Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The golden age of scammers: AI-powered phishing

mailgun.com

Post reply on HN
Print view View original

61–70 of 143 posts

Re: The golden age of scammers: AI-powered phishing

#61

Post by CM30 »

salviati wrote: post #43
kagevf wrote: post #39

I expect that with AI, we'll be less able to rely on the heuristic of bad grammar to easily detect phishing. That one flaw gave the phishers away so often, and made it so obvious ...

The bad grammar is on purpose. I know of two possible reasons: * Bayesian poisoning https://en.wikipedia.org/wiki/Bayesian_poisoning * Weeding out poor mark candidates https://josephsteinberg.com/why-scammers-make-spelling-and-g...

I see this a lot, but it seems hard to verify. Has a scammer actually ever come out and say they deliberately use poor grammar? Would be interesting to compare scam emails/messages from scammers based in the US/UK/Australia with those in India or Nigeria, and see if the pattern holds up for both.

Re: The golden age of scammers: AI-powered phishing

#62

Post by nonrandomstring »

nottorp wrote: post #59

> Is it your fate now to do due diligence on every email you receive? Always has been. Tbh the browser/email client makers are complicit in these phishing attempts for hiding the URLs and the actual email addresses. Put them back!

> Tbh the browser/email client makers are complicit in these phishing attempts for hiding the URLs and the actual email addresses.

It's worse. Research "Scamicry".

Big business now is so fake, such a grift, drenched in PR deception, and lacking integrity and trustworthiness, there isn't much space left between what is "legitimate" and what is a scam.

If businesses like Google or Facebook hide URLs and email addresses that's not a casual "mistake". It's because that's to their profitable advantage to do so. And they know it puts you in harms way. So yes, they're complicit in scams.

To make themselves a little more competitive businesses are always learning from scammers, meanwhile good scammers keenly learn from businesses to look more legit. Some ransomware "services" even have better customer support than billion dollar companies. And big business is certainly using the same AI tools as cybercriminals.

So a problem isn't how clever and scurrilous scammers have gotten, it's how far legitimate services have fallen so that ordinary folk struggle to know the difference.

How can we trust our own insticts for selecting what is good and wholesome from what is rotten, when there are few moral differences? The only difference resides in a digital identifier.

Re: The golden age of scammers: AI-powered phishing

#64

Post by rsanek »

Calamityjanitor wrote: post #33
WesternWind wrote: post #2

Hey, just going to say what I've been telling folks IRL, if you are reading this, and your parents and family members aren't tech savvy, you need to set them up with two factor authentication now. Because you know how to do that, and it's so much easier than helping them when they get hacked.

MFA doesn't stop this kind of phishing. If you're tricked to put in your password, you'll likely put in your 2FA code right after. A yubi key or device passkey that uses webauthn can stop these methods, since the domain seeking authentication is checked and won't authenticate unless it's the original domain. Even then, that won't help scams and fraud that just trick you into sending money, or direct you to install ma…

surely it won't hurt. at minimum, it makes the attacker's job much harder -- their window to exploit becomes max 30 seconds instead of however long you don't change your password.

Re: The golden age of scammers: AI-powered phishing

#65

Post by lukan »

backspace_ wrote: post #49
6510 wrote: post #12

Earlier quoted context omitted.

For laughs

Now they have a recording of you saying yes that can used to justify signing you up for services that you never intended to.

That "yes" for other services cam be contested easily, though, without ever paying anything. It is still stress I would avoid.

Re: The golden age of scammers: AI-powered phishing

#66

Post by psychoslave »

feverzsj wrote: post #63

Artificial Intelligence vs. Actually Indian

I was called by an Indian like ten years ago, trying to convince me to follow some script obviously made for Windows when at the time I already hadn’t a Windows box for quite some time. Fun moment, in that specific case.

Probably the funniest thing here is that this call reached me despite the fact that I am French, living in France. And so I really wonder how they ended up calling me. I mean, chance I would understand some English speaker with an Indian accent (I like how it sounds, but it’s definitely an additional difficulty as a non-native).

I read here and there how extortion of old USA citizens by some organized Indian citizens is really a thing. To my mind the main issue at stake is that we have global level communication facilities, extremely high wealth disparities at world scale, and no compelling global social endeavor to reach an harmonization of human quality of life for everyone. I don’t mean the latter is on the official agenda of most countries out there either, but at global scale it’s obviously even worst.

With all that in mind, blaming a whole nation for the illegitimate actions of some minority in the country, all the more when the international geopolitical context itself is all but fair, is probably not going to solve any issue.

Re: The golden age of scammers: AI-powered phishing

#67

Post by greyrouting »

Why don’t US phone carriers give their users the ability to block foreign calls terminating in the U.S., at the telephony signaling layer? In almost no case do I ever want to receive a phone call from a foreign country with a spoofed number. Nor do I think anyone in my family wants to either.

Re: The golden age of scammers: AI-powered phishing

#68

Post by mnau »

jimmaswell wrote: post #27
advael wrote: post #22

Earlier quoted context omitted.

I mean SSNs are the worst possible authentication mechanism and yet we still have to freak out every time they're leaked. Security practices are so utterly backwards everywhere that it's quite apparent no one powerful is incentivised to care even a little bit

what's the practical alternative?

Digital id card for every citizen? My id card can prove identity or sign a document and could for ~10 years. Estonia had it for over 20 years.

Just give it to everyone. Today, it can likely be embedded in a cell phone instead of separate physical card.

Re: The golden age of scammers: AI-powered phishing

#69

Post by Kiro »

jimmaswell wrote: post #27
advael wrote: post #22

Earlier quoted context omitted.

I mean SSNs are the worst possible authentication mechanism and yet we still have to freak out every time they're leaked. Security practices are so utterly backwards everywhere that it's quite apparent no one powerful is incentivised to care even a little bit

what's the practical alternative?

What do you mean? I don't know of any country except the US where SSN is used for authentication. In my country SSN is public information.

Re: The golden age of scammers: AI-powered phishing

#70

Post by Calamityjanitor »

rsanek wrote: post #64
Calamityjanitor wrote: post #33

Earlier quoted context omitted.

MFA doesn't stop this kind of phishing. If you're tricked to put in your password, you'll likely put in your 2FA code right after. A yubi key or device passkey that uses webauthn can stop these methods, since the domain seeking authentication is checked and won't authenticate unless it's the original domain. Even then, that won't help scams and fraud that just trick you into sending money, or direct you to install ma…

surely it won't hurt. at minimum, it makes the attacker's job much harder -- their window to exploit becomes max 30 seconds instead of however long you don't change your password.

Tools like evilnginx proxy the traffic, then grab the auth token / cookie after a successful login. From there you can send the session tokens to something like necrobrowser to automatically do whatever you want with the account. The whole hack can happen in seconds.
Post reply on HN