Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If malware authors ever learn how to spell we're all screwed

hanselman.com

Post reply on HN
Print view View original

21–30 of 106 posts

Re: If malware authors ever learn how to spell we're all screwed

#21

Post by txo »

eridius wrote: post #5
mseebach wrote: post #3

Probably an instance of this? [T]he obvious giveaways are used as a pre-qualifier, to ensure with the least possible effort that the ONLY people who respond to the scammers' initial mass mailings (and therefore have to be brought along individually during the later stages) are the absolutely most gullible, ignorant, susceptible, suckers they can find. http://www.quora.com/Scams/Why-are-email-scams-written-in-br...

I thought that too, but it doesn't apply. This is malware. It doesn't need someone to be gullible beyond the click of the button. Scams, on the other hand, require actually convincing the mark to send money, which is why they need to be sure they have a gullible person on the hook.

But they do, most of these malware scams involve the user going to their website and buying their special malware removal tool.

Re: If malware authors ever learn how to spell we're all screwed

#22

Post by tlrobinson »

I forget what the term for it is, but there's a principle that any dialog that's asking the user for credentials or authorization must be clearly delineated from the rest of the UI and thus "unspoofable".

The example I recall was a "ribbon" in the OS that slide out to reveal the dialog. If a dialog presented itself but the ribbon remained along the edge you could immediately tell it was spoofed. Of course this requires the OS not allow untrusted code to reposition/hide the ribbon or present a full screen display without prompting the user.

Another example is iOS grays out the background (including status bar at the top) when presenting a modal password prompt. However this could easily be spoofed by a full screen native app. The only way to solve that is to require authorization to enter full screen mode.

Browsers are improving. At least Chrome shows the URL at the top of all popup windows. Entering full screen mode requires user authorization.

That of course doesn't solve the OP's problem of spoofing a floating window purely inside a webpage, but that really needs to be solved at the OS level.

Re: If malware authors ever learn how to spell we're all screwed

#25

Post by eridius »

txo wrote: post #21
eridius wrote: post #5

Earlier quoted context omitted.

I thought that too, but it doesn't apply. This is malware. It doesn't need someone to be gullible beyond the click of the button. Scams, on the other hand, require actually convincing the mark to send money, which is why they need to be sure they have a gullible person on the hook.

But they do, most of these malware scams involve the user going to their website and buying their special malware removal tool.

Once you've actually infected a computer with malware it's a heck of a lot easier to convince the person to pay money to get rid of it.

Re: If malware authors ever learn how to spell we're all screwed

#27

Post by tterrace »

arriu wrote: post #16

One day these things won't be "selectable" to prove to us that they are HTML Selection is probably not the best way to check whether something is browser content... -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none;

Yup, also you can use a css background-image rather than an html img tag.

Re: If malware authors ever learn how to spell we're all screwed

#28

Post by juhanima »

tlrobinson wrote: post #22

I forget what the term for it is, but there's a principle that any dialog that's asking the user for credentials or authorization must be clearly delineated from the rest of the UI and thus "unspoofable". The example I recall was a "ribbon" in the OS that slide out to reveal the dialog. If a dialog presented itself but the ribbon remained along the edge you could immediately tell it was spoofed. Of course this requir…

The term would be trusted path.

http://en.wikipedia.org/wiki/Trusted_path

EDIT: Also: spot on! I thought browser induced popups would have a clear signature of where they came from. Obviously this is not the case any more.

Re: If malware authors ever learn how to spell we're all screwed

#29

Post by gergles »

arriu wrote: post #16

One day these things won't be "selectable" to prove to us that they are HTML Selection is probably not the best way to check whether something is browser content... -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none;

Why does this parameter exist? What possible legitimate use could you have for disabling selection?

Re: If malware authors ever learn how to spell we're all screwed

#30

Post by CamperBob2 »

robert_nsu wrote: post #2

He's right. Most of the time, the things that tip me off are the misspelled words and poor grammar; also, the conflicting information. For example, getting an email message from Chase Bank with a signature from a Wells Fargo employee. A lot of people are one well versed phisher from losing a lot of time and money.

There was a story on HN not too long ago where a stereotypical 419 scammer explained why the schemes haven't gotten more sophisticated. Basically, it's a waste of time and resources targeting people who aren't either senile, naive, highly religious, or just plain morons. Using proper grammar and a well-thought-out background story will just bring your scam to the attention of people who might have the ability to investigate or otherwise interfere with it.

Put another way, if you want to steal a million dollars, do it by stealing $100 from 10,000 people. Much safer than stealing $100,000 from 10 people.

Post reply on HN