Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was tricked on Facebook into downloading an obfuscated script

security.stackexchange.com

Post reply on HN
Print view View original

11–20 of 74 posts

Re: I was tricked on Facebook into downloading an obfuscated script

#11

Post by uxp »

tokenizerrr wrote: post #8
djKianoosh wrote: post #6

Earlier quoted context omitted.

I take it a step further. insta-block phone numbers (never answer either) and insta-spam/unsubscribe emails.

And how do you know a phone number is spam without answering it?

Generally, if it's not in my contacts list, then it's unsolicited and flagged spam. I won't answer unknown phone numbers (as I get a large number of spam calls in Spanish for immigration and high interest loans coming from or spoofed to the same area code and CO as my number, so even "local" numbers are suspect to me). If I don't answer, they leave a message, and it is someone or someplace I know about, then I'll add it to my contacts. If I answer an unknown number, just the act of asking "Hello?" seems to be about the equivalent as clicking an unsubscribe link in a true spam message; it notifies the spammer that they've got a warm contact that they can resell or contact again.

Re: I was tricked on Facebook into downloading an obfuscated script

#12

Post by jobigoud »

djKianoosh wrote: post #6
mathattack wrote: post #5

Earlier quoted context omitted.

For whatever reason, in my most current job, unwanted phone calls and email solicitations have gone up 20X. With phone calls I give a polite "not interested" and if there is anything other than "I'm sorry" I hang up mid-sentence. It took me a while to be this direct, but they have no right to waste my time. With email I used to politely say, "I'm not interested" to the spammer's email. (I've been on the other side, a…

I take it a step further. insta-block phone numbers (never answer either) and insta-spam/unsubscribe emails.

I do the same. Almost no one has my landline phone number, so whenever I get a call I paste the number in Google. 9/10 times other people have already reported it as spam. I then proceed to blacklist it which can be done from the phone itself and takes about 5 keystrokes.

Re: I was tricked on Facebook into downloading an obfuscated script

#13

Post by jobigoud »

tokenizerrr wrote: post #8
djKianoosh wrote: post #6

Earlier quoted context omitted.

I take it a step further. insta-block phone numbers (never answer either) and insta-spam/unsubscribe emails.

And how do you know a phone number is spam without answering it?

There are websites for caller reputation. (If you can assume that an unknown number is suspicious).

Re: I was tricked on Facebook into downloading an obfuscated script

#14

Post by uxp »

a3n wrote: post #10
Aelinsaar wrote: post #2

I treat any attempt to download like an attempt to call my phone, or ring my doorbell when I'm not expecting someone. Instant suspicion which is, 99% of the time, unfounded. Still, I've never had to deal with the Jehovah's Witnesses.

I engage Jehovah's Witnesses, but not in the dick way that capital A Atheists might (I'm a small a atheist). I try to learn what they're about. They're generally nice people.

The house I bought last year came with a cheesy "No Solicitation" sign stuck to the screen door near the handle. I've wanted to remove it, but laziness and the fact that it has some utility has kept it in place.

Oddly, Jehovah's Witnesses have been the only people to ignore it. I've watched Mormons walk up and turn away, though.

Re: I was tricked on Facebook into downloading an obfuscated script

#15

Post by tokenizerrr »

uxp wrote: post #11
tokenizerrr wrote: post #8

Earlier quoted context omitted.

And how do you know a phone number is spam without answering it?

Generally, if it's not in my contacts list, then it's unsolicited and flagged spam. I won't answer unknown phone numbers (as I get a large number of spam calls in Spanish for immigration and high interest loans coming from or spoofed to the same area code and CO as my number, so even "local" numbers are suspect to me). If I don't answer, they leave a message, and it is someone or someplace I know about, then I'll add…

It's insane to me that you refuse to pick up the phone for people whose phone number you don't know. Aren't you anyone's emergency contact?

Re: I was tricked on Facebook into downloading an obfuscated script

#16

Post by uxp »

jobigoud wrote: post #12
djKianoosh wrote: post #6

Earlier quoted context omitted.

I take it a step further. insta-block phone numbers (never answer either) and insta-spam/unsubscribe emails.

I do the same. Almost no one has my landline phone number, so whenever I get a call I paste the number in Google. 9/10 times other people have already reported it as spam. I then proceed to blacklist it which can be done from the phone itself and takes about 5 keystrokes.

One app I've always wanted to write is one that intercepts incoming phone numbers that are not on your contact list and do a quick lookup on those reputation service sites and display it side-by-side with the number. Similar to how iOS has recently added the "Might Be John Doe" based on numbers it has learned about through iMessage or Mail.

Maybe iOS 10 has added enough functionality on the call screen APIs to allow it (I haven't honestly checked), but up until now there hasn't been a way to tie into calls like that without actually writing an entire VoIP backend so you could control the complete call flow.

Re: I was tricked on Facebook into downloading an obfuscated script

#17

Post by newjersey »

a3n wrote: post #10
Aelinsaar wrote: post #2

I treat any attempt to download like an attempt to call my phone, or ring my doorbell when I'm not expecting someone. Instant suspicion which is, 99% of the time, unfounded. Still, I've never had to deal with the Jehovah's Witnesses.

I engage Jehovah's Witnesses, but not in the dick way that capital A Atheists might (I'm a small a atheist). I try to learn what they're about. They're generally nice people.

Yes. I have so much appreciation for their contributions to civil liberties. Yes, we should have a right to not say the pledge of allegiance. No, I won't exercise that right but it is seriously stupid to say we have a "right" to do something if we don't have a right to not do it.

If we have to get up and pray, we do not have freedom to pray. People who refuse to stand up to pray at the beginning of a rodeo are people we have to be grateful for.

Re: I was tricked on Facebook into downloading an obfuscated script

#18

Post by uxp »

tokenizerrr wrote: post #15
uxp wrote: post #11

Earlier quoted context omitted.

Generally, if it's not in my contacts list, then it's unsolicited and flagged spam. I won't answer unknown phone numbers (as I get a large number of spam calls in Spanish for immigration and high interest loans coming from or spoofed to the same area code and CO as my number, so even "local" numbers are suspect to me). If I don't answer, they leave a message, and it is someone or someplace I know about, then I'll add…

It's insane to me that you refuse to pick up the phone for people whose phone number you don't know. Aren't you anyone's emergency contact?

Yes I am. I know iOS allows someone to dial their emergency contact from a locked phone, so in that case I will receive a call from the person's phone that I know about. Otherwise, they leave a message and I get to it immediately and call them back.

The reality of an emergency situation where someone I know has me listed as an ICE contact and someone else calls on their behalf from an unknown number is that I cannot do much to help them in a situation that a minute or two of phone-tag would introduce. That's what 911 and other emergency services are for. If you are ever in a situation where you come across someone that has just sustained major injury, who are you going to call first? Their children or spouse to let them know of the situation, or medical help via 911? I'd hope you would chose the latter to get them the critical medical help they need before you inform someone else of the situation.

Re: I was tricked on Facebook into downloading an obfuscated script

#19

Post by my_first_acct »

thefreeman wrote: post #9
my_first_acct wrote: post #7

Maybe the wrong place for a newbie question, but here goes. IF I am running up-to-date versions of Windows and Chrome, and I click on this link, is it game over? Or do I get another chance to refuse installation of whatever malware is in the payload?

You have to double click the downloaded file to execute it under Windows Script Host

Thanks. That is somewhat reassuring. The likelihood of my doing something stupid/oblivious is higher than it should be, but the likelihood of being stupid twice in a row is quite a bit lower.
Post reply on HN