Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The inception bar: a new phishing method

jameshfisher.com

Post reply on HN
Print view View original

41–50 of 238 posts

Re: The inception bar: a new phishing method

#41

Post by antonvs »

mk89 wrote: post #28

Using Firefox for android: if I open the page and scroll down, the address bar becomes invisible and the hsbc bar shows up. If I keep scrolling down, I just see hsbc. The moment I scroll up, the original address bar is shown, and even if I keep scrolling down, the bar does not disappear. Edit: it's happening kind of randomly. 1 time it happens, 3 times it doesn't...

Using Firefox Beta for Android v67.0b9, I see the hbsc address bar as a second address bar below the real one. It remains in place as I scroll, although a couple of times it disappeared.

Also this version wouldn't fool me because it says I have 26 tabs open. I'm used to the infinity symbol there!

Re: The inception bar: a new phishing method

#42

Post by userbinator »

"Ceci n'est pas un UI."

This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme), but it seems the trend toward un-customisability is just going to lead to this being even more easy to exploit.

Of course, mobile browsers hiding important information and being even more un-customisable makes this worse.

Well, even I, as the creator of the inception bar, found myself accidentally using it!

When reading a product's documentation that has screenshots explaining how to do something, I've also accidentally tried to manipulate them instead of the actual dialogs. I'm sure others here have had similar experiences too.

Re: The inception bar: a new phishing method

#46

Post by amingilani »

paul7986 wrote: post #30

Poor Android users .. no blue bubbles and now this!

Security vulnerabilities are discovered across all platforms. Just recently did we find an eavesdropping vulnerability in iOS[0] that certainly qualifies as far more severe. Given how security issues can pop up for any platform, I don't think calling one group of users "poor" is prudent, or a nice thing to do.

[0]: https://www.forbes.com/sites/daveywinder/2019/01/29/apple-co...

Re: The inception bar: a new phishing method

#47

Post by walrus01 »

userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

I have an unquantified theory that the number of users that can distinguish between a Windows 7/8/10 dialog box that is presented directly by the operating system, versus as an image inside a browser coming from external http/https server, is diminishing greatly every year.
Post reply on HN