Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was seven words away from being spear-phished

robertheaton.com

Post reply on HN
Print view View original

81–90 of 187 posts

Re: I was seven words away from being spear-phished

#81

Post by jjoonathan »

matthewowen wrote: post #33

The specifics of this - the request to judge a prize one is clearly unqualified for - are we as software engineers particularly vulnerable to? Most people would, I think, conclude "this is fake, because why would I be asked to do this?". But I often think that as software engineers we fancy ourselves to have more insight into other fields than we really do. Does this ring true to anyone else?

Nearly every contest I've ever competed in has had judges who I didn't believe were vigorously qualified. Perhaps not in the final round, or in the most competitive sections, but they were there, somewhere, filling in the gaps. On the other side of the equation, I regularly got "please judge this contest" emails I wasn't qualified for while I was still in academia.

Falling for this phish woudln't need to be a matter of inflating one's opinion of oneself, it could simply happen by knowing that at the low end of contests, the bar for judging is low.

Re: I was seven words away from being spear-phished

#82

Post by wutbrodo »

davb wrote: post #48
scotchmi_st wrote: post #34

This is a fascinating story. It's funny though how, with compromised accounts at a highly reputable university and a 0-day exploit in one of the most-used pieces of software out there, they still managed to make basic grammatical errors in their phishing email. I mean, these people were clearly not messing around. Their attack(s) were highly targeted. And yet they still didn't check their written english! If it hasn'…

I once read a theory that poor grammar, particularly with 419 scams, acts as a sort of gullibility filter where only the most susceptible targets will respond.

Yup, it was a Microsoft Research paper IIRC. That's more applicable to scams that cast a wide net to avoid investing resources on savvier targets in the second, more labor-intensive phase. I don't think it would be too relevant to spear-phishing like this case where the resources are already invested in step 1.

Re: I was seven words away from being spear-phished

#83

Post by stordoff »

DangerousPie wrote: post #2

I don't understand the point of using compromised Cambridge accounts for this. All they wanted people to do was to just click on a link. They could have easily registered some legitimate sounding domain name and linked to that instead. It wouldn't be unusual at all for an academic organisation to have a separate site.

_Any_ other domain, and I'm just going to ignore it. A legitimate *.ac.uk domain, and there's a good chance I will click it to find out what it is, even if I don't believe it. At that point, they've won (it's a 0-day).

Using a recognisable domain lets my guard down just enough ("there's no risk in going to a cam.ac.uk domain") for an attack like this to work.

Re: I was seven words away from being spear-phished

#84

Post by wutbrodo »

matthewowen wrote: post #33

The specifics of this - the request to judge a prize one is clearly unqualified for - are we as software engineers particularly vulnerable to? Most people would, I think, conclude "this is fake, because why would I be asked to do this?". But I often think that as software engineers we fancy ourselves to have more insight into other fields than we really do. Does this ring true to anyone else?

> Does this ring true to anyone else

Not to me, and that jumped out at me as the most bizarre part of the story. I have a lot more of an economics background than "having read some Paul Krugman articles", but I'd think that this was obviously a scam because there's no way in hell that that anyone in the world would think I should be judging a competition on economics.

Re: I was seven words away from being spear-phished

#85

Post by fwip »

albertgoeswoof wrote: post #71
tempodox wrote: post #65

Systematic dropping of definite article makes me suspect the author may be a native speaker of some eastern language with limited knowledge of English.

It’s odd that they would have limited knowledge of English yet understand the prestige of Cambridge, be able to create genuine looking linkedin pages and target the attack so well. If you’re going to that much trouble running a spell checker over he email would seem like a reasonable step? Most likely it’s a deliberate attempt to target people who are excited enough by the email to not notice the grammar.

Foreign language speakers aren't stupid. You can Google "famous school England" in any language.

There's no "second step" to this con. You don't have to get tricked into wiring them money. If you visit the page, you lose.

Re: I was seven words away from being spear-phished

#86

Post by fwip »

gruez wrote: post #17
luckylion wrote: post #12

Is it still spear-phishing when it's not a phishing attack but an 0day? Is there a better term?

AFAIK spear phishing refers to the fact that the attack is tailored/targeted, rather than mass mailings.

It doesn't really seem that targeted, just tailored. If they'd only emailed people who used crypto, that might be spear phishing.

Edit: nevermind, I didn't realize he worked on coinbase.

Re: I was seven words away from being spear-phished

#88

Post by stordoff »

> Looking back it’s obviously completely absurd that the University of Cambridge would ask me to judge an economics competition

I don't think this really matters all that much. I might click the link anyway to find out what it is, or to find out why I am allegedly being considered, or even just out of general curiosity. It doesn't _stop_ the attack from working.

Re: I was seven words away from being spear-phished

#89

Post by CPLX »

ryandrake wrote: post #79
CPLX wrote: post #57

Earlier quoted context omitted.

That's just really not true. Especially not in a professional setting. I deal with this personally all the time, as the founder of a national conference series. We reach out to people cold all the time and invite them to prominent speaking roles. Sometimes people are surprised to hear from us or don't think of themselves as public speakers but we're most certainly real and serious. I get it the other way all the time…

As is true for most HN posts, I should have prefaced with “In most but not all cases...” People who do not happen to be conference organizers or frequent recipients of legitimate cold calls should, in most cases, ignore unsolicited messages from strangers.

Or business development executives. Or freelancers. Or journalists. Or academics.

Or like anyone who has some level of networking as part of their job. Which is a lot of people.

The point being that most people need a better system than "ignore every email that you get from a new contact".

Re: I was seven words away from being spear-phished

#90

Post by sireat »

veeti wrote: post #75
larrik wrote: post #60

Earlier quoted context omitted.

Chrome had a nasty one back in March, so your presumption seems correct. Really, the best way to protect yourself is to use an obscure OS, or a separate machine for web browsing. Sounds paranoid, but the web is THE main attack vector these days.

Or disable JavaScript, which is the cause of most RCE exploits.

Do you mean whitelist JavasScript to known good sites?

HN is about the only site that I frequent that is usable without JS.

The progressive enhancement ship has sailed into abyss.

Post reply on HN