Live data from Hacker News

The golden age of scammers: AI-powered phishing

mailgun.com

51–60 of 143 posts

Re: The golden age of scammers: AI-powered phishing

#51
post #11
post #8

Earlier quoted context omitted.

When I typed my phone number in the box on "Musk" "investment" website my landline rang instantly after entering the last digit. It was definitely an onkeydown event. A friendly fast talking man in an extremely busy sounding (fake) call center asked me if I was $name_I_put_in_the_form. The voices in the background were people further down the sign up process. I said yes, then asked how he got my number. He said I jus…

It sounds like you confuse easily?

[deleted]

Re: The golden age of scammers: AI-powered phishing

#52

Earlier quoted context omitted.

They shut them down pretty much right away, but they pop back up right away too. And they usually viewbot to the top of the front page. Seems like a fairly simple thing to solve though, limit ages of accounts needed to be featured etc

I wouldn't be surprised if alot of the viewbots are using the same pool of IP addresses. Blocking VPNs, VPSes, tor, and ranges with large amounts of bans would probably help. On the other hand, twitch keeps firing employees, so they probably just ban the stream account every 20 minutes because they don't have the manpower.

There are a ton of sketchy browser plugins that form VPN relay networks.

I would be very surprised if they are not using a new, clean residential IP on a US ISP for each and every account.

Re: The golden age of scammers: AI-powered phishing

#53

The section “Recognizing AI phishing attempts” is mournfully short, but there’s some companies out there like Jericho Security ( https://www.jerichosecurity.com ) that are working on countermeasures, at least for enterprises.

I’m skeptical we can develop effective ones, due to the fact that we have been unable to solve non-AI phishing problems but I welcome their attempt.

When Google added Yubikeys it reduced phishing internally to zero.

https://krebsonsecurity.com/2018/07/google-security-keys-neu...

I adore my Yubikey.

Re: The golden age of scammers: AI-powered phishing

#54
post #39

I expect that with AI, we'll be less able to rely on the heuristic of bad grammar to easily detect phishing. That one flaw gave the phishers away so often, and made it so obvious ...

It goes the other way now, overly verbose responses and perfect grammar sets off the warning bells.

They'll adapt. You can easily ask chat4 to make it sound "less formal" or "more teenager"

Re: The golden age of scammers: AI-powered phishing

#55
post #12

Earlier quoted context omitted.

For laughs

Now they have a recording of you saying yes that can used to justify signing you up for services that you never intended to.

Could also be used to generate his voice and scam his relatives.

Re: The golden age of scammers: AI-powered phishing

#56
post #39

I expect that with AI, we'll be less able to rely on the heuristic of bad grammar to easily detect phishing. That one flaw gave the phishers away so often, and made it so obvious ...

The bad grammar is on purpose. I know of two possible reasons: * Bayesian poisoning https://en.wikipedia.org/wiki/Bayesian_poisoning * Weeding out poor mark candidates https://josephsteinberg.com/why-scammers-make-spelling-and-g...

I suspect it's a compromise. Entertaining a target with high literacy skills is more work. If you have AI that is excellent at communication, there goes one reason to aim low.

Re: The golden age of scammers: AI-powered phishing

#60
post #59

> Is it your fate now to do due diligence on every email you receive? Always has been. Tbh the browser/email client makers are complicit in these phishing attempts for hiding the URLs and the actual email addresses. Put them back!

Also the URL "security scanner" things on corporate email systems. The user can't see the URL by hovering over it.
Post reply on HN