Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Innovative Phishing Style

tehaurum.wordpress.com

Post reply on HN
Print view View original

61–70 of 83 posts

Re: An Innovative Phishing Style

#61

Post by kylebarron »

fabricexpert wrote: post #39

I'm an engineer (mostly web) and I am very tech savvy, and extremely wary on the internet of scams. However, if this site had to come me via a trusted channel, I would have fallen for it maybe 80% of the time. I hardly ever login to steam as it's always running and while I have 2FA my password would have been stolen in this attack for sure. I don't think teenagers and non-techy users would stand a chance against this…

Note that LastPass didn't autofill the password and the box stayed gray instead of red. That would tip off most LastPass users that the url was wrong.

edit: Image in question: https://i.imgur.com/hVTEKfD.png

Re: An Innovative Phishing Style

#62

Post by wild_preference »

kylebarron wrote: post #61
fabricexpert wrote: post #39

I'm an engineer (mostly web) and I am very tech savvy, and extremely wary on the internet of scams. However, if this site had to come me via a trusted channel, I would have fallen for it maybe 80% of the time. I hardly ever login to steam as it's always running and while I have 2FA my password would have been stolen in this attack for sure. I don't think teenagers and non-techy users would stand a chance against this…

Note that LastPass didn't autofill the password and the box stayed gray instead of red. That would tip off most LastPass users that the url was wrong. edit: Image in question: https://i.imgur.com/hVTEKfD.png

1Password saved me from getting phished by “colnbase.com” because the completion hotkey didn’t work. I still wince thinking about how close I got.

You used to just have to be moderately tech savvy to avoid scams but I find myself tricked more and more often these days. Recently it was a “click to start download” ad. I sent the page to my friends and they got fooled too.

Re: An Innovative Phishing Style

#63

Post by tjoff »

ectospheno wrote: post #60
tjoff wrote: post #50

Earlier quoted context omitted.

Maybe it's a cultural thing? I've never come across a situation where anyone would give their CC number for a free service. That gives a really shady impression. Or expose myself to that risk.

What risk? That you have to wait a few days for your bank to send you a new card if it is compromised? There is no accidental charge risk as you then just call the bank and have them remove it. If your bank makes that difficult then switch to a reputable one.

I hate that kind reasoning.

1. You are actively funding thieves. This is wrong on so many levels it is bizarre.

2. All subscriptions need to be redone.

3. Even in a perfect world it is quite the hassle. And that is not taking into account the added problems if this were to be happening while you were on vacation.

Even risking only one of those is a complete dealbreaker.

Re: An Innovative Phishing Style

#64

Post by arayh »

For what it's worth, I noticed that the login does not load up on IE11 and Edge, although it loads up for Chrome, Firefox, and Opera and will label the fake pop-up window with said browser name.

Re: An Innovative Phishing Style

#65

Post by bonestamp2 »

btown wrote: post #57
hvindin wrote: post #54

Earlier quoted context omitted.

Personally I'd be pretty sure that, at least at the bank I currently work at, this would rarely ever work. I mean, other than the attempts to foster a relationship between bank staff and the tech people through things like days of letting tech people hang out and try and be helpful at branches in order to "see what real difference they could make" - and that laegely ending up being a fairly regular educational exerci…

> half way competent institution At which attackers shift their targets from a bank to a mobile phone provider... :(

Obligatory "SMS 2FA needs to stop" comment. Because it does.

Re: An Innovative Phishing Style

#66

Post by tvanantwerp »

hsnewman wrote: post #47
oriettaxx wrote: post #12

Wanna bet that if I call anybody working in a bank, telling them I am from the IT department and I want them to check the new login page (done the way described in this article), they will enter there their login & password?

Well, first, phishing is not calling someone, but at our bank we train our employees monthly about phishing by testing them, and if they fail they must take a class. Serial failures could result up to termination. So, how much you wanna bet?

From the stories my wife--a bank employee--has told me, I'll bet on the phishers.

Re: An Innovative Phishing Style

#67

Post by tomjen3 »

hsnewman wrote: post #47
oriettaxx wrote: post #12

Wanna bet that if I call anybody working in a bank, telling them I am from the IT department and I want them to check the new login page (done the way described in this article), they will enter there their login & password?

Well, first, phishing is not calling someone, but at our bank we train our employees monthly about phishing by testing them, and if they fail they must take a class. Serial failures could result up to termination. So, how much you wanna bet?

How often do they assume that non-scams are scams?

That part has always made me curious when talking about these tests, I mean I have a mostly fool proof way (type the url or navigate to it from the main page), but even including "this page is not linked from anywhere else for security, you must click the link) would probably fool people. Especially because I can imagine many orgs would actually include that.

Re: An Innovative Phishing Style

#68

Post by stordoff »

kilburn wrote: post #17

Doesn't OAuth and similar work by redirecting you to the login page? I don't recall ever seeing a version that opens a popup to get you to login. This would immediately raise my suspicions on this basis (popup windows can be controlled by the opening website to a large degree!).

I see it all the time with PayPal (to the point where I wouldn't be suspicious of Steam doing it).

Re: An Innovative Phishing Style

#69

Post by nneonneo »

The site's dead now - the DNS record was pulled about an hour ago. But, I got a snapshot of the site and all the code before it got taken down, and I took the liberty of deobfuscating the big blobs of code:

https://github.com/nneonneo/steam-phishing-analysis

It's fairly simple code, in the end. The phishers copied the legitimate trading site, as well as the Steam Community login page, and then added some JavaScript code to both as well as tweaking the HTML a bit. In total, three snippets of JS were added: the first detects debuggers using https://github.com/sindresorhus/devtools-detect (the bit that the original blog poster found), the second pops open the fake browser chrome and sticks the fake login page inside an iframe, and the third (running in the iframe) harvests credentials off the copied Steam login page.

Post reply on HN