121–130 of 267 posts
> as ChatGPT confirmed when I asked it to analyze it lol we are so cooked
Not so smart, after all.
https://www.securityweek.com/clickfix-attack-exploits-fake-c...
Earlier quoted context omitted.
> as ChatGPT confirmed Tech support knew it was not a good idea. ChatGPT was used to throughly explain why that was a bad idea. Are you trying to make other people look dumb because you need to feel smarter than others for some reason? That's gross.
ChatGPT didn't confirm anything! It didn't even output the decoded text. It made a guess that happened to be correct, at a greater expense than real forensics and less confidence. In order to use the ChatGPT response, in order to avoid looking like an idiot, the first thing I would have to do is confirm it, because ChatGPT is very good at guessing and absolutely incapable of confirming Using base64 -d and looking at…
Earlier quoted context omitted.
Come on. Base64 decoding should be like binary to hex conversion for a developer. The command even mentions base64. What if ChatGPT said everything is fine?
Running it through ChatGPT and asking for its thoughts is a free action. Base64 decoding something that I know to be malicious code that's trying to execute on my machine, that's worrisome. I may do it eventually, but it's not the first thing I would like to do. Really I would prefer not to base64 decode that payload at all, if someone who can't accidentally execute malicious code could do it, that sounds preferable.…
In Windows CMD you don’t even need to hit return at the end. They can just add a line break to the copied text and as soon as you paste into the command line (just a right click!), you own yourself. I have one question though: Considering the scare-mongering about Windows 10’s EOL, this seems pretty convoluted. I thought bad guys could own your machine by automatic drive-by downloads unless you’re absolutely on the l…
I'm sure "visit a site and get exploited" happens, but... I haven't actually heard of a single concrete case outside of nation-state attacks. What's more baffling is that I also haven't heard of any Android malware that does this, despite most phones out there having several publicly known exploits and many phones not receiving any updates. I can't really explain it except "social engineering like this works so well…
Earlier quoted context omitted.
Problems: - E-mail is insecure. It can be read by any number of servers between you and the sender. - Numerically, very few healthcare companies have the time, money, or talent to self-host a secure solution, so they farm it out to a third-party that offers specific guarantees, and very few of those permit self-hosting or even custom domains because that's a risk to them. As someone who works in healthcare, I can say…
Millions please. The solution is to just link to the fucking thing instead of a cryptic tracking url from your mass mailing provider. But oh no, now you can’t see line go up anymore!!!
Earlier quoted context omitted.
LLMs are just as bad at code as "creative writing or whatever". It's just that fewer people know how to write/smell code at the same level as prose, so we get drowned out as "anti-AI" cynics and the lie continues.
But chatGPT was correct in this case, so you are indeed being cynical.
Earlier quoted context omitted.
I don't understand? It's actually a pretty good idea - ChatGPT will download whatever the link contains in its own sandboxed environment, without endangering your own machine. Or do you mean something else by saying we're cooked?
I doubt it downloaded or executed anything, it probably just did a base64 decode using some tool and then analysed the decoded bash command which would be very easy. Seems like a good use of an LLM to me.
Earlier quoted context omitted.
Problems: - E-mail is insecure. It can be read by any number of servers between you and the sender. - Numerically, very few healthcare companies have the time, money, or talent to self-host a secure solution, so they farm it out to a third-party that offers specific guarantees, and very few of those permit self-hosting or even custom domains because that's a risk to them. As someone who works in healthcare, I can say…
Millions please. The solution is to just link to the fucking thing instead of a cryptic tracking url from your mass mailing provider. But oh no, now you can’t see line go up anymore!!!
Geez, I skimmed the image with the "steps" and the devtools next to it and assumed it was steps to get the user to open the DevTools, but later when he said it would download a file I thought "You can tell the DevTools to download a file and execute it as a shell script?!". Then I read the steps again, step 2 is "Type in 'Terminal'"... oh come on, will many people fall for that?
There's no such thing as "too obvious" when it comes to computers, because normal people are trained by the entire industry, by every interaction, and by all of their experience to just treat computers as magic black boxes that you chant rituals to and sometimes they do what you want.
Even when the internet required a bit more effort to get on to, it was still trivial to get people to delete System32
The reality is that your CEO will fall for it.
I mean come on, do you not do internal phishing testing? You KNOW how many people fall for it.