance at the url bar.

> Every time you're about to paste your password, glance at the url bar. Actually - I disagree with this. You can no longer "glance" at the url bar to determine if you are on the right domain due to Unicode chars if you clicked a link. The only safe way is to type the url yourself into the browser. If it is a long link - then at least typing the base domain, and pasting the "rest" is probably safe?

This actually isn't true. A website like https://www.xn--80ak6aa92e.com/ won't show up as apple.com. Browsers don't allow Unicode rendering in the URL bar.

Maybe IE is affected though. I haven't tested every browser. But it's a known security concern.

Re: Our Copyfish extension was stolen and adware-infested

#37

Post by Endy »

While I understand how some people can take this as a cautionary tale in favor of 2FA, as someone who doesn't like it and won't use it, I guess my mindset is very simple. There's the old saw that over time, computing has evolved from smart people in front of dumb terminals into dumb people in front of "smart" terminals. This attack is proof of it; and while 2FA might have had an impact, the major issue here is that we had a dumb person - this "unlucky" team member - who either didn't have the training or the common sense to understand that if you have a public presence on the Internet, you are a target. If you have auto-updating software installed on more than 1 machine, you are going to be someone's target because they want access to that person's computer.

The lesson here is: never trust anyone or anything.

Re: Our Copyfish extension was stolen and adware-infested

#38

Post by 2muchcoffeeman »

IncRnd wrote: post #10

> “Click here to read more details” the email said. The click opened the “Google” password dialog, and the unlucky team member entered the password for our developer account. This looked all legit to the team member, so we did not notice the pishing attack as such at this point. Pishing for Chrome extensions was simply not on our radar screen. First, it is excellent that you disclosed the issue. Second, based upon th…

I find it strange the team member clicked on the link. For such high value accounts, always use google or type in the URL.

Why would you click?

Re: Our Copyfish extension was stolen and adware-infested

#39

Post by tfigment »

pfg wrote: post #26
sillysaurus3 wrote: post #19

Earlier quoted context omitted.

I think I'm misreading your comment, but the best defense against phishing is to always be expecting a phishing attack from every source. Every time you're about to paste your password, glance at the url bar.

Password managers with browser extensions are a good fix for this too. If you're used to entering your password only through the extension, not being able to do that on a login screen would be a big warning sign. Admittedly, these extensions have had some vulnerabilities in the past, but phishing is simply a bigger problem for the vast majority of users. Obviously, for sites that support U2F (like Google), getting a…

Semi-relevant link from Bruce Schneier on the subject and that he did not design password safe with a browser extension in mind. https://www.schneier.com/blog/archives/2014/09/security_of_p.... The android version implements a keyboard replacement rather than integrate though not as easy to use is still mostly usable.

Re: Our Copyfish extension was stolen and adware-infested

#40

Post by timdorr »

Looks like they are using unpkg.com and npm to distribute the badware:

https://unpkg.com/copyfish-npm-2-8-5@1.0.1501416918/

https://www.npmjs.com/package/copyfish-npm-2-8-5

I reached out to both services to have it shut down. Hopefully that will at least kill it temporarily.

Post reply on HN