If malware authors ever learn how to spell we're all screwed • Hacker News Board

Re: If malware authors ever learn how to spell we're all screwed

#91

Post by aptwebapps » Sat, Jun 30, 2012, 3:26 AM UTC

johnhess wrote: post #59

csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

My bank used to do this, and I never quite understood why. An attacker could easily mimic the site's behavior. 1. Attacker prompts me (or my grandmother) for login name. 2. Attacker gives login name to bank. 3. Bank serves proper image to attacker. Attacker stores image. 4. Profit.

Yes, that type of security image is vulnerable to man-in-the-middle attacks but that is not what was proposed.

The parent poster suggested that all system messages have the security message. The user is not prompted for some sort of id first, they're already using the computer and are presumed to be logged in.

This is the right way to use security images, IMO, although they're still not perfect as others in the thread have pointed out. The way you describe, which I believe BoA uses (just hearsay), is bad security.

Re: If malware authors ever learn how to spell we're all screwed

#92

Post by bbrtyth » Sat, Jun 30, 2012, 6:17 AM UTC

Malware authors have learned to spell -- many apps I install under the mistaken assumption that they will not run background services or send information back to the company, in fact do.

I also note that Dell's laptop division has a number of malware authors hard at work.

Re: If malware authors ever learn how to spell we're all screwed

#93

Post by pbz » Sat, Jun 30, 2012, 6:36 AM UTC

huhtenberg wrote: post #79

avocet wrote: post #69

Earlier quoted context omitted.

Take a cue from banks, and add a "confidence word". The user enters a special phrase such as "myspecialword". If "myspecialword" does not appear in the corner of the dialog box, they will know it's fake. I doubt there would be many technical issues that would prevent a simple phrase like that from displaying in the corner of the box.

What if it shows "PHP Parse error: syntax error, unexpected T_VARIABLE in ..." where the confidence word should be? Or better yet "ConfidenceWord database is empty" - something pseudo-techy that clearly implies a temporary f#ckup on bank's side.

Hopefully they have a better system so that if anything breaks on the page, the returned result is an error page / code.

Re: If malware authors ever learn how to spell we're all screwed

#94

Post by unimpressive » Sat, Jun 30, 2012, 7:04 AM UTC

fghh45sdfhr3 wrote: post #48

Nah, you're already screwed. If you get to the point of the pop-up it is already too late.

Don't see why this was downvoted. Once your opponent is executing arbitrary JavaScript on your browser, there's no real reason for them to try tricking you into clicking a link when they can just use one of the outstanding security vulnerabilities for your browser to install malware.

Re: If malware authors ever learn how to spell we're all screwed

#95

Post by zck » Sat, Jun 30, 2012, 7:16 AM UTC

pbz wrote: post #93

huhtenberg wrote: post #79

Earlier quoted context omitted.

What if it shows "PHP Parse error: syntax error, unexpected T_VARIABLE in ..." where the confidence word should be? Or better yet "ConfidenceWord database is empty" - something pseudo-techy that clearly implies a temporary f#ckup on bank's side.

Hopefully they have a better system so that if anything breaks on the page, the returned result is an error page / code.

The problem is not if the bank's site breaks; the problem is what happens when a phishing site displays "error: connection to ConfidenceWord database failed". What percentage of users will say "oh, the bank's site is messed up; let's go in anyway"? A high percentage.

Re: If malware authors ever learn how to spell we're all screwed

#96

Post by johnchristopher » Sat, Jun 30, 2012, 8:50 AM UTC

zck wrote: post #95

pbz wrote: post #93

Earlier quoted context omitted.

Hopefully they have a better system so that if anything breaks on the page, the returned result is an error page / code.

The problem is not if the bank's site breaks; the problem is what happens when a phishing site displays "error: connection to ConfidenceWord database failed". What percentage of users will say "oh, the bank's site is messed up; let's go in anyway"? A high percentage.

I hardly believe any technical solutions on the bank's website is going to prevent any phishing sites to mimick it. People have to learn to recognize phishing sites and electronic communications phishing tactics just like they have to learn to spot fake ATM.

Frankly, I believe it's not something you can make happen. I remember a story here not long ago about honeypots in China and businessmen getting full briefing and warnings by the MI5 before leaving the UK and some would still leave their computers and smartphones powered on near the bed. I think it's the same with some users: they just don't learn and never will (I have another theory that states they don't want to learn anything about computers and that it should magically read their minds but I always end up cursing when I try to explain it and besides it's not the point :).

Re: If malware authors ever learn how to spell we're all screwed

#97

Post by taejo » Sat, Jun 30, 2012, 9:42 AM UTC

The spelling heuristic doesn't work very well in much of the world. I live in a country where English is the primary language of commerce, government, etc. but only very few people (I think less than 5%) speak it at home. So the people writing the genuine banking websites, etc. are almost as likely to make mistakes as the phishers.

Re: If malware authors ever learn how to spell we're all screwed

#98

Post by Deestan » Sat, Jun 30, 2012, 10:33 AM UTC

huhtenberg wrote: post #76

csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

Oh, common. Username: ____ Password: ____ Please note that as of June 7th 2012 the system prompt image identification system has been deprecated and being replaced with new security measures. If you have any questions or require assistance, contact technical support at support@bank.com How many tech savvy persons would not be even a bit surprised by their bank legitimately doing something as retarded as this?

I wouldn't be surprised.

Some fairly large banks here in Norway have at times ran with a not-completely-valid SSL certificate - making the bank login indistinguishable from a man-in-the-middle.

Answer from their phone support? "Oh yeah whenever you see that warning, just click 'allow' or 'ignore'."

Re: If malware authors ever learn how to spell we're all screwed

#99

Post by Deestan » Sat, Jun 30, 2012, 10:43 AM UTC

hxa7241 wrote: post #18

Never respond. Always take the initiative. If something asks you about update/downloading/etc., reject it. You decide what to do and when, and you type the URL into the browser, or go to the normal menu/dialog/tool for updating. (This is partly why Chrome browser is right and the normal approach is wrong: if/when it needs update, it just does it.)

I think you're really on to something here. A root problem of this is that a lot of legitimate software communicate via random popups out of the blue - training users to just "do what the computer says".

People are used to the computer being in charge and commanding them. This is bad from a UX point of view, but now I see it also affects security.

Yet another reason popups of all kinds should be forbidden.

When all application-initiated communication come from the OS notification area, this kind of dialog will make people wary. Which is a win.

Re: If malware authors ever learn how to spell we're all screwed

#100

Post by morsch » Sat, Jun 30, 2012, 12:32 PM UTC

nixterrimus wrote: post #44

gergles wrote: post #29

Earlier quoted context omitted.

Why does this parameter exist? What possible legitimate use could you have for disabling selection?

I've thought about this quite a bit. As HTML applications continue to evolve we should make them feel "appish". Things like selectable buttons take the user away from experience the app. Also graph labels shouldn't be selectable. One of the big ideas of the web is selectable content. However UI elements shouldn't be included in this set. I've written a little more about this (with some screenshots to illustrate my th…

I disagree completely.

For the Github example, you want to disable selecting the file list header and, bizarrely, you tend towards disabling selecting the file list itself. Considering the files and their meta information are Github's content, disabling copy-pasting file names and commit messages is incomprehensible to me -- that's the last thing I'd consider disabling. And if I want to copy/paste the entire file list, I might want to copy the list header along with it for the benefit of the recipient. I wouldn't disable the selection on anything on your Github example.

The graph label example is just as strange. I tried the linked Morris.js example, and I can't select the label text. How is that a better user experience? What if I want to IM a friend the 2011 Q3 numbers? What if I want to search for similar data? Both quintessential web actions.

I think braking selection is almost as bad as breaking the back key, the cardinal sin of web apps.