Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

11–20 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#11

Post by farresito »

retube wrote: post #7

Twitter blocked in my location. Is there a mirror? Edit: thanks all for help below. Yes very cunning.

"This is the closest I've ever come to falling for a Gmail phishing attack. If it hadn't been for my high-DPI screen making the image fuzzy..."

https://pbs.twimg.com/media/C0W-dCCWQAAl0cn.jpg

If you can't view the image, try this:

http://imgur.com/oJYWPXE

Re: The closest I've ever come to falling for a Gmail phishing attack

#12

Post by lovich »

retube wrote: post #7

Twitter blocked in my location. Is there a mirror? Edit: thanks all for help below. Yes very cunning.

I don't know of a mirror but the email had an embedded image that looked like a pdf attachment in gmail. The embedded image led to a fake google sign in page when clicked

Re: The closest I've ever come to falling for a Gmail phishing attack

#13

Post by rerx »

Once I almost fell for an extremely well made Paypal-phishing mail. It was late at night and I had just made a purchase via Paypal at a very small web shop. The timing was so perfect to catch me off guard that I am certain that site had been broken into to gather my email address.

Re: The closest I've ever come to falling for a Gmail phishing attack

#15

Post by rovek »

I'd be really interested to see the increased success rate. Even if the most tech-savvy weren't fooled (I'm not so sure), I would be surprised not to see a vast increase from your average misspelled ecommerce phishing email. Shame those crooks don't practise open data.

Re: The closest I've ever come to falling for a Gmail phishing attack

#16

Post by witty_username »

whyagaindavid wrote: post #8

Serious question. Does having a chromebook anyway help? How often is the google safe browsing checked? Wondering if I should do all internet activities inside chromebook only.

A Chromebook won't help anymore than Chrome for phishing.

Re: The closest I've ever come to falling for a Gmail phishing attack

#17

Post by dvh » 

    ">clickme
Or if you want to reproduce it console:

    a = document.createElement('a');
    a.href = 'data:text/html,valid_looking_url    ';
    a.textContent = 'clickme';
    a.style.position = 'fixed';
    a.style.left = 0;
    a.style.top = 0;
    a.style.zIndex = 9999;
    document.body.appendChild(a);
The "valid_looking_url" will appear in document but it can be hidden from page by script or made transparent using css

Re: The closest I've ever come to falling for a Gmail phishing attack

#18

Post by mderazon »

witty_username wrote: post #14

To stop being phished always check the domain name and for HTTPS before entering passwords.

Don't trust HTTPS, any malicious site can get certificate very easily. I once almost fell for a smart Airbnb phishing attack. At some point, I was directed to https://www.airbnb.com.eubook.net/en/instant/rooms/2685603?c... to complete my booking. Website had perfectly valid SSL cert (doesn't anymore) and more importantly, check out the domain name ! Almost missed the .eubook.net part!

Re: The closest I've ever come to falling for a Gmail phishing attack

#19

Post by slazaro »

The only two things that I think could have prevented me from falling for this is: I don't have images loaded by default for unknown senders, and LastPass wouldn't match the domain and therefore wouldn't show the button to autocomplete on the password box.

Depending on how observant I'd be at the moment, I might check the URL bar and see something fishy. But I could fall for this, which is worrying.

Post reply on HN