The fake browser update scam gets a makeover

#1

Post by feross » Wed, Oct 18, 2023, 4:02 PM UTC

The fake browser update scam gets a makeover
krebsonsecurity.com

Re: The fake browser update scam gets a makeover

#2

Post by keane » Wed, Oct 18, 2023, 4:39 PM UTC

The quality of full screen takeover pages seems to have dramatically risen recently. My family members, who don’t know the Escape key exists, accidentally click one from a banner ad every week now taking them to a page like examplefoobar38561.cloudfront.net and the use of elements that imitate browser or OS chrome (generally imitating Windows Defender or similar) has reached near perfection. All browsers should have a setting to permanently block full screen mode for all sites (not “ask”).

Re: The fake browser update scam gets a makeover

#3

Post by TeMPOraL » Wed, Oct 18, 2023, 4:50 PM UTC

keane wrote: post #2

The quality of full screen takeover pages seems to have dramatically risen recently. My family members, who don’t know the Escape key exists, accidentally click one from a banner ad every week now taking them to a page like examplefoobar38561.cloudfront.net and the use of elements that imitate browser or OS chrome (generally imitating Windows Defender or similar) has reached near perfection. All browsers should have…

Maybe one of these days scammers will release their UI elements as web components or React whatever, so we'll finally get some high-quality JS versions of native UI elements; maybe we could get Electron app developers to use them.

Re: The fake browser update scam gets a makeover

#4

Post by sysadm1n » Wed, Oct 18, 2023, 4:51 PM UTC

Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessibility reasons, and, malware issues in the browser.

This attack can still be pulled off without JS though: using plain old CSS & HTML. It seems these attacks are targeted to the non tech savvy, but even I (tech savvy) get duped by persuasive messages in my browser. This is why I advocate for a Phishing/Malware 101 course which is mandatory for all types of tech-related courses and learning.

Re: The fake browser update scam gets a makeover

#5

Post by tempodox » Wed, Oct 18, 2023, 4:57 PM UTC

Yet again the crypto crap has proven its utility for doing shady shit.

Re: The fake browser update scam gets a makeover

#6

Post by Unfrozen0688 » Wed, Oct 18, 2023, 5:18 PM UTC

Will ublock origin or Brave shield block this?

Another reason to use ublock origin for private use and also deploy it in company use with GPO, Intune or other RMM.

Re: The fake browser update scam gets a makeover

#7

Post by sublinear » Wed, Oct 18, 2023, 5:27 PM UTC

sysadm1n wrote: post #4

Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessib…

This isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default stance on HN is always javascript bad.

Re: The fake browser update scam gets a makeover

#8

Post by simion314 » Wed, Oct 18, 2023, 5:53 PM UTC

sublinear wrote: post #7

sysadm1n wrote: post #4

Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessib…

This isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default stance on HN is always javascript bad .

>I'll never understand why the default stance on HN is always javascript bad.

I am a web dev, and I agree that JS on the web is bad for pages that should be just documents like a news webpage or wiki page. JS makes sense for applications like a video game, video/audio/level/text editor, or some internal app that your company trust, but for random untrusted document pages JavaScript is a detriment, even if we only consider UX.

Re: The fake browser update scam gets a makeover

#9

Post by tremon » Wed, Oct 18, 2023, 5:56 PM UTC

sublinear wrote: post #7

sysadm1n wrote: post #4

Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessib…

This isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default stance on HN is always javascript bad .

I don't think it's a matter of trust and awareness, because your browser is already happily executing the javascript payload before you have decided whether to trust the website or not. And users are completely unaware of what the payload is doing unless it's spinning at 100% cpu or throwing UI elements in the user's face. It's a matter of convenience mostly, from my point of view.

The HN population consists for a large part of computer power users and developers who are fully aware of the capabilities of browsers and the dangers of remote code execution. I'll never understand why the default stance on HN still mostly seems to be javascript good, if not for the convenience factor.

Re: The fake browser update scam gets a makeover

#10

Post by pwg » Wed, Oct 18, 2023, 5:59 PM UTC

Unfrozen0688 wrote: post #6

Will ublock origin or Brave shield block this? Another reason to use ublock origin for private use and also deploy it in company use with GPO, Intune or other RMM.

> Will ublock origin

Since the attack is likely JavaScript based, provided one configures Ublock Origin to by default deny all JavaScript (this is not Ublock's default mode, you have to turn on "I am an advanced user" mode and then block all JS by default using the advanced user UI controls) then the answer is very likely: yes, it will. Because if it is JS based - if no JS runs, no exploit happens.