I was seven words away from being spear-phished • Hacker News Board

Re: I was seven words away from being spear-phished

#101

Post by doc_gunthrop » Wed, Jun 26, 2019, 4:15 PM UTC

matthewowen wrote: post #33

The specifics of this - the request to judge a prize one is clearly unqualified for - are we as software engineers particularly vulnerable to? Most people would, I think, conclude "this is fake, because why would I be asked to do this?". But I often think that as software engineers we fancy ourselves to have more insight into other fields than we really do. Does this ring true to anyone else?

> They ruthlessly exploited innocent people’s slightly over-inflated beliefs of their own abilities and importance,...

Inflated ego and/or the appearance of a rare opportunity (which would lead to further ego inflation) can cloud judgment.

Re: I was seven words away from being spear-phished

#102

Post by miles » Wed, Jun 26, 2019, 4:18 PM UTC

A case of "flattery will get you everywhere":

> I received a very flattering email from the University of Cambridge, asking me to judge the Adam Smith Prize for Economics ...

> I wouldn’t say I’m an “expert” in economics exactly, but the university’s request wasn’t that surprising. I do have a subscription to The Economist ...

> I’ve read a few books by Paul Krugman, but aside from that have never studied or practiced economics

Re: I was seven words away from being spear-phished

#103

Post by nemothekid » Wed, Jun 26, 2019, 4:19 PM UTC

pjdemers wrote: post #87

I thought 0-day exploits could be sold for a significant amount if money. I wonder if the hackers bought one, or, found one and thought they could make more on their own than by selling it? And, if they did buy one, what was the return on their investment?

I may be making things up, but I remember reading the particular bug was reported by a white hat to Firefox’s internal bug tracker and somehow may have gotten leaked.

Re: I was seven words away from being spear-phished

#104

Post by mrmattyboy » Wed, Jun 26, 2019, 4:24 PM UTC

"Neil, if you are real and this is your real LinkedIn profile then I am so sorry. But if you’re so real then why did you copy someone else’s self-description?"

I would love to find out that the profile _is_ real, and that the JPMorgan dude is actually a fake profile for another scam (for trying to cheat people out of money), who stole this guy's self-description :P

The beautiful outcome being that he'd have publicly shamed and picked apart the guy's entire profile and foiled another scam in one hit :)

Re: I was seven words away from being spear-phished

#105

Post by mrmattyboy » Wed, Jun 26, 2019, 4:26 PM UTC

scotchmi_st wrote: post #34

This is a fascinating story. It's funny though how, with compromised accounts at a highly reputable university and a 0-day exploit in one of the most-used pieces of software out there, they still managed to make basic grammatical errors in their phishing email. I mean, these people were clearly not messing around. Their attack(s) were highly targeted. And yet they still didn't check their written english! If it hasn'…

To your initial point, I assume that you're immediately thinking of a sloppy-writing person who's first language is English, as opposed to a hacker who learnt English as a second language. With the latter, it wouldn't be surprising that they spent less time learning a foreign language than learning about the technology that they're trying to attack

Re: I was seven words away from being spear-phished

#106

Post by albertgoeswoof » Wed, Jun 26, 2019, 4:27 PM UTC

fwip wrote: post #85

albertgoeswoof wrote: post #71

Earlier quoted context omitted.

It’s odd that they would have limited knowledge of English yet understand the prestige of Cambridge, be able to create genuine looking linkedin pages and target the attack so well. If you’re going to that much trouble running a spell checker over he email would seem like a reasonable step? Most likely it’s a deliberate attempt to target people who are excited enough by the email to not notice the grammar.

Foreign language speakers aren't stupid. You can Google "famous school England" in any language. There's no "second step" to this con. You don't have to get tricked into wiring them money. If you visit the page, you lose.

Exactly, they’re not stupid. So you’d expect them to use a spell checker if they intended for the attack to have a high success rate on English speakers.

There may have been a second step for the attackers goals after the zero day, e.g. ransomware or some other social engineering

Re: I was seven words away from being spear-phished

#107

Post by cf498 » Wed, Jun 26, 2019, 4:31 PM UTC

wutbrodo wrote: post #82

davb wrote: post #48

Earlier quoted context omitted.

I once read a theory that poor grammar, particularly with 419 scams, acts as a sort of gullibility filter where only the most susceptible targets will respond.

Yup, it was a Microsoft Research paper IIRC. That's more applicable to scams that cast a wide net to avoid investing resources on savvier targets in the second, more labor-intensive phase. I don't think it would be too relevant to spear-phishing like this case where the resources are already invested in step 1.

https://www.microsoft.com/en-us/research/publication/why-do-...

Here is the paper

Re: I was seven words away from being spear-phished

#108

Post by magicalhippo » Wed, Jun 26, 2019, 4:41 PM UTC

throwayEngineer wrote: post #41

decasia wrote: post #26

It's impossible to overestimate the power of expectations to create trust (even in the face of contrary indications). This just almost happened to me this week: A couple of days ago I wrote an email to a friend I hadn't been in touch with for several years. A day later I got a message from him on Facebook with what looked like a YouTube link and the cryptic message, "It's you?" I didn't want to see myself on a random…

Okay but let's be clear. Clicking a link won't steal your information. Going to a bad link and giving your details is how you are phished.

Couple of years ago a significant news site here in .no had their ad network hacked. The result was that if you were browsing that site that morning, and was a customer of the largest bank in .no, you'd silently got served some software which would do a MITM attack against the online account page of said bank, redirecting any payments you did without your knowledge.

All you had to do was to visit that site with Java installed on that computer, which most users of said bank did because their 2-factor login relied on Java...

So yeah, don't click on random links.

Re: I was seven words away from being spear-phished

#109

Post by ponyous » Wed, Jun 26, 2019, 4:47 PM UTC

How can I check if I am infected?

Re: I was seven words away from being spear-phished

#110

Post by tialaramex » Wed, Jun 26, 2019, 4:51 PM UTC

undecisive wrote: post #19

Cool post. One small nitpick: > Neil describes his pre-university education as “High School”. We don’t have “High School” in the UK - we call it “Secondary School” Not true at all I'm afraid. Where I'm from (Norwich) we had First / Middle / High School / (Sixth Form or college) splits, alongside other schools that did the Primary / Secondary / 6th split.

In Buckinghamshire, one of the few places in the UK which still has selective state education (ie they test children at the end of primary school for broad academic ability and then send them to different state-funded secondary schools based on the results‡) they call most mixed or girl-only schools that you'd get to if you did "well" on those tests High Schools, with boy-only schools often named Grammar Schools although other combinations do happen.

‡ This causes an interesting phenomenon. Suppose you're a pair of moderately successful young parents, you _could_ afford to send your children to get privately educated but it'd mean money was tight and also you'd get called on it all the time because you're socially liberal and theoretically don't agree with private education. Well, Bucks Grammar Schools and High Schools have an excellent reputation, but the state pays for them. So, when the kids approach school age maybe you move to, say, Beaconsfield, a very nice town in Buckinghamshire where your kids would qualify (if they pass selection) for these schools. So immediately this drives up housing prices in Bucks.

But then later at selection age the options are all _terrible_. Unless you got very lucky your kid isn't smart enough to be 100% certain of getting in anywhere they want. Do you pay tutors to try to get your "not quite bright enough" kid over the line and pay off on this investment? Imagine if they spend the rest of their school life being the slowest kid in every class. That's not going to be a lot of fun, or a good psychological experience. Or maybe you decide to stick by your beliefs, and let them "fail" into a non-selective school, now they'll resent you. Perhaps you decide to spend money on private school if they "fail" - now they're the kid who was so dumb they're only at this school because they failed a test AND you're still out the cash.

And this choice comes up for each kid, if you are inconsistent they absolutely will know about it. And they're probably _all_ going to resent you both for it. And then you can argue among yourselves about whose fault this all is. Brilliant.