Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The inception bar: a new phishing method

jameshfisher.com

Post reply on HN
Print view View original

101–110 of 238 posts

Re: The inception bar: a new phishing method

#101

Post by jsmith99 »

emmelaich wrote: post #94
Waterluvian wrote: post #51

Earlier quoted context omitted.

In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts. Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message. People will just assume they made a typo and continue as if nothing happened. I've argued before for a genuine out-of-band independent display on…

That's why Windows can be set to require Ctrl+Alt+Del before login as it can't be intercepted by a fake login screen.

Re: The inception bar: a new phishing method

#102

Post by bgeeek »

laumars wrote: post #77
Waterluvian wrote: post #51

Earlier quoted context omitted.

In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

ha I did a similar thing too. Except it was fake error messagebox and on Windows 3.1 (or might have even been 3.0?) It worked quite effectively on 3.x because you could just minimize progman.exe

We did similar with the dos prompt, which must have been about 1991.

Re: The inception bar: a new phishing method

#103

Post by ben_w »

walrus01 wrote: post #47
userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

I have an unquantified theory that the number of users that can distinguish between a Windows 7/8/10 dialog box that is presented directly by the operating system, versus as an image inside a browser coming from external http/https server, is diminishing greatly every year.

Last time I was in Davis CA, someone was trying to get me to sign up to their charity. They had an iPad, and were adamant that the padlock on the screen proved it was secure.

I couldn’t convince them that it was just a picture, and that I could fake it if I wanted to.

Re: The inception bar: a new phishing method

#104

Post by mk89 »

antonvs wrote: post #41
mk89 wrote: post #28

Using Firefox for android: if I open the page and scroll down, the address bar becomes invisible and the hsbc bar shows up. If I keep scrolling down, I just see hsbc. The moment I scroll up, the original address bar is shown, and even if I keep scrolling down, the bar does not disappear. Edit: it's happening kind of randomly. 1 time it happens, 3 times it doesn't...

Using Firefox Beta for Android v67.0b9, I see the hbsc address bar as a second address bar below the real one. It remains in place as I scroll, although a couple of times it disappeared. Also this version wouldn't fool me because it says I have 26 tabs open. I'm used to the infinity symbol there!

I am using Firefox 66.0.2. (how could I forget to mention that!).

Re: The inception bar: a new phishing method

#105

Post by oefrha »

gruez wrote: post #8
doctorless wrote: post #3

Interesting. iOS Safari seems to force the address bar to stay visible on this page.

Also the scrolling feels "weird". Kinda like when you're on an amp page (although I think they fixed that now).

Yeah, the scrolling is so janky on the page, I thought my iPad wasn’t properly responding to multitouch input for a moment... Then I opened the HN discussion and smooth, buttery scrolling (tm) was back. Lesson: don’t hijack scrolling behavior, it’s awful. (Very smart hack though.)

Re: The inception bar: a new phishing method

#106

Post by baddox »

jsmith99 wrote: post #101
emmelaich wrote: post #94

Earlier quoted context omitted.

Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts. Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message. People will just assume they made a typo and continue as if nothing happened. I've argued before for a genuine out-of-band independent display on…

That's why Windows can be set to require Ctrl+Alt+Del before login as it can't be intercepted by a fake login screen.

Similarly, the iPhone X requires double-pressing the power button to complete a purchase using Face ID. Previously, with Touch ID, the authentication action itself was also sufficient to establish intent (placing the finger on the sensor). But with Face ID, any app could just pop up the purchase window and Face ID would see your face.

Incidentally, this is why Face ID is strictly worse than Touch ID in my opinion.

Re: The inception bar: a new phishing method

#108

Post by jfoster »

ehnto wrote: post #71
Waterluvian wrote: post #50

I'm not doubting the concerns raised but the fake failed in many ways for me on my phone with the latest chrome. It didn't appear. Then when it did it appeared below the existing bar. But I guess you just need it to work often enough.

It's like the fake "Allow Notification" dialogs on some sites. They look off to pretty much anyone paying attention, but their target market probably isn't people paying attention

What's the idea behind those? Do they just get permission before showing the real dialog, or is it more sinister than that?

Re: The inception bar: a new phishing method

#109

Post by 0db532a0 »

Waterluvian wrote: post #51
userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

The company where I first worked out of university had a custom which the CEO named ‘shemaling’. The company had quite strict security standards. It was encouraged that anyone who found an unlocked screen in the office would ‘shemale’ the wallpaper. It did the job. I never forgot again after being ’shemaled’ the first time.
Post reply on HN