111–120 of 289 posts
Just addressing this attack in particular, is there any legitimate reason to have consecutive white spaces in a URL bar?
Earlier quoted context omitted.
This is pretty scary. When you hear security professionals explain to laymen how to identify phishing attacks, it's almost always check the URL, make sure you're actually at google.com and not go0gle.com, or something like that. I can't even imagine what legitimate use there is to placing an entire HTML document into the URL. Just seems like a hack someone came up with as a solution to a problem, not the right soluti…
>I can't even imagine what legitimate use there is to placing an entire HTML document into the URL. Just seems like a hack someone came up with as a solution to a problem, not the right solution, but a solution nonetheless. It allows you to embed data in an URL, meaning you can link to documents that aren't necessarily stored anywhere, such as generated images/text. I suppose you could make an argument that it should…
Earlier quoted context omitted.
My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices. ^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used…
That's a pretty awful method of securing anything. Like, that would prevent me from using 2FA. Whatever happened to standards?
1. you input your username
google send back an msg/pic which you saved in google at last login
confirm then goes to step 2
3. google ask you input auth code
Thanks for sharing this - this is fiendishly clever. Even with all the investment in infosec, we're still woefully unprepared to deal with this type of attack. We need to start thinking about new approaches to protect users.
It's a hard problem but the industry isn't doing as much as it could do. There's low hanging fruit that has gone unharvested for years at most big companies. 1. Reform the browser address bar. Safari does this right. Chrome, IMHO shamefully, does not. The address bar is completely ignored by a large fraction (I've read it's about 25%) of users because it's full of meaningless technobabble. These users navigate entire…
Sysadmin at a school: we use GMail for our students and faculty, and we got hit by this hard right before the holiday break. Three employees and a handful of students all got hit by the attack within a two hour period. It's the most sophisticated attack I've seen. The attackers log in to your account immediately once they get the credentials, and they use one of your actual attachments, along with one of your actual…
Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.
Earlier quoted context omitted.
Yes, but as per the standard TOTP codes are valid for a window of 1 minute. TOTP barely protects against phishing. What you want is an U2F key as the second factor. It's not like they are expensive anyway (usually 7-15 Euro) and quite some large services support U2F tokens already (Google, Dropbox, GitHub, Fastmail, etc.).
Thanks! Is the 1 minute window always the case? In the authenticator app, it seems like codes expire after ~30 seconds. If I wait till the last few seconds before using the code, does that make me any safer?
Earlier quoted context omitted.
No. A man-in-the-middle phishing attack can ask you for your second factor and pass it through to Gmail.
This is definitely true of TOTP but U2F was designed to prevent phishing attacks by incorporating the hostname in the protocol[1], which means the attacker needs to successfully compromise SSL as well. 1. https://security.stackexchange.com/questions/71316/how-secur...
However I wouldn't want my second-factor to be attached to my browser. Seems way too volatile for me. Personally I'd rather keep TOTP and be vulnerable to time-of-use phishing.
Maybe if the browser had an OS API that a YubiKey could query...
Just addressing this attack in particular, is there any legitimate reason to have consecutive white spaces in a URL bar?
However, a better question is: do a lot of legitimate websites in the wild put multiple spaces in the address field. Obvious answer is that millions do, so there's nothing browsers can really do here.
Earlier quoted context omitted.
Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.
Not really. The phisher can just ask for the second factor the same way they ask for the password.