Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Copyfish extension was stolen and adware-infested

a9t9.com

Post reply on HN
Print view View original

131–140 of 217 posts

Re: Our Copyfish extension was stolen and adware-infested

#131

Post by sneak »

sillysaurus3 wrote: post #22
hartator wrote: post #18

Earlier quoted context omitted.

I don't think more policies will make a better place. One of the team member screw up and stuff like this happen. I am questioning his security education to have been phished so easily.

It's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you. The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game. A policy of popping…

> The only real defense is to glance at the url bar every time you're about to enter your password.

No. FIDO hardware 2fa works fine for this.

Re: Our Copyfish extension was stolen and adware-infested

#132

Post by claudius »

alister wrote: post #127
hartator wrote: post #25

Earlier quoted context omitted.

An email from Google with a bit.ly link? Hell no, I hope I won't fell from it in whatever situation. I agree that any defense is far from being perfect, but IT professionals shouldn't fell for an unsofiscated attack like this even if you are no working in security. I am not even talking about a web developer.

> An email from Google with a bit.ly link? The article clearly explains that "the bitly link was not directly visible in the phishing email, as it was an HTML-email."

Disabling HTML e-mails does not sound particularly unreasonable. There’s little additional benefit from them but a whole host of possible issues, least of all that suddenly your e-mail client has to deal with properly parsing HTML and you have to decide whether or not to load remote images and potentially execute JavaScript.

Re: Our Copyfish extension was stolen and adware-infested

#133

Post by u02sgb »

charleslmunger wrote: post #64
sillysaurus3 wrote: post #22

Earlier quoted context omitted.

It's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you. The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game. A policy of popping…

That's a good habit, but a good tool to help you avoid getting phished is https://support.google.com/a/answer/6197508?hl=en It alerts if you enter your google password anywhere but the real google sign in page.

That seems like something that should be part of Chrome once you login, not an optional extension.

Re: Our Copyfish extension was stolen and adware-infested

#135

Post by sam_goody »

cheez wrote: post #42
IncRnd wrote: post #10

> “Click here to read more details” the email said. The click opened the “Google” password dialog, and the unlucky team member entered the password for our developer account. This looked all legit to the team member, so we did not notice the pishing attack as such at this point. Pishing for Chrome extensions was simply not on our radar screen. First, it is excellent that you disclosed the issue. Second, based upon th…

I rely on my password manager: if it isn't filling in the password automatically, something is suspect. I wonder if I'm the only one who does this.

I used to do that till lastpass had several vulns [1] in which passwords to all sites can be gotten by a malicious page or extension.

If you use a password manager that auto fills in the paswords, it is open to an attack by a site or program that can fool it into thinking you have visited the site.

Any malicious extension such as the one compromised her, has a good chance of being able to drain all your passwords. You are probably safer, even with phishing threats, to paste it in from another program each time.

[1] http://thehackernews.com/2016/07/lastpass-password-manager.h...

Re: Our Copyfish extension was stolen and adware-infested

#138

Post by codedokode »

krackers wrote: post #108
i_am_nomad wrote: post #106

Earlier quoted context omitted.

That is some fine detective work there, Lieutenant! :) What tipped you off in the first place to the malware in User-Agent Switcher?

The odd post requests I noticed to uaswitcher.org in wireshark while I was trying to create a packet capture. I saw that it contained my browsing history urls in double encoded base64 format. Interestingly it appears the extension was infected ~4 years back, taken down, and somehow later re-added, only to be reinfested with malware within the last few months. Suffice to say, I am now paranoid and have audited all my…

I don't use browser extensions at all because they are often made by unknown developers and I cannot trust them.

Re: Our Copyfish extension was stolen and adware-infested

#139

Post by CrendKing »

nl wrote: post #87
sillysaurus3 wrote: post #36

Earlier quoted context omitted.

This actually isn't true. A website like https://www.xn--80ak6aa92e.com/ won't show up as apple.com. Browsers don't allow Unicode rendering in the URL bar. Maybe IE is affected though. I haven't tested every browser. But it's a known security concern.

It shows up as www.apple.com on Firefox 54.0.1 (latest, up-to-date) on OSX.

about:config, set network.standard-url.punycode-host to true

Re: Our Copyfish extension was stolen and adware-infested

#140

Post by stevenh »

codedokode wrote: post #138
krackers wrote: post #108

Earlier quoted context omitted.

The odd post requests I noticed to uaswitcher.org in wireshark while I was trying to create a packet capture. I saw that it contained my browsing history urls in double encoded base64 format. Interestingly it appears the extension was infected ~4 years back, taken down, and somehow later re-added, only to be reinfested with malware within the last few months. Suffice to say, I am now paranoid and have audited all my…

I don't use browser extensions at all because they are often made by unknown developers and I cannot trust them.

I always thought it was strange that Google bothered adding so many XSS prevention measures to Chrome when they also happily give UXSS abilities to extension developers, complete with the veneer of trust provided by the Chrome web store.
Post reply on HN