81–90 of 217 posts
Looking at the attacker's code, they are currently trying to steal cloudflare api keys in addition to stealing cookies from all sites the extension users visit :(
Earlier quoted context omitted.
I don't think more policies will make a better place. One of the team member screw up and stuff like this happen. I am questioning his security education to have been phished so easily.
It's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you. The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game. A policy of popping…
Can someone explain to me why the attacker wrote the script source tag as "var config_fragment = ' ';" Instead of just: var config_fragment = ' ';
It’s usually done to prevent the parser from interpreting the closing script tag early: https://stackoverflow.com/questions/236073/why-split-the-scr...
> “Click here to read more details” the email said. The click opened the “Google” password dialog, and the unlucky team member entered the password for our developer account. This looked all legit to the team member, so we did not notice the pishing attack as such at this point. Pishing for Chrome extensions was simply not on our radar screen. First, it is excellent that you disclosed the issue. Second, based upon th…
Earlier quoted context omitted.
but apparently non-maliciously
What do you mean? I thought the attacker stole the account maliciously, but hadn't quite gotten around to inserting the malware by the time it was taken back.
I had strong suspicions that a certain webhost a new client of mine utilized was both prone to attack, and not very forthcoming when past attacks had occurred.
So when I loaded their own website one day and found it full of ads for russian pornography... I confirmed my own bias that the webhost had been hacked... deleted the account, and moved everything over to AWS.
Changed all the passwords, freaked out a bit, etc...
Then I realized that it was just the extension I was running that injected those ads... d'oh!
Earlier quoted context omitted.
> The only real defense is to glance at the url bar every time you're about to enter your password. With i18n not even that: https://www.theguardian.com/technology/2017/apr/19/phishing-... Benign POC: https://www.xn--80ak6aa92e.com/ (open it and it'll look like a normal "l" in the url box)
Browser shows https://www.xn--80ak6aa92e.com to me, Chrome on Android. What browser are you using that shows non-ascii with .com?
Earlier quoted context omitted.
> Every time you're about to paste your password, glance at the url bar. Actually - I disagree with this. You can no longer "glance" at the url bar to determine if you are on the right domain due to Unicode chars if you clicked a link. The only safe way is to type the url yourself into the browser. If it is a long link - then at least typing the base domain, and pasting the "rest" is probably safe?
This actually isn't true. A website like https://www.xn--80ak6aa92e.com/ won't show up as apple.com. Browsers don't allow Unicode rendering in the URL bar. Maybe IE is affected though. I haven't tested every browser. But it's a known security concern.
Case in point, I don't care about a readability or bookmarking plugin reading a news link, but it shouldn't read my bank page.
Earlier quoted context omitted.
I don't think more policies will make a better place. One of the team member screw up and stuff like this happen. I am questioning his security education to have been phished so easily.
It's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you. The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game. A policy of popping…