Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The inception bar: a new phishing method

jameshfisher.com

Post reply on HN
Print view View original

231–238 of 238 posts

Re: The inception bar: a new phishing method

#231

Post by decalages »

jamesfisher wrote: post #165
Gaelan wrote: post #37

"Make sure you’ve done a hard refresh of the page" An inception bar could include a fake refresh button, no?

Thanks, and yes! I was originally thinking "pull-to-refresh", but since your comment, I've enhanced the phishing with another trick: a large buffer at the top of the scroll jail, which prevents the user from reaching the top, and thus prevents the user from using "pull-to-refresh". Now, the only way I know to reliably get out of the page is to move to another app, then back to Chrome - this seems to cause it to re-di…

You can scroll down from the inception bar to display the browser bar again

Re: The inception bar: a new phishing method

#232

Post by Natanael_L »

akersten wrote: post #177
geuszb wrote: post #172

Earlier quoted context omitted.

Thanks. This is a great reference indeed! The challenge is preserving ability for content to control all pixels; without it, the content ecosystem ends up developing single-purpose, generally crappy apps, which isn't necessarily a better thing either... I'm not sure it is the only solution either - what about "secure attention key" type ways to get the system's attention (in this case the browser's), bypassing any co…

Those are some good ideas too - "only solution" was a bit hyperbolic - but I do think our options are limited, especially on mobile. The Secure Attention Key is interesting, but would need the user to know you press it. And on mobile, it would probably need to be a dedicated button on the device, since I could just fake the on screen keyboard too. Password manager auto-fill failing would clue a savvy user that someth…

With the use of gesture controls and swipe-up menus and "soft keys", etc, why not put in something like the "pie control" apps on Android, where the OS controls one part and the app controls another?

Consider a semi-configurable universal menu with a well defined access method, where you always can back out of the app, and in the case of browsers also have guaranteed access to switching tabs and accessing options, etc.

Re: The inception bar: a new phishing method

#233

Post by IshKebab »

iforgotpassword wrote: post #171
IshKebab wrote: post #100

Earlier quoted context omitted.

In high school I replicated the entire login UI of NT LAN manager (I think it was called) and had it save the password and then crash the machine (via c:\con\con). Asked the teacher to login for something and tada, admin password. If you ever wondered why you have to press ctrl-alt-del to log in, that is why (nobody ever fixed this for Linux).

> If you ever wondered why you have to press ctrl-alt-del to log in, that is why (nobody ever fixed this for Linux). Seems you're not familiar with Linux. It had SAK since forever.

It doesn't look like the implementation is any good though. First, you have to set it up manually. I've literally never seen anyone do that. Second, it works by killing X. Not exactly elegant. But most importantly you don't have to use the SAK to log in! That's kind of the whole point of it.

It should be "Press ctrl-alt-delete to log in", not "By the way you can press ctrl-alt-delete if you want" because then nobody will bother!

Re: The inception bar: a new phishing method

#234

Post by iforgotpassword »

IshKebab wrote: post #233
iforgotpassword wrote: post #171

Earlier quoted context omitted.

> If you ever wondered why you have to press ctrl-alt-del to log in, that is why (nobody ever fixed this for Linux). Seems you're not familiar with Linux. It had SAK since forever.

It doesn't look like the implementation is any good though. First, you have to set it up manually. I've literally never seen anyone do that. Second, it works by killing X. Not exactly elegant. But most importantly you don't have to use the SAK to log in! That's kind of the whole point of it. It should be "Press ctrl-alt-delete to log in", not "By the way you can press ctrl-alt-delete if you want" because then nobody…

> Second, it works by killing X. Not exactly elegant.

It works by killing everything on that particular terminal, no matter if it's text based or graphical. That's the whole point: whatever spawns after that is created by the init system.

> But most importantly you don't have to use the SAK to log in! That's kind of the whole point of it.

> It should be "Press ctrl-alt-delete to log in", not "By the way you can press ctrl-alt-delete if you want" because then nobody will bother!

I can guarantee you, if I were to copy the design of the login screen that shows up after you press ctrl-alt+del, 99.999% of people who don't work in IT won't bat an eye and enter their credentials straight away. It comes down to educating your users. If you don't explain your users why they have to press it before logging in, they will write it off as just random computer stuff they don't understand and only do so because they get prompted to do so. If next time around they don't, they don't care.

So it comes down to educating your users, and I could very well train them to press alt-print-k before logging in, whereas I agree that a friendly reminder on the login screen is a plus.

Re: The inception bar: a new phishing method

#236

Post by remram »

baud147258 wrote: post #213
userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

"Ceci n'est pas un UI." Shouldn't it be "Ceci n'est pas une UI."? Since interface is a feminine word in French, the article in front of UI need to be feminine too.

Then it should probably be "une IHM", for "Interface Homme-Machine".

Re: The inception bar: a new phishing method

#237

Post by Stugie »

I found a fix to this problem, on accident. I use Blokada apk on android (not the Google play store version, the good one, if that makes a difference) and when first visiting the page didn't see what the hell you were talking about, the inception url bar never showed up for me. So, when most things don't load or don't act as they're supposed to that is the first thing I go and do-- disable Blokada and reload. Once I did, then it showed up, (pretty cool little discovery btw, good job)

So tl/dr; Can be fixed by using ad+malware blocking host file, namely this one, https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master... since it's the one I use and was using when I noticed this

Re: The inception bar: a new phishing method

#238

Post by Stugie »

Stugie wrote: post #237

I found a fix to this problem, on accident. I use Blokada apk on android (not the Google play store version, the good one, if that makes a difference) and when first visiting the page didn't see what the hell you were talking about, the inception url bar never showed up for me. So, when most things don't load or don't act as they're supposed to that is the first thing I go and do-- disable Blokada and reload. Once I…

Bumping this so it doesnt get lost...
Post reply on HN