Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The fake browser update scam gets a makeover

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 196 posts

Re: The fake browser update scam gets a makeover

#11

Post by gjsman-1000 »

keane wrote: post #2

The quality of full screen takeover pages seems to have dramatically risen recently. My family members, who don’t know the Escape key exists, accidentally click one from a banner ad every week now taking them to a page like examplefoobar38561.cloudfront.net and the use of elements that imitate browser or OS chrome (generally imitating Windows Defender or similar) has reached near perfection. All browsers should have…

> All browsers should have a setting to permanently block full screen mode for all sites (not “ask”).

Never going to happen, because that's breaking YouTube.

Re: The fake browser update scam gets a makeover

#12

Post by paulpauper »

Good ol' Krebs and Schneier ..either way too late to a scam, or ignoring other scams, or ineffectual regardless. What about those fake "download here" Adword buttons that have been a scourge of the web for the past decade or longer infecting untold millions of computers with malware. When will anyone bring that up.

Re: The fake browser update scam gets a makeover

#13

Post by ceejayoz »

paulpauper wrote: post #12

Good ol' Krebs and Schneier ..either way too late to a scam, or ignoring other scams, or ineffectual regardless. What about those fake "download here" Adword buttons that have been a scourge of the web for the past decade or longer infecting untold millions of computers with malware. When will anyone bring that up.

People have been bringing that up for like a decade?

Re: The fake browser update scam gets a makeover

#15

Post by yardstick »

josteink wrote: post #14

I guess someone finally found a real world use for blockchain. Too bad it was malware.

Ironic that even this blockchain still had some centralised aspects:

“In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts.”

I thought one of the big drivers for people using blockchain is the decentralised nature- resistance to censorship etc. Seems like this one isn’t a great long-term choice for malware as it’s not censorship resistant (as evidenced by the blacklist).

Re: The fake browser update scam gets a makeover

#16

Post by jkaptur »

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload.

And the reason for this two-step architecture is to make it convenient to change the real payload.

And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the blockchain" which means it "can’t be blocked".

What I don't understand is who is actually serving the HTTP call that effectively proxies the data from the blockchain. It seems like they (like Cloudflare, or a regular hosting service) are opening themselves up to all sorts of risks by serving arbitrary content.

Re: The fake browser update scam gets a makeover

#18

Post by andybak »

simion314 wrote: post #8
sublinear wrote: post #7

Earlier quoted context omitted.

This isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default stance on HN is always javascript bad .

>I'll never understand why the default stance on HN is always javascript bad. I am a web dev, and I agree that JS on the web is bad for pages that should be just documents like a news webpage or wiki page. JS makes sense for applications like a video game, video/audio/level/text editor, or some internal app that your company trust, but for random untrusted document pages JavaScript is a detriment, even if we only con…

You're a web developer but your mental map of the web consists of "documents" on one end and "applications like a video game, video/audio/level/text editor(s)" on the other?

You haven't in your career, stumbled across web (sites/apps) that sit somewhere on the spectrum between the extremes of "document" vs "app"?

It strikes me that there's a fairly even distribution between those two points - even if we discount all the misguided "could have been a static site but someone decided it had to be an app" decisions.

I actually agree with you on reigning in javascript but I think much of the web is poorer without it. We had an answer for this years back and it was called "progressive enhancement".

Re: The fake browser update scam gets a makeover

#19

Post by 7moritz7 »

> New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from being taken down by security experts or law enforcement: By hosting the malicious files on a decentralized, anonymous cryptocurrency blockchain

Finally a practical use for web3

Re: The fake browser update scam gets a makeover

#20

Post by pyrolistical »

They could also use ipfs as there are many http proxies for it including cloudflare. All proxies would individually need to blacklist the address.

In general it is going to be impossible to block content. We need to charge for bytes or something like that. But that produces other problems which could be worse

Post reply on HN