Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The scariest "user support" email I've received

devas.life

Post reply on HN
Print view View original

101–110 of 267 posts

Re: The scariest "user support" email I've received

#101

Post by dangus »

This is tame and not scary compared to the kinds of real live human social engineering scams I’ve seen especially targeting senior leaders. With those scams there’s a budget for real human scammers.

This thing was a very obvious scam almost immediately. What real customer provides a screenshot with Google sites, captcha, and then asking you to run a terminal program?

Most non-technical users wouldn’t even fall for this because they’d be immediately be scared away with the command line aspect of it.

Re: The scariest "user support" email I've received

#102

Post by thwarted »

croes wrote: post #89
gambiting wrote: post #31

Earlier quoted context omitted.

I don't understand? It's actually a pretty good idea - ChatGPT will download whatever the link contains in its own sandboxed environment, without endangering your own machine. Or do you mean something else by saying we're cooked?

ChatGPT didn’t download anything, hopefully. The we’re cooked refers to the fact of using ChatGPT to decode the base64 command. That’s like using ChatGPT to solve a simple equation like 4*12, especially for a developer. There are tons of base64 decoder if don’t want to write that one liner yourself.

Unless you're on Windows, there's one in /bin or /usr/bin, you don't even need to go find one.

Re: The scariest "user support" email I've received

#103

Post by lukeschlather »

croes wrote: post #84
notRobot wrote: post #21

Earlier quoted context omitted.

Isn't analysing and writing bits of code one of the few things LLMs are actually good at and useful for (as opposed to creative writing or whatever). Before LLMs if someone wasn't familiar with deobfuscation they would have no easy way to analyse the attack string as they were able to do here.

Come on. Base64 decoding should be like binary to hex conversion for a developer. The command even mentions base64. What if ChatGPT said everything is fine?

Running it through ChatGPT and asking for its thoughts is a free action. Base64 decoding something that I know to be malicious code that's trying to execute on my machine, that's worrisome. I may do it eventually, but it's not the first thing I would like to do. Really I would prefer not to base64 decode that payload at all, if someone who can't accidentally execute malicious code could do it, that sounds preferable.

Maybe ChatGPT can execute malicious code but that also seems less likely to be my problem.

Re: The scariest "user support" email I've received

#104

Post by tecoholic »

didgeoridoo wrote: post #68
nerdsniper wrote: post #57

The binary itself appears to be a remote-access trojan and data exfiltration malware for MacOS. It provides a reverse-shell via http://83.219.248.194 and exfiltrates files with the following extensions: txt rtf doc docx xls xlsx key wallet jpg dat pdf pem asc ppk rdp sql ovpn kdbx conf json It looks quite similar to AMOS - Atomic MacOS Stealer. It also seems to exfiltrate browser session data + cookies, the MacOS key…

I can’t even exfiltrate my MacOS Notes on purpose . Maybe I’ll download it and give it a spin.

God! That cracked me up. :D

Re: The scariest "user support" email I've received

#105

Post by nijave »

notRobot wrote: post #21
tantalor wrote: post #4

> as ChatGPT confirmed when I asked it to analyze it lol we are so cooked

Isn't analysing and writing bits of code one of the few things LLMs are actually good at and useful for (as opposed to creative writing or whatever). Before LLMs if someone wasn't familiar with deobfuscation they would have no easy way to analyse the attack string as they were able to do here.

The "old fashioned" way was to post on an internet message board or internet chatroom and let someone else decode it.

Re: The scariest "user support" email I've received

#106

Post by mrcsharp »

> as ChatGPT confirmed when I asked it to analyze it

Really? you need ChatGPT to help you decode a base64 string into the plain text command it's masking?

Just based on that, I'd question the quality of the app that was targetted and wouldn't really trust it with any data.

Re: The scariest "user support" email I've received

#107

Post by nijave »

johnisgood wrote: post #65
05 wrote: post #63

Earlier quoted context omitted.

No need - it's detectable as Trojan:MacOS/Amos by VirusTotal, just Google the description. Spoiler: it's a stealer. Here [0] is a writeup > AMOS is designed for broad data theft, capable of stealing credentials, browser data, cryptocurrency wallets, Telegram chats, VPN profiles, keychain items, Apple Notes, and files from common folders. [0] https://www.trendmicro.com/en_us/research/25/i/an-mdr-analys...

Thank you! Nothing too interesting. :( Got anything better? :D Something that may be worth getting macOS for! Edit: I have some ideas to make this one better, for example, or to make a new one from scratch. I really want to see how mine would fare against security researchers (or anyone interested). Any ideas where to start? I would like to give them a binary to analyze and figure out what it does. :D I have a couple…

You can spin up an ssh server on GitHub Actions macOS runner or most cloud providers you can rent a box

Re: The scariest "user support" email I've received

#108

Post by potato3732842 »

nneonneo wrote: post #96
tantalor wrote: post #4

> as ChatGPT confirmed when I asked it to analyze it lol we are so cooked

Better yet - ChatGPT didn't actually decode the blob accurately. It nails the URL, but manages somehow to get the temporary filename completely wrong (the actual filename is /tmp/pjKmMUFEYv8AlfKR, but ChatGPT says /tmp/lRghl71wClxAGs). It's possible the screenshot is from a different payload, but I'm more inclined to believe that ChatGPT just squinted and made up a plausible /tmp/ filename. In this case it doesn't ma…

Very common for these sorts of things to give different payloads to different user agents.
Post reply on HN