Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Copyfish extension was stolen and adware-infested

a9t9.com

Post reply on HN
Print view View original

151–160 of 217 posts

Re: Our Copyfish extension was stolen and adware-infested

#151

Post by franciscop »

cbr wrote: post #41
franciscop wrote: post #30

Earlier quoted context omitted.

> The only real defense is to glance at the url bar every time you're about to enter your password. With i18n not even that: https://www.theguardian.com/technology/2017/apr/19/phishing-... Benign POC: https://www.xn--80ak6aa92e.com/ (open it and it'll look like a normal "l" in the url box)

Browser shows https://www.xn--80ak6aa92e.com to me, Chrome on Android. What browser are you using that shows non-ascii with .com?

I activated it so it would display the punycode. Every major browser up to few months ago would show it as "apple", not sure now. But we know many people cannot just upgrade their browsers, so there must be still many vulnerable browsers out there.

Re: Our Copyfish extension was stolen and adware-infested

#152

Post by detaro »

twhb wrote: post #111
jeswin wrote: post #88

Chrome's security policy is surprisingly poor and is the reason why I stay away from most extensions. "Read data from all websites" is like root on the phone. It should be allowed only via deliberate, explicit user action. While this will be an interesting UX challenge, defaulting to domain-specific permissions is the sane thing to do in this age. Case in point, I don't care about a readability or bookmarking plugin…

I think more granular permissions, not domain-specific permissions, are the solution. Domain-specific permissions destroy the illusion that the extension is part of the browser, without restricting access as far as it should be. For example, I made an extension that, upon a certain keyboard shortcut, saves the current page in a specific bookmarks folder. Currently Chrome's permissions model completely fails here, you…

Isn't this what the "activeTab" permission is for (combined with a shortcut to trigger the extensions pageAction)?

Re: Our Copyfish extension was stolen and adware-infested

#153

Post by cheez »

sam_goody wrote: post #135
cheez wrote: post #42

Earlier quoted context omitted.

I rely on my password manager: if it isn't filling in the password automatically, something is suspect. I wonder if I'm the only one who does this.

I used to do that till lastpass had several vulns [1] in which passwords to all sites can be gotten by a malicious page or extension. If you use a password manager that auto fills in the paswords, it is open to an attack by a site or program that can fool it into thinking you have visited the site. Any malicious extension such as the one compromised her, has a good chance of being able to drain all your passwords. Yo…

I am aware of that bug. However, Google wants to replace lastpass with Chrome sync, so no surprise that their employees are attacking it. Hopefully that made it better.

I doubt even pasting it in is completely secure.

Re: Our Copyfish extension was stolen and adware-infested

#154

Post by pbhjpbhj »

nl wrote: post #86
cbr wrote: post #41

Earlier quoted context omitted.

Browser shows https://www.xn--80ak6aa92e.com to me, Chrome on Android. What browser are you using that shows non-ascii with .com?

Firefox on OSX shows it appearing as "www.apple.com"

Same, FF54.0 on Ubuntu 17.04.

Re: Our Copyfish extension was stolen and adware-infested

#155

Post by pbhjpbhj »

andmalc wrote: post #65
joshschreuder wrote: post #59

A similar attack happened on another Chrome extension last month (Social Fixer) with over 190k installs. In fact, judging by the exploit code, I would guess the same author, as the Social Fixer attack had a very similar hashed package on Unpkg as well. In that scenario the author also didn't have 2FA enabled: https://www.facebook.com/socialfixer/posts/10155117415829342 I feel like Google should take the next step of…

> Google should take the next step of requiring all extension developers to enable 2FA before being able to post an extension. Best comment here

Which would allow real world identity to be discovered, in the event of malware is there a possibility of prosecution eg for something related to recklessly causing damage (through inaction/action)?

Re: Our Copyfish extension was stolen and adware-infested

#156

Post by 4ad »

BenjiWiebe wrote: post #72
alecthomas wrote: post #32

Earlier quoted context omitted.

"Note that the bitly link was not directly visible in the phishing email, as it was an HTML-email. That is another lesson learned: Back to standard, text-based email as the default."

I always look at the mouse over url. And check the URL in the address bar. And rely on the password manager in the browser. And sometimes login in a new tab, then go back and reload the link.

A pity some browsers now hide the mouse over URL.

I use this in safari to bring it back: https://visnup.github.io/Minimal-Status-Bar/

Re: Our Copyfish extension was stolen and adware-infested

#157

Post by IncRnd »

hartator wrote: post #25
sillysaurus3 wrote: post #22

Earlier quoted context omitted.

It's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you. The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game. A policy of popping…

An email from Google with a bit.ly link? Hell no, I hope I won't fell from it in whatever situation. I agree that any defense is far from being perfect, but IT professionals shouldn't fell for an unsofiscated attack like this even if you are no working in security. I am not even talking about a web developer.

I have no idea why your post was downvoted. Your post is clearly correct.

Re: Our Copyfish extension was stolen and adware-infested

#158

Post by IncRnd »

Pxtl wrote: post #14
IncRnd wrote: post #10

> “Click here to read more details” the email said. The click opened the “Google” password dialog, and the unlucky team member entered the password for our developer account. This looked all legit to the team member, so we did not notice the pishing attack as such at this point. Pishing for Chrome extensions was simply not on our radar screen. First, it is excellent that you disclosed the issue. Second, based upon th…

While I normally agree, I think it's important that they referred to the specific person without using blaming language. The team failed and screwed up because they had bad policies with their account. The individual team member who was holding the keys when the screw-up happened? Unlucky. Fix the process, not the people. It's good that they're not throwing the poor person under the bus.

I really wasn't calling to "fix the person."

I agree with you. The email makes the situation appear as a process issue. Based upon the disclosure text, it seems quite possible the person wouldn't normally have clicked on an email text, but did so here based upon process.

The disclosure displayed the attitude that they shouldn't have expected to get phished. It's 2017. Lots of people get phished.

It's pretty straightforward to never click links that arrive in emails, to never enter passwords into webpages that open on their own.

Of course there are technical ways to mitigate this specific attack, but it is more important not to excuse poor Internet hygiene after the fact.

Re: Our Copyfish extension was stolen and adware-infested

#159

Post by proactivesvcs »

claudius wrote: post #132
alister wrote: post #127

Earlier quoted context omitted.

> An email from Google with a bit.ly link? The article clearly explains that "the bitly link was not directly visible in the phishing email, as it was an HTML-email."

Disabling HTML e-mails does not sound particularly unreasonable. There’s little additional benefit from them but a whole host of possible issues, least of all that suddenly your e-mail client has to deal with properly parsing HTML and you have to decide whether or not to load remote images and potentially execute JavaScript.

I've never read my email in HTML, mostly for security reasons such as this incident. For the rare occasion where an email doesn't render correctly, Thunderbird's "Show HTML" button works a charm.

Have I been able to convince a single customer (I run a computer services business) or friend to follow my lead? Nope, not a single one.

Re: Our Copyfish extension was stolen and adware-infested

#160

Post by raimue »

Cthulhu_ wrote: post #126
developer2 wrote: post #45

Earlier quoted context omitted.

>> The only real defense is to glance at the url bar every time you're about to enter your password With Google specifically, the worst part is you really do have to look at the URL every single time you go to enter your password. And by that I mean that if you land on the login page, verify the URL, enter your password, submit, and get the error page saying you got the password wrong... you must check the URL again…

Pretty sure Google and other sites will do another 2FA challenge when you try to remove or change the 2FA challenge.

The phisher just shows you a "password incorrect" message on the first attempt. Assuming you made some typing mistake, you enter your password and 2FA again...
Post reply on HN