Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Copyfish extension was stolen and adware-infested

a9t9.com

Post reply on HN
Print view View original

121–130 of 217 posts

Re: Our Copyfish extension was stolen and adware-infested

#121

Post by CannisterFlux »

alecthomas wrote: post #32
staticautomatic wrote: post #17

Of course it's a phishing attack. Why would Google send you a bit.ly link to your own Google account?

"Note that the bitly link was not directly visible in the phishing email, as it was an HTML-email. That is another lesson learned: Back to standard, text-based email as the default."

Thunderbird has phishing/scam detection built in that shows a pop-up with "this message might be a scam" if there is URL-like text in the message that points to another, different URL. So having the text "www.google.com" with a link to bit.ly would show a warning.

Sadly it is a bit overzealous and shows messages with say www.google.com that go to www.google.com/ as malicious too (i.e. trailing / so the text and URL don't exactly match though they resolve to the same thing), but the idea seems sound. I'm surprised gmail doesn't have something like this.

Re: Our Copyfish extension was stolen and adware-infested

#124

Post by Cthulhu_ »

hartator wrote: post #18
Pxtl wrote: post #14

Earlier quoted context omitted.

While I normally agree, I think it's important that they referred to the specific person without using blaming language. The team failed and screwed up because they had bad policies with their account. The individual team member who was holding the keys when the screw-up happened? Unlucky. Fix the process, not the people. It's good that they're not throwing the poor person under the bus.

I don't think more policies will make a better place. One of the team member screw up and stuff like this happen. I am questioning his security education to have been phished so easily.

A simple policy to add would be 2-factor authentication, no single shared developer account, and (on Google's side), both another security challenge (2FA) and e-mail notification to both a primary and recovery e-mail address when an extension is moved. Pretty sure Google also raises a question when logging in from a new device, e.g. from Russia, or when certain information is changed. (I know Facebook did at least).

Re: Our Copyfish extension was stolen and adware-infested

#125

Post by [deleted] »

TeMPOraL wrote: post #99
devrandomguy wrote: post #46

Earlier quoted context omitted.

Yeah, we really need to distinguish between a 2FA app and a dedicated hardware key. My phone is probably the least secure thing I've ever owned, both in terms of technical security, and physical security. This whole 2FA thing has been really jarring for me, because I always treated my phone like a public space: no password, no private data (that I know of), ready for inspection by foreign authorities. Of all the thin…

> Of all the things the world could ask me to trust, why the phone? Because it's the only instance of a computer that you can expect majority of users to own and always have on them. 2FA as a thing would not get any reasonable adoption if you required people to buy hardware keys to use it. Not to mention, hardware keys do not work on every device one would like to log in from (AFAIK you can't plug in a Yubikey to an…

[deleted]

Re: Our Copyfish extension was stolen and adware-infested

#126

Post by Cthulhu_ »

developer2 wrote: post #45
sillysaurus3 wrote: post #22

Earlier quoted context omitted.

It's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you. The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game. A policy of popping…

>> The only real defense is to glance at the url bar every time you're about to enter your password With Google specifically, the worst part is you really do have to look at the URL every single time you go to enter your password. And by that I mean that if you land on the login page, verify the URL, enter your password, submit, and get the error page saying you got the password wrong... you must check the URL again…

Pretty sure Google and other sites will do another 2FA challenge when you try to remove or change the 2FA challenge.

Re: Our Copyfish extension was stolen and adware-infested

#127

Post by alister »

hartator wrote: post #25
sillysaurus3 wrote: post #22

Earlier quoted context omitted.

It's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you. The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game. A policy of popping…

An email from Google with a bit.ly link? Hell no, I hope I won't fell from it in whatever situation. I agree that any defense is far from being perfect, but IT professionals shouldn't fell for an unsofiscated attack like this even if you are no working in security. I am not even talking about a web developer.

> An email from Google with a bit.ly link?

The article clearly explains that "the bitly link was not directly visible in the phishing email, as it was an HTML-email."

Re: Our Copyfish extension was stolen and adware-infested

#128

Post by icelancer »

krackers wrote: post #112
kyle-rb wrote: post #109

Earlier quoted context omitted.

> urls in double encoded base64 format I've seen that somewhere else; is it just for obfuscation? Or is there some other reason for it?

From what I've seen online a lot of these adware extensions do something similar. To me it doesn't make sense as an obfuscation method since anyone capable of capturing traces of network activity (or using chrome dev tools to do the equivalent) can probably recognize a base64 encoding and can just run the decoder a second time. Maybe it might fool some automated analyzers though.

I've definitely seen naive analyzers just do something like:

-Input string

-If string is Base64 encoded

--Run base64decode(string)

-Output new string

With no recursion for an iterated check of any sort of encoding.

Re: Our Copyfish extension was stolen and adware-infested

#129

Post by kijin »

joshschreuder wrote: post #79
BenjiWiebe wrote: post #72

Earlier quoted context omitted.

I always look at the mouse over url. And check the URL in the address bar. And rely on the password manager in the browser. And sometimes login in a new tab, then go back and reload the link.

bit.ly addresses don't keep their URL in the address bar (Eg. http://bit.ly/19y8wyr for HN), so it's possible you might not notice it once you've clicked, depending on how realistic the malicious target URL was.

Password managers really help in that situation. They will refuse to autofill your Google password if you're redirected to a domain that looks like google.com but actually contains weird Unicode characters, for example.
Post reply on HN