The inception bar: a new phishing method • Hacker News Board

Re: The inception bar: a new phishing method

#91

Post by chii » Sun, Apr 28, 2019, 8:20 AM UTC

steve_taylor wrote: post #17

doctorless wrote: post #3

Interesting. iOS Safari seems to force the address bar to stay visible on this page.

> With a little more effort, the page could detect which browser it’s in, and forge an inception bar for that browser. It’s just a proof of concept, focusing on one browser in one operating system. It would be interesting to see how well this could be done on iOS. The real host name is always shown at the top of the page, so it’s not going to be perfect.

> so it’s not going to be perfect.

doens't have to be perfect - just good enough to fool some people.

Re: The inception bar: a new phishing method

#92

Post by suzzer99 » Sun, Apr 28, 2019, 8:21 AM UTC

I'll worry about this when I stop getting emails from my banks and credit card companies that look like cheesy phishing emails and ask me to click the link then login.

My point is that none of this stuff matters if major corporations continue to send out terrible emails that basically encourage consumers to engage in risky behavior.

Re: The inception bar: a new phishing method

#93

Post by cjsawyer » Sun, Apr 28, 2019, 8:24 AM UTC

jamesfisher wrote: post #76

akersten wrote: post #68

With a little polishing this would be quite the "exploit" - trap the user in your fake browser, actually load pages that are entered into the fake URL bar, replace content only on certain patterns... The only solution here is a proper line of death [0]. It defeats the purpose of the LoD when it dynamically shrinks from user action. [0]: https://textslashplain.com/2017/01/14/the-line-of-death/

Thanks for pointing me to this post - an amazing reference. I'm going to include it in my post.

It is fascinating how little we can trust in software that shows content from other users.

Re: The inception bar: a new phishing method

#94

Post by emmelaich » Sun, Apr 28, 2019, 8:31 AM UTC

Waterluvian wrote: post #51

userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts.

Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message.

People will just assume they made a typo and continue as if nothing happened.

I've argued before for a genuine out-of-band independent display on machines which can only be written to by some very high privilege process.

Re: The inception bar: a new phishing method

#95

Post by asgs » Sun, Apr 28, 2019, 8:31 AM UTC

it was hard to reproduce this behaviour on Firefox mobile, but it did happen twice after multiples of scroll ups and downs.

so the question is, is it a common browser bug?

Re: The inception bar: a new phishing method

#96

Post by GordonS » Sun, Apr 28, 2019, 8:37 AM UTC

Gaelan wrote: post #37

"Make sure you’ve done a hard refresh of the page" An inception bar could include a fake refresh button, no?

By "hard refresh" I took that to mean using the keyboard to forcibly reload the page and all assets, e.g. CTRL-F5 on Windows. Of course, the average user probably doesn't use keyboard commands, or even know this one exists.

Re: The inception bar: a new phishing method

#97

Post by GordonS » Sun, Apr 28, 2019, 8:38 AM UTC

cookingrobot wrote: post #65

FYI this isn’t occurring on chrome or safari on iOS. As soon as the fake bar appears the page stops scrolling normally - the scrolling inertia stops so that I can scroll but not “toss” the page, and the real address bar no longer hides. I wonder if this is a deliberate mitigation, or an accident?

Also doesn't work using Brave on Android. Which is unexpected, since it's now based on Chromium.

Re: The inception bar: a new phishing method

#98

Post by GordonS » Sun, Apr 28, 2019, 8:40 AM UTC

skunkworker wrote: post #55

A recent example that I've been seeing more and more is pages taking over some system keyboard shortcuts. I've seen pages taking over Command-F and using their own search interface instead of the browsers. I've found utilities for not messing with copy/paste, but is there a way to block pages with keyboard shortcuts in Chrome?

Hijacking CTRL-F drives me nuts!

I really think this should result in a permissions dialog from the browser.

Re: The inception bar: a new phishing method

#99

Post by afandian » Sun, Apr 28, 2019, 8:45 AM UTC

I can't help but think that this was made possible by the complete collapse in common UI standards. 'Apps' have stopped being OS-toolkit apps and moved onto the web, and of course each designer needs to have their own special on-brand widget style. This has leaked onto the few remaining desktop apps: Chrome rejects the standard Mac OS widgets and reimplements everything, from buttons to the print dialog. Spotify does its own thing. And lest we think Apple has much respect for UX, iTunes is a mess. I genuinely can't use it.

The result is that users have been trained not to expect consistent UI paradigms. Every UI is hunt-and-peck. And that paves the way for this kind of exploit.

Re: The inception bar: a new phishing method

#100

Post by IshKebab » Sun, Apr 28, 2019, 8:46 AM UTC

Waterluvian wrote: post #51

userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

In high school I replicated the entire login UI of NT LAN manager (I think it was called) and had it save the password and then crash the machine (via c:\con\con). Asked the teacher to login for something and tada, admin password.

If you ever wondered why you have to press ctrl-alt-del to log in, that is why (nobody ever fixed this for Linux).