121–130 of 187 posts
Earlier quoted context omitted.
I once read a theory that poor grammar, particularly with 419 scams, acts as a sort of gullibility filter where only the most susceptible targets will respond.
In this case though, since the zero day runs without consuming the attacker's time, what is to be gained by filtering out less-gullible people? If it's automated, why not cast as wide a net as possible?
I thought 0-day exploits could be sold for a significant amount if money. I wonder if the hackers bought one, or, found one and thought they could make more on their own than by selling it? And, if they did buy one, what was the return on their investment?
The two questions that immediately jumped to my mind on this are 1) does Coinbase's user base skew more towards Firefox than the average, possibly because of perceived better security/privacy and a desire for that among cryptocurrency users? 2) did the zeroday impact Tor browser users, and does Coinbase have a lot of those?
Earlier quoted context omitted.
Probably not a good idea to click a link you know is malicious, you never know what 0-Day they might have
That's what I keep my old Blackberry Z10 for. If I get something weird or want to go to dangerous places on internet (for research obviously) I use that thing. I'm pretty sure know one writes a 0-day for a 0.0% market share device.
Earlier quoted context omitted.
You may be overestimating the writing ability of native English speakers.
The kind of mistakes a non-native English speaker makes tend to be different than ones an uneducated native speaker does.
This "spear" was also for a MacOS vulnerability. No doubt most Mac people think they're immune to viruses and malware, making this even more effective. It is very well thought out attack.
A lot of recent high profile targeted hacks have been against macos (poker stars, Saudi activist, Chinese activists, ...). Let's just agree that all platforms are vulnerable and anyone telling you otherwise should not be trusted.
This is a fascinating story. It's funny though how, with compromised accounts at a highly reputable university and a 0-day exploit in one of the most-used pieces of software out there, they still managed to make basic grammatical errors in their phishing email. I mean, these people were clearly not messing around. Their attack(s) were highly targeted. And yet they still didn't check their written english! If it hasn'…
One option is to use a VPC on a cloud-hosted machine to access whatever emails, links, websites someone sends you, but this can be time-consuming and costs money.
This article claims that Docker would also not be a good solution:
https://security.stackexchange.com/questions/107850/docker-a...
"...container solutions do not and never will do guarantee to provide complete isolation, use virtualization instead if you require this."
So is there any other way to create a sealed off sandbox on your own machine that would create a type of moat between your machine and your adversary?
This also happened to me - and after returning to the Stellar site years later, my old login did not work, and the page looked nothing like it used to. Were the free Stellar tokens ever really granted?