Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If malware authors ever learn how to spell we're all screwed

hanselman.com

Post reply on HN
Print view View original

101–106 of 106 posts

Re: If malware authors ever learn how to spell we're all screwed

#101

Post by bartl »

simonbrown wrote: post #31
eridius wrote: post #5

Earlier quoted context omitted.

I thought that too, but it doesn't apply. This is malware. It doesn't need someone to be gullible beyond the click of the button. Scams, on the other hand, require actually convincing the mark to send money, which is why they need to be sure they have a gullible person on the hook.

It's their button, why would they need the user to click it? I guess it could be clickjacking, but there must be an easier way to do that.

>It's their button, why would they need the user to click it?

Because Javascript is allowed to do more, like show popup windows, if it happens in an onclick event of a button.

Re: If malware authors ever learn how to spell we're all screwed

#102

Post by zarify »

hexagonc wrote: post #88
astral303 wrote: post #52

Earlier quoted context omitted.

Tech savvy users are not the main problem in malware. The whole SiteKey/tiger image solution only gives you an illusion of the solution. What happens when the system displays "System error, unable to display the image?" How will a convincingly-written error message prevent your average gullible or below-average competence computer user from logging in to a phishing site? Think of how many things can go wrong on a com…

I use (unfortunately) Bank of America online banking and if I don't see the SiteKey or really if there is any error at all during the signon process then I leave and immediately start Googling for Bank of America security breeches in the news. If I don't find anything, then I try to login again the next day.

Not to pick on spelling in a spelling thread, but quite frankly "security breeches" sound awesome :)

Unless of course they're adult diapers for the discerning (and ageing) security professional.

Re: If malware authors ever learn how to spell we're all screwed

#103

Post by tedunangst »

juhanima wrote: post #67
FreeFull wrote: post #60

Earlier quoted context omitted.

What would prevent someone from spoofing this? (other than there being no apparent reason to spoof it)

Except for the apparent reason of fooling a user to confirm something he/she is not aware of? Anyway, asking security questions from the end user is always a bad choice. There is an excellent paper about it by Ka-Ping Yee: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.9.4... But then of course, to relieve users from the burden of making security decisions one needs the whole chain of authentication of exec…

Except you don't confirm anything. A fake UAC doesn't have any magic powers, nor can it pass your click on to the real UAC.

The problem UAC solves is that you click on a harmless dialog, but suddenly an important dialog is swapped in under your mouse. A fake UAC can't do that.

Re: If malware authors ever learn how to spell we're all screwed

#104

Post by dhughes »

mgkimsal wrote: post #86

I've suggested for years now that someone could make a killing selling copywriting services to spammers. Poor spelling, bad fonts, random crap, etc - these are all the hallmarks of spam which makes it easy to classify as spam. Well-written, intelligent-sounding, professionally-produced spam would likely get past more filters, and be harder for people to dismiss out of hand, and likely get more sales.

Here on HN or maybe it was Reddit I read the misspellings in spam/phishing were intentional to weed out anyone smart enough to detect it was a scam.

Re: If malware authors ever learn how to spell we're all screwed

#105

Post by [deleted] »

huhtenberg wrote: post #76
csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

Oh, common. Username: ____ Password: ____ Please note that as of June 7th 2012 the system prompt image identification system has been deprecated and being replaced with new security measures. If you have any questions or require assistance, contact technical support at support@bank.com How many tech savvy persons would not be even a bit surprised by their bank legitimately doing something as retarded as this?

[deleted]

Re: If malware authors ever learn how to spell we're all screwed

#106

Post by sopooneo »

avocet wrote: post #69
astral303 wrote: post #52

Earlier quoted context omitted.

Tech savvy users are not the main problem in malware. The whole SiteKey/tiger image solution only gives you an illusion of the solution. What happens when the system displays "System error, unable to display the image?" How will a convincingly-written error message prevent your average gullible or below-average competence computer user from logging in to a phishing site? Think of how many things can go wrong on a com…

Take a cue from banks, and add a "confidence word". The user enters a special phrase such as "myspecialword". If "myspecialword" does not appear in the corner of the dialog box, they will know it's fake. I doubt there would be many technical issues that would prevent a simple phrase like that from displaying in the corner of the box.

What I never understood is why an attacker couldn't just mirror the user's actions to the real site and scrape the confidence image or word from there to show on the phishing site. What am I missing?
Post reply on HN