Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The inception bar: a new phishing method

jameshfisher.com

Post reply on HN
Print view View original

151–160 of 238 posts

Re: The inception bar: a new phishing method

#151

Post by welly »

0db532a0 wrote: post #109
Waterluvian wrote: post #51

Earlier quoted context omitted.

In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

The company where I first worked out of university had a custom which the CEO named ‘shemaling’. The company had quite strict security standards. It was encouraged that anyone who found an unlocked screen in the office would ‘shemale’ the wallpaper. It did the job. I never forgot again after being ’shemaled’ the first time.

My last work place did something similar, although using Justin Bieber photographs. I was Biebered a few times.

Re: The inception bar: a new phishing method

#152

Post by ctz »

colanderman wrote: post #149

I understand why this was a problem in 1995, but honestly, in 2019, with image recognition technology as advanced as it is now – especially due to efforts by Google – why can't browsers detect this? Surely "does this rectangle look vaguely like a URL bar" is an easier problem to solve than "is this a photograph of a cat"? Sure, image recognition is CPU intensive, but even just checking once every 5 seconds or so woul…

Machine learning-style image recognition tends to work extremely poorly with adversarial inputs.

Re: The inception bar: a new phishing method

#153

Post by oedmarap »

chicob wrote: post #148
userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

Someone I know would constantly leave a macbook unlocked, so I prepared a script that would turn down the volume, whisper the owner's name, open weird sfw pictures online and other mildly annoying things, but not very often (like once a week). This was meant as a joke, and I never actually went through with it. I know the person very well but it still felt douchebaggy. But the idea was to make an app file, save it to…

Blurred lines aside, for posterity you could name it "Safari Auto-Update Utility" and use an app icon that has the Safari logo coupled with a cog wheel or so.

Re: The inception bar: a new phishing method

#154

Post by 0db532a0 »

welly wrote: post #151
0db532a0 wrote: post #109

Earlier quoted context omitted.

The company where I first worked out of university had a custom which the CEO named ‘shemaling’. The company had quite strict security standards. It was encouraged that anyone who found an unlocked screen in the office would ‘shemale’ the wallpaper. It did the job. I never forgot again after being ’shemaled’ the first time.

My last work place did something similar, although using Justin Bieber photographs. I was Biebered a few times.

I'm not sure which is worse.

Re: The inception bar: a new phishing method

#156

Post by Terretta »

sandworm101 wrote: post #59
walrus01 wrote: post #47

Earlier quoted context omitted.

I have an unquantified theory that the number of users that can distinguish between a Windows 7/8/10 dialog box that is presented directly by the operating system, versus as an image inside a browser coming from external http/https server, is diminishing greatly every year.

Except all the colorblind people who have altered their system defaults enough that anything internal to the browser will look very out of place.

You could always try pulling their system colors in through CSS:

https://www.sitepoint.com/css-system-styles/

Re: The inception bar: a new phishing method

#157

Post by bartimus »

Perhaps a solution would be to allow the browser to share a "fingerprint" with specific websites. To make a trusted connection. The website would know if a trusted connection exists for the user and deny all login attempts coming from unauthorized fingerprints.

Re: The inception bar: a new phishing method

#158

Post by chicob »

oedmarap wrote: post #153
chicob wrote: post #148

Earlier quoted context omitted.

Someone I know would constantly leave a macbook unlocked, so I prepared a script that would turn down the volume, whisper the owner's name, open weird sfw pictures online and other mildly annoying things, but not very often (like once a week). This was meant as a joke, and I never actually went through with it. I know the person very well but it still felt douchebaggy. But the idea was to make an app file, save it to…

Blurred lines aside, for posterity you could name it "Safari Auto-Update Utility" and use an app icon that has the Safari logo coupled with a cog wheel or so.

I thought of something like that, but then the user could kill it as a precaution since an auto-update utility or any other secondary application can be temporarily disabled. Killing "Safari", on the other hand, would terminate everything the user's currently doing in it.

I guess I could have named it Disk Memory Manager or some other important-sounding thing.

Re: The inception bar: a new phishing method

#160

Post by washadjeffmad »

chicob wrote: post #158
oedmarap wrote: post #153

Earlier quoted context omitted.

Blurred lines aside, for posterity you could name it "Safari Auto-Update Utility" and use an app icon that has the Safari logo coupled with a cog wheel or so.

I thought of something like that, but then the user could kill it as a precaution since an auto-update utility or any other secondary application can be temporarily disabled. Killing "Safari", on the other hand, would terminate everything the user's currently doing in it. I guess I could have named it Disk Memory Manager or some other important-sounding thing.

'Ghost of Steve Jobs' then.
Post reply on HN