Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If malware authors ever learn how to spell we're all screwed

hanselman.com

Post reply on HN
Print view View original

61–70 of 106 posts

Re: If malware authors ever learn how to spell we're all screwed

#61

Post by yuliyp »

johnhess wrote: post #59
csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

My bank used to do this, and I never quite understood why. An attacker could easily mimic the site's behavior. 1. Attacker prompts me (or my grandmother) for login name. 2. Attacker gives login name to bank. 3. Bank serves proper image to attacker. Attacker stores image. 4. Profit.

The mitigation for that is asking you for a security question before showing you the login image and asking for password.

Re: If malware authors ever learn how to spell we're all screwed

#62

Post by pyre »

csmeder wrote: post #50
alister wrote: post #42

The OP's point is that displayed content can be made to be indistinguishable from visual elements of the browser even for technically sophisticated users in the near future. This reminds me of login spoofing of yesteryear. How do you know if the login prompt on a shared computer or terminal is really from the OS or is a user-level program trying to steal passwords? The usual solution was to hit a special attention ke…

Easy solution. Logging in takes two passwords. After you enter your first password (first 8 chars of your 16 char password) you are presented with an image of a Tiger. You now trust the system. (The picture of a tiger was your secret image). You now enter your second password (the remaining 8 chars of your 16 digit password). See site key: http://en.wikipedia.org/wiki/SiteKey

If the user selects their 'secret image' from a known pool of images (as would probably be the case if this is at the OS-level), then the attacker just has to select one of those images (preferably a cute one) and then they know that at least some of the users they snag will have that as their security image.

Re: If malware authors ever learn how to spell we're all screwed

#63

Post by jlgreco »

yuliyp wrote: post #61
johnhess wrote: post #59

Earlier quoted context omitted.

My bank used to do this, and I never quite understood why. An attacker could easily mimic the site's behavior. 1. Attacker prompts me (or my grandmother) for login name. 2. Attacker gives login name to bank. 3. Bank serves proper image to attacker. Attacker stores image. 4. Profit.

The mitigation for that is asking you for a security question before showing you the login image and asking for password.

Can you explain how that fixes the problem? I'm not sure I understand.

Re: If malware authors ever learn how to spell we're all screwed

#64

Post by politician »

jlgreco wrote: post #63
yuliyp wrote: post #61

Earlier quoted context omitted.

The mitigation for that is asking you for a security question before showing you the login image and asking for password.

Can you explain how that fixes the problem? I'm not sure I understand.

It doesn't -- at all -- the obvious workaround is to extend the middleman game a little longer and pass the user's answer to the site.

Re: If malware authors ever learn how to spell we're all screwed

#65

Post by slovette »

jlgreco wrote: post #63
yuliyp wrote: post #61

Earlier quoted context omitted.

The mitigation for that is asking you for a security question before showing you the login image and asking for password.

Can you explain how that fixes the problem? I'm not sure I understand.

It doesn't. The entire idea is seemingly cheap and ridiculous. Digital security is going to change dramatically in the near future.

Re: If malware authors ever learn how to spell we're all screwed

#66

Post by politician »

A suggestion to browser vendors: add a key combo that will turn all of the screen real estate managed by your browser into yellow diagonal stripes.

Then we just have to educate users to press this panic button whenever something that looks like a popup is on screen. If it's a real popup, it'll do the modal flash thing; otherwise the browser -- and everything in it -- turns yellow.

Re: If malware authors ever learn how to spell we're all screwed

#67

Post by juhanima »

FreeFull wrote: post #60
recoiledsnake wrote: post #32

Earlier quoted context omitted.

You mean like the Vista and Win 7 UAC screen? http://www.micro-isv.asia/img/win7uac.png

What would prevent someone from spoofing this? (other than there being no apparent reason to spoof it)

Except for the apparent reason of fooling a user to confirm something he/she is not aware of?

Anyway, asking security questions from the end user is always a bad choice. There is an excellent paper about it by Ka-Ping Yee:

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.9.4...

But then of course, to relieve users from the burden of making security decisions one needs the whole chain of authentication of executables, access control and a trust system to dispense privileges.

EDIT: a better link to Yee's paper

Re: If malware authors ever learn how to spell we're all screwed

#68

Post by tjoff »

merraksh wrote: post #15

There's no option other than "Clean computer." No ignore, repair, quarantine. Note to malware coders: add ignore, repair, quarantine buttons that run the same code.

Instead of trying to create a fake image, why not print screen the real thing?

Re: If malware authors ever learn how to spell we're all screwed

#69

Post by avocet »

astral303 wrote: post #52
csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

Tech savvy users are not the main problem in malware. The whole SiteKey/tiger image solution only gives you an illusion of the solution. What happens when the system displays "System error, unable to display the image?" How will a convincingly-written error message prevent your average gullible or below-average competence computer user from logging in to a phishing site? Think of how many things can go wrong on a com…

Take a cue from banks, and add a "confidence word". The user enters a special phrase such as "myspecialword". If "myspecialword" does not appear in the corner of the dialog box, they will know it's fake. I doubt there would be many technical issues that would prevent a simple phrase like that from displaying in the corner of the box.

Re: If malware authors ever learn how to spell we're all screwed

#70

Post by gergles »

simonbrown wrote: post #34
gergles wrote: post #29

Earlier quoted context omitted.

Why does this parameter exist? What possible legitimate use could you have for disabling selection?

Any time you need the user to drag their mouse or double-click and don't want selections getting in the way. e.g. drag and drop

Fair enough; I hadn't even thought of someone wanting to drag-and-drop from/within a webpage. Thanks for the insight.
Post reply on HN