The inception bar: a new phishing method • Hacker News Board

Re: The inception bar: a new phishing method

#61

Post by saagarjha » Sun, Apr 28, 2019, 3:46 AM UTC

dzhiurgis wrote: post #56

userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

Prolly need some sort of ml to parse every image used on device and tag potentially dangerous ones. Wouldn’t be too expensive on devices with tensor units... Apparently Apple already reports your offensive photos already, can’t imagine why browsing should be treated differently.

> potentially dangerous ones

How do you define this?

> Apple already reports your offensive photos already

What?

Re: The inception bar: a new phishing method

#62

Post by lgats » Sun, Apr 28, 2019, 3:46 AM UTC

29athrowaway wrote: post #52

Change your system font.

slightly related, js [limited] system available font detection: https://gist.github.com/fijiwebdesign/3b0bf8e88ceef7518844

Re: The inception bar: a new phishing method

#63

Post by saagarjha » Sun, Apr 28, 2019, 3:48 AM UTC

sandworm101 wrote: post #59

walrus01 wrote: post #47

Earlier quoted context omitted.

I have an unquantified theory that the number of users that can distinguish between a Windows 7/8/10 dialog box that is presented directly by the operating system, versus as an image inside a browser coming from external http/https server, is diminishing greatly every year.

Except all the colorblind people who have altered their system defaults enough that anything internal to the browser will look very out of place.

Having the entire web be unaccessible is a somewhat poor compromise, though…

Re: The inception bar: a new phishing method

#64

Post by delfinom » Sun, Apr 28, 2019, 3:49 AM UTC

enedil wrote: post #27

I'm surprised that nobody included "clicking on the url bar in order to modify it" as a mitigation.

You can simulate that though since it's an html element being rendered with css.

Re: The inception bar: a new phishing method

#65

Post by cookingrobot » Sun, Apr 28, 2019, 3:51 AM UTC

FYI this isn’t occurring on chrome or safari on iOS. As soon as the fake bar appears the page stops scrolling normally - the scrolling inertia stops so that I can scroll but not “toss” the page, and the real address bar no longer hides. I wonder if this is a deliberate mitigation, or an accident?

Re: The inception bar: a new phishing method

#66

Post by saagarjha » Sun, Apr 28, 2019, 3:51 AM UTC

lgats wrote: post #62

29athrowaway wrote: post #52

Change your system font.

slightly related, js [limited] system available font detection: https://gist.github.com/fijiwebdesign/3b0bf8e88ceef7518844

Safari has prevented websites from accessing nonstandard fonts as an anti-fingerprinting technique for a while now, so this script does not quite work for those.

Re: The inception bar: a new phishing method

#67

Post by BoorishBears » Sun, Apr 28, 2019, 4:00 AM UTC

cookingrobot wrote: post #65

FYI this isn’t occurring on chrome or safari on iOS. As soon as the fake bar appears the page stops scrolling normally - the scrolling inertia stops so that I can scroll but not “toss” the page, and the real address bar no longer hides. I wonder if this is a deliberate mitigation, or an accident?

I wonder if this behavior is Google trying to make AMP pages behave a certain way in Chrome...

It mirrors the exact behavior of an AMP page's header.

Re: The inception bar: a new phishing method

#68

Post by akersten » Sun, Apr 28, 2019, 4:02 AM UTC

With a little polishing this would be quite the "exploit" - trap the user in your fake browser, actually load pages that are entered into the fake URL bar, replace content only on certain patterns...

The only solution here is a proper line of death [0]. It defeats the purpose of the LoD when it dynamically shrinks from user action.

[0]: https://textslashplain.com/2017/01/14/the-line-of-death/

Re: The inception bar: a new phishing method

#69

Post by sjroot » Sun, Apr 28, 2019, 4:06 AM UTC

cookingrobot wrote: post #65

FYI this isn’t occurring on chrome or safari on iOS. As soon as the fake bar appears the page stops scrolling normally - the scrolling inertia stops so that I can scroll but not “toss” the page, and the real address bar no longer hides. I wonder if this is a deliberate mitigation, or an accident?

This is because iOS browsers use WebKit and leverage the CSS `overflow-scrolling` attribute.

https://developer.mozilla.org/en-US/docs/Web/CSS/-webkit-ove...

Re: The inception bar: a new phishing method

#70

Post by userbinator » Sun, Apr 28, 2019, 5:08 AM UTC

Gaelan wrote: post #37

"Make sure you’ve done a hard refresh of the page" An inception bar could include a fake refresh button, no?

This is why I think removing the physical (as in, below the screen --- whether they're capacitive or actual pushbuttons isn't the point here) buttons from Android devices is a horrible idea; a webpage can mess around with what's on the screen, but it can't stop the user pressing the physical menu button and choosing Refresh from there.