Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If malware authors ever learn how to spell we're all screwed

hanselman.com

Post reply on HN
Print view View original

71–80 of 106 posts

Re: If malware authors ever learn how to spell we're all screwed

#71

Post by simonbrown »

politician wrote: post #66

A suggestion to browser vendors: add a key combo that will turn all of the screen real estate managed by your browser into yellow diagonal stripes. Then we just have to educate users to press this panic button whenever something that looks like a popup is on screen. If it's a real popup, it'll do the modal flash thing; otherwise the browser -- and everything in it -- turns yellow.

Or just tell them to switch tabs. Another sign is that if a dialog was actually showing, the browser window wouldn't look focussed.

e.g. on Windows the browser looks like this:

http://i.imgur.com/nbn9K.png

instead of this:

http://i.imgur.com/7F3FD.png

Re: If malware authors ever learn how to spell we're all screwed

#72

Post by juhanima »

csmeder wrote: post #54
kht786 wrote: post #51

Earlier quoted context omitted.

Enough users will end up using certain images such as the tiger making it worthwhile to fake a prompt.

"The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,000 images." I should have made this more clear. The ten images are chosen randomly from the group of 10,000 The question is: are there 10,000 images that are different enough people won't be fooled. Say my picture is a green house. And a prompt has a picture of a red house, will I accidentally think its the right site key? Th…

That is a fair attempt. The weak point of course is the bit of data which stores which image you chose. If the attacker is able to read that, then he can display the right image.

Re: If malware authors ever learn how to spell we're all screwed

#73

Post by tomjen3 »

gergles wrote: post #29
arriu wrote: post #16

One day these things won't be "selectable" to prove to us that they are HTML Selection is probably not the best way to check whether something is browser content... -webkit-touch-callout: none; -webkit-user-select: none; -khtml-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none;

Why does this parameter exist? What possible legitimate use could you have for disabling selection?

Games.

You don't want the user to accidentally drag your images all over the screen when he is trying to click on them (happens daily when I test the games I work on).

Re: If malware authors ever learn how to spell we're all screwed

#74

Post by gerts »

its_so_on wrote: post #14
andybak wrote: post #11

In moments of distraction I've had a couple of near-misses where I nearly clicked on malware. But when I'm trying to explain to my dad how to know what to trust and what not to trust I realise it's completely hopeless. You can fake almost everything that a non-techie would know to check.

Ever think to link to a file (e.g. excel spreadsheet) for a forum, like you can for an image with imgur? other than Dropbox public url's the services that exiist have so many images with the word "Download" in the resulting link, all of which look exactly like a UX element, that you have to click about half of them or play Sherlock Holmes to uncover the real download link. It's like a scratch-off lottery.

Or install AdBlock guiltfree because the website is obviously hostile beyond forgiveness.

Re: If malware authors ever learn how to spell we're all screwed

#75

Post by gerts »

csmeder wrote: post #50
alister wrote: post #42

The OP's point is that displayed content can be made to be indistinguishable from visual elements of the browser even for technically sophisticated users in the near future. This reminds me of login spoofing of yesteryear. How do you know if the login prompt on a shared computer or terminal is really from the OS or is a user-level program trying to steal passwords? The usual solution was to hit a special attention ke…

Easy solution. Logging in takes two passwords. After you enter your first password (first 8 chars of your 16 char password) you are presented with an image of a Tiger. You now trust the system. (The picture of a tiger was your secret image). You now enter your second password (the remaining 8 chars of your 16 digit password). See site key: http://en.wikipedia.org/wiki/SiteKey

SiteKey is completely susceptible to Man-in-the-middle (unless the user is a scrupulous cookie-manager and refuses to re-authenticate a computer more than once), so adds minimal value over regular SSL.

Re: If malware authors ever learn how to spell we're all screwed

#76

Post by huhtenberg »

csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

Oh, common.

  Username: ____
  Password: ____

  Please note that as of June 7th 2012 the system prompt
  image identification system has been deprecated and
  being replaced with new security measures.

  If you have any questions or require assistance, contact
  technical support at support@bank.com
How many tech savvy persons would not be even a bit surprised by their bank legitimately doing something as retarded as this?

Re: If malware authors ever learn how to spell we're all screwed

#78

Post by Karunamon »

shanselman wrote: post #46
Karunamon wrote: post #35

Looks like trying to move the "popup" is a great way to defeat this kind of thing for now. Me: Okay mom, if you ever get a popup that you were not expecting, try to move it outside of the browser before clicking on it. If you can't, it's fake. Fairly simple, for now.

Unless the entire image is a clickable hotspot that starts the next step in the process of their evil. ;)

Can you do that? I.e. launch events on mouse down but not a full "click"?

Re: If malware authors ever learn how to spell we're all screwed

#79

Post by huhtenberg »

avocet wrote: post #69
astral303 wrote: post #52

Earlier quoted context omitted.

Tech savvy users are not the main problem in malware. The whole SiteKey/tiger image solution only gives you an illusion of the solution. What happens when the system displays "System error, unable to display the image?" How will a convincingly-written error message prevent your average gullible or below-average competence computer user from logging in to a phishing site? Think of how many things can go wrong on a com…

Take a cue from banks, and add a "confidence word". The user enters a special phrase such as "myspecialword". If "myspecialword" does not appear in the corner of the dialog box, they will know it's fake. I doubt there would be many technical issues that would prevent a simple phrase like that from displaying in the corner of the box.

What if it shows "PHP Parse error: syntax error, unexpected T_VARIABLE in ..." where the confidence word should be? Or better yet "ConfidenceWord database is empty" - something pseudo-techy that clearly implies a temporary f#ckup on bank's side.

Re: If malware authors ever learn how to spell we're all screwed

#80

Post by jaylevitt »

mattmanser wrote: post #13
drzaiusapelord wrote: post #7

The problem is that the people who click on these also have lousy grammar and don't notice, don't care, or won't actually read all of the text. There's only so much we can do if the end user refuses to think. I suspect a lot of these people will be migrating to locked down/walled garden devices soon anyway.

One of the programs I inherited once had been written by a programmer who loved alert boxes of the form 'Are you sure you want to Delete X'. I was watching a user a month or so afterwards to notice they just pressed enter every time an alert box popped up, immediately, without reading and without thought. Alerts on computers aren't there to be read any more. They're confusing annoyances that you just click yes to. Th…

This was known 20 years ago; see e.g. the seminal UI book "About Face".
Post reply on HN