Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was seven words away from being spear-phished

robertheaton.com

Post reply on HN
Print view View original

11–20 of 187 posts

Re: I was seven words away from being spear-phished

#11

Post by adam12 »

edent wrote: post #4
DangerousPie wrote: post #2

I don't understand the point of using compromised Cambridge accounts for this. All they wanted people to do was to just click on a link. They could have easily registered some legitimate sounding domain name and linked to that instead. It wouldn't be unusual at all for an academic organisation to have a separate site.

It is a prestigious domain - with a high recognition factor. And, as part of that, it will almost never be blocked by URL / DNS filters. In this case, it clearly worked. The user saw cam.ac.uk and trusted it.

I wonder if the attackers were also thinking that these users would more likely be using macOS. The exploit they were using only works in Firefox on macOS.

Re: I was seven words away from being spear-phished

#13

Post by aziraphale »

> Neil describes his pre-university education as “High School”. We don’t have “High School” in the UK - we call it “Secondary School”. This might make sense if Neil was American, or trying to communicate with an American audience, but there’s no indication that this is the case.

Many secondary schools in the UK still have "High School" in their name. I've always used the two terms interchangeably, but maybe that's because I went to " High School", or maybe it's because I'm old.

Re: I was seven words away from being spear-phished

#14

Post by gruez »

kache_ wrote: post #6

It's always nice to get a good healthy dose of paranoia in the morning. This makes me think back to how my sec professor had a separate system that he'd use to access his online banking.

To be honest, that's probably overboard. You're pretty much never liable for fraudulent fiat transactions. Crypto on the other hand...

Re: I was seven words away from being spear-phished

#16

Post by gruez »

gdfasfklshg4 wrote: post #7
bin0 wrote: post #5

Earlier quoted context omitted.

It also means the e-mail is significantly more likely to make it past a spam filter, even an aggressive one. There was very little in that e-mail any reasonable spam filter could possibly have flagged, unless they're going to start doing API calls to grammarly. But if they check spelling and grammar, filters will start flagging a lot more than spam.

.ac.uk emails get spam filtered pretty harshly.

really? why?

Re: I was seven words away from being spear-phished

#19

Post by undecisive »

Cool post. One small nitpick:

> Neil describes his pre-university education as “High School”. We don’t have “High School” in the UK - we call it “Secondary School”

Not true at all I'm afraid. Where I'm from (Norwich) we had First / Middle / High School / (Sixth Form or college) splits, alongside other schools that did the Primary / Secondary / 6th split.

Re: I was seven words away from being spear-phished

#20

Post by Finnucane »

luckylion wrote: post #12

Is it still spear-phishing when it's not a phishing attack but an 0day? Is there a better term?

It's not clear from the article, since the author didn't (apparently) get successfully targeted, what the ultimate goal of the attack was or whether they were actually after something from a particular individual. However, it doesn't seem like a well-planned attack if that was the case.
Post reply on HN