Ask HN: Google Chrome heuristic warnings pose threat to our business • Hacker News Board

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#41

Post by tteam » Mon, Jul 01, 2013, 6:08 PM UTC

coverband wrote: post #39

Filecloud wrote: post #26

Earlier quoted context omitted.

We have checked with one of the latest beta builds. In that build it didn't show the warning. It happens with the live chrome version. The issue is much more complex.

On a Mac with current Chrome (Version 27.0.1453.116) hitting your sample dev URL, I don't get any errors at all...

This specific instance in the screenshot has been fixed (this is the second time). Basically, in this specific instance if the "Login" button is changed to localize to a specific keyword "Connexion" as part of french translation, it shows up. No other keyword triggers it.. and no way to find out what the heck chrome wants.

It is like playing proverbial whack-a-mole. Every update of chrome can potentially change their "heuristic" that thinks it has "found" a phishing attack.. and we have to scramble to see what the heck caused it and fix it.

This would be funny if it wasn't so detrimental to a business. I will get the dev to recreate this on dev1 and post it.

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#42

Post by ctz » Mon, Jul 01, 2013, 6:09 PM UTC

pyvek wrote: post #25

I opened http://dev1.codelathe.com/ui/core/index.html (URL in your screenshot) in Chrome (latest) but I'm not getting any phishing warning.

I opened the same URL and did get a phishing warning. Version 27.0.1453.116 m on Windows 7 x64.

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#43

Post by markshepard » Mon, Jul 01, 2013, 6:11 PM UTC

coverband wrote: post #39

Filecloud wrote: post #26

Earlier quoted context omitted.

We have checked with one of the latest beta builds. In that build it didn't show the warning. It happens with the live chrome version. The issue is much more complex.

On a Mac with current Chrome (Version 27.0.1453.116) hitting your sample dev URL, I don't get any errors at all...

It shows up now on Version 27.0.1453.116

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#44

Post by markshepard » Mon, Jul 01, 2013, 6:12 PM UTC

blauwbilgorgel wrote: post #12

Filecloud wrote: post #10

Earlier quoted context omitted.

Unfortunately we have done all that. It is not a domain issue or safe browsing issue. The best analogy here is let us say lot of customers run a default drupal or joomla site under their domain and Google chrome show these sites as phishing site.

Please host the HTML source of a page that throws a warning somewhere. And mention the version of Chrome that gave the warning ( chrome://chrome/ ). Also can you post the thread on the Google forums with a proper bug report? I can't find it.

Try http://dev1.codelathe.com

Shows up now with Chrome v27.0.1453.116

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#45

Post by markshepard » Mon, Jul 01, 2013, 6:14 PM UTC

mgevans wrote: post #32

I just ran into this with some pages in our product as well. If you run Chrome with '--enable-logging --v=2' the chrome_debug.log will contain messages from the phishing classifier (search for 'phishing_classifier'). I was able to tweak the wording on the page to drop the score below 0.5, but there are other features that may be causing your problem. You may need to restart the browser between edits, as it seems to c…

Very nice! This will actually be very helpful in tracking this. Thank you.

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#46

Post by swalkergibson » Mon, Jul 01, 2013, 6:14 PM UTC

pyvek wrote: post #25

I opened http://dev1.codelathe.com/ui/core/index.html (URL in your screenshot) in Chrome (latest) but I'm not getting any phishing warning.

I received the warning. Chrome 26.

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#47

Post by markshepard » Mon, Jul 01, 2013, 6:17 PM UTC

pyvek wrote: post #25

I opened http://dev1.codelathe.com/ui/core/index.html (URL in your screenshot) in Chrome (latest) but I'm not getting any phishing warning.

It has now been patched to throw the error. It shows up now on Version 27.0.1453.116

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#48

Post by olalonde » Mon, Jul 01, 2013, 6:43 PM UTC

If you are lucky, Matt Cutts (https://news.ycombinator.com/user?id=Matt_Cutts) will read this and investigate with the Chrome team.

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#49

Post by markshepard » Mon, Jul 01, 2013, 6:46 PM UTC

markshepard wrote: post #45

mgevans wrote: post #32

I just ran into this with some pages in our product as well. If you run Chrome with '--enable-logging --v=2' the chrome_debug.log will contain messages from the phishing classifier (search for 'phishing_classifier'). I was able to tweak the wording on the page to drop the score below 0.5, but there are other features that may be causing your problem. You may need to restart the browser between edits, as it seems to c…

Very nice! This will actually be very helpful in tracking this. Thank you.

Here is the output snippet. Basically some "algorithm" thinks it has found phishyness with some score above 0.5 and flags it. No clue as to what caused it (We know that it can be triggered by simply changing the name of the "Login" button to "Connexion"!!

Must be nice to dream up some "algorithm" and push it out.. sigh

[5570:1799:0701/133949:VERBOSE1:client_side_detection_host.cc(221)] Instruct renderer to start phishing detection for URL: http://dev1.codelathe.com/ui/core/index.html [5579:1799:0701/133949:VERBOSE2:phishing_classifier_delegate.cc(238)] Not starting classification, no Scorer created. [5579:1799:0701/133950:VERBOSE2:phishing_classifier_delegate.cc(238)] Not starting classification, no Scorer created. [5570:1799:0701/133954:VERBOSE2:client_side_detection_service.cc(255)] Sending phishing model to RenderProcessHost @0x7aa18a00 [5570:1799:0701/133954:VERBOSE2:client_side_detection_service.cc(255)] Sending phishing model to RenderProcessHost @0x8043d620 [5579:1799:0701/133954:VERBOSE2:phishing_classifier_delegate.cc(283)] Starting classification for http://dev1.codelathe.com/ui/core/index.html [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlTld=com = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageImgOtherDomainFreq = 0 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlOtherHostToken=dev1 = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlPathToken=html = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageLinkDomain=tonido.com = 1 [5574:1799:0701/133954:VERBOSE2:phishing_classifier_delegate.cc(275)] Not starting classification, last url from browser is , last finished load is chrome-extension://jpjpnpmbddbjkfaccnmhnkdgjideieim/background.html [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlPathToken=core = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageTerm=password = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageHasTextInputs = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageExternalLinksFreq = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageHasPswdInputs = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageSecureLinksFreq = 0 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageTerm=connexion = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlDomain=codelathe = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: UrlPathToken=index = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageTerm=account = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageHasForms = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageNumScriptTags>1 = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier.cc(192)] Feature: PageNumScriptTags>6 = 1 [5579:1799:0701/133954:VERBOSE2:phishing_classifier_delegate.cc(211)] Phishy verdict = 1 score = 0.548927 [5570:1799:0701/133954:VERBOSE2:client_side_detection_host.cc(447)] Feature extraction done (success:1) for URL: http://dev1.codelathe.com/ui/core/index.html. Start sending client phishing request. [5570:1799:0701/133954:VERBOSE2:client_side_detection_host.cc(415)] Received server phishing verdict for URL:http://dev1.codelathe.com/ui/core/index.html is_phishing:1 [5570:1799:0701/133954:VERBOSE2:client_side_detection_service.cc(255)] Sending phishing model to RenderProcessHost @0x802b7ff0 [5580:1799:0701/133954:VERBOSE2:phishing_classifier_delegate.cc(259)] Toplevel URL is unchanged, not starting classification.

Re: Ask HN: Google Chrome heuristic warnings pose threat to our business

#50

Post by alternize » Mon, Jul 01, 2013, 6:58 PM UTC

markshepard wrote: post #49

markshepard wrote: post #45

Earlier quoted context omitted.

Very nice! This will actually be very helpful in tracking this. Thank you.

Here is the output snippet. Basically some "algorithm" thinks it has found phishyness with some score above 0.5 and flags it. No clue as to what caused it (We know that it can be triggered by simply changing the name of the "Login" button to "Connexion"!! Must be nice to dream up some "algorithm" and push it out.. sigh [5570:1799:0701/133949:VERBOSE1:client_side_detection_host.cc(221)] Instruct renderer to start phis…

most probably "connexion" in relation to "password" was used in an unrelated (english?) phishing attempt.

mixing different languages might be bad. try changing all the page text (and corresponding content-language header) to the localized language instead of just changing the submit button. maybe this have the classifier use the contextual meaning of "connexion".