Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Copyfish extension was stolen and adware-infested

a9t9.com

Post reply on HN
Print view View original

51–60 of 217 posts

Re: Our Copyfish extension was stolen and adware-infested

#51

Post by gruez »

ivanbakel wrote: post #7

Good reminder that you should never be in the mindset of "expecting" a phish from any source - trust is how they get you. Also, if a message was really urgent, you wouldn't have to click-through to see it.

>Also, if a message was really urgent, you wouldn't have to click-through to see it.

i don't get that logic. what's the difference between

    Your adwords account was suspended due to suspected click fraud. [bunch of made up plausible reasons]. you may appeal by going to your adwords control panel [phising link here]
and

    Your adwords account was suspended. click here to see why [phising link here].
in both cases you'd be pretty tempted to click the link.

Re: Our Copyfish extension was stolen and adware-infested

#52

Post by anonred »

cgb223 wrote: post #49

Can someone explain to me why the attacker wrote the script source tag as "var config_fragment = ' ';" Instead of just: var config_fragment = ' ';

It’s usually done to prevent the parser from interpreting the closing script tag early: https://stackoverflow.com/questions/236073/why-split-the-scr...

Re: Our Copyfish extension was stolen and adware-infested

#53

Post by crystaln »

Pxtl wrote: post #14
IncRnd wrote: post #10

> “Click here to read more details” the email said. The click opened the “Google” password dialog, and the unlucky team member entered the password for our developer account. This looked all legit to the team member, so we did not notice the pishing attack as such at this point. Pishing for Chrome extensions was simply not on our radar screen. First, it is excellent that you disclosed the issue. Second, based upon th…

While I normally agree, I think it's important that they referred to the specific person without using blaming language. The team failed and screwed up because they had bad policies with their account. The individual team member who was holding the keys when the screw-up happened? Unlucky. Fix the process, not the people. It's good that they're not throwing the poor person under the bus.

Stating what happened is not blaming language.

Characterizing the act as "unlucky" is excusing language, just as bad as blaming language.

Assigning an error to mystical forces is unhelpful.

Simply stating that the person entered the password into a phishing site is not blaming language, it is factual.

Re: Our Copyfish extension was stolen and adware-infested

#55

Post by greggman »

hartator wrote: post #18
Pxtl wrote: post #14

Earlier quoted context omitted.

While I normally agree, I think it's important that they referred to the specific person without using blaming language. The team failed and screwed up because they had bad policies with their account. The individual team member who was holding the keys when the screw-up happened? Unlucky. Fix the process, not the people. It's good that they're not throwing the poor person under the bus.

I don't think more policies will make a better place. One of the team member screw up and stuff like this happen. I am questioning his security education to have been phished so easily.

As someone who's been phished even though I've written article s on phishing in the past, all it takes is a moment of weakness.

In my case everything looked normal at a glance. 2FA saved me but if they'd had asked for 2FA I wouldn't have noticed.

https://blog.greggman.com/blog/getting-phished/

Other people getting phished

https://www.exploratorium.edu/blogs/tangents/we-got-phished-...

Re: Our Copyfish extension was stolen and adware-infested

#56

Post by driverdan »

Endy wrote: post #37

While I understand how some people can take this as a cautionary tale in favor of 2FA, as someone who doesn't like it and won't use it, I guess my mindset is very simple. There's the old saw that over time, computing has evolved from smart people in front of dumb terminals into dumb people in front of "smart" terminals. This attack is proof of it; and while 2FA might have had an impact, the major issue here is that w…

> The lesson here is: never trust anyone or anything.

Which is why you should use 2FA and why you shouldn't trust someone who says they don't use it.

Re: Our Copyfish extension was stolen and adware-infested

#57

Post by joshschreuder »

timdorr wrote: post #40

Looks like they are using unpkg.com and npm to distribute the badware: https://unpkg.com/copyfish-npm-2-8-5@1.0.1501416918/ https://www.npmjs.com/package/copyfish-npm-2-8-5 I reached out to both services to have it shut down. Hopefully that will at least kill it temporarily.

Unpkg has a blacklist, so you can put up a PR if you know the package IDs.

https://github.com/unpkg/unpkg.com/commit/ac09a03c75a51997b9...

A similar thing happened with another Chrome extension Social Fixer about a month ago.

EDIT: It's already been blocked, nice work @mjackson

https://github.com/unpkg/unpkg-website/commit/7d4a4ba4958c16...

Re: Our Copyfish extension was stolen and adware-infested

#58

Post by markbnj »

sillysaurus3 wrote: post #22
hartator wrote: post #18

Earlier quoted context omitted.

I don't think more policies will make a better place. One of the team member screw up and stuff like this happen. I am questioning his security education to have been phished so easily.

It's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you. The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game. A policy of popping…

Mmm, maybe. I'm certainly not immune to being fooled. I am careful, however. I roll over and check any link in an email before I click it, and I know when I am or am not authenticated into one of my google accounts. It's all too easy, though, to make a mistake like this when you're in a hurry or don't give something enough thought. The email was very good but after reading it a couple of times the language strikes me as not _quite_ right, especially the "unless you fix it" part at the end. Perhaps the key insight is that you have to assume going in that any email you get like this is fake, and then prove otherwise.

Re: Our Copyfish extension was stolen and adware-infested

#59

Post by joshschreuder »

A similar attack happened on another Chrome extension last month (Social Fixer) with over 190k installs.

In fact, judging by the exploit code, I would guess the same author, as the Social Fixer attack had a very similar hashed package on Unpkg as well.

In that scenario the author also didn't have 2FA enabled: https://www.facebook.com/socialfixer/posts/10155117415829342

I feel like Google should take the next step of requiring all extension developers to enable 2FA before being able to post an extension.

Re: Our Copyfish extension was stolen and adware-infested

#60

Post by [deleted] »

joshschreuder wrote: post #59

A similar attack happened on another Chrome extension last month (Social Fixer) with over 190k installs. In fact, judging by the exploit code, I would guess the same author, as the Social Fixer attack had a very similar hashed package on Unpkg as well. In that scenario the author also didn't have 2FA enabled: https://www.facebook.com/socialfixer/posts/10155117415829342 I feel like Google should take the next step of…

[deleted]
Post reply on HN