Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The fake browser update scam gets a makeover

krebsonsecurity.com

Post reply on HN
Print view View original

131–140 of 196 posts

Re: The fake browser update scam gets a makeover

#131

Post by diego_sandoval »

warkdarrior wrote: post #23
jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

Why is this considered abuse? Blockchains are for storing data, and these people are storing data on it.

Re: The fake browser update scam gets a makeover

#132

Post by bryanrasmussen »

diego_sandoval wrote: post #131
warkdarrior wrote: post #23

Earlier quoted context omitted.

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

Why is this considered abuse? Blockchains are for storing data, and these people are storing data on it.

unless there's been an edit the parent didn't write abuse they wrote malware, which sort of anyway answers your question because we are supposed to consider the aiding and abetting of the malicious purposes of malware to be abusive.

Re: The fake browser update scam gets a makeover

#134

Post by yieldcrv »

jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

This group isnt doing it, but you can load ethers.js or web3.js client side, and it can also do RPC calls to the nearest node and get the same data

Re: The fake browser update scam gets a makeover

#135

Post by yieldcrv »

jbaczuk wrote: post #72
warkdarrior wrote: post #23

Earlier quoted context omitted.

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

lol > In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts. Earlier in th…

the code is still on BSC blockchain and any node will still return the information in those addresses

even binance operated nodes

the only thing Binance did was do the exact same thing that Cloudflare did, both on their HTTP routes. Binance just had one for convenience and to attract use of their blockchain, which … worked?

its actually lazy and amateurish that the hackers are using HTTP to access this code on the blockchain, they dont have to

Re: The fake browser update scam gets a makeover

#136

Post by yieldcrv »

numtel wrote: post #84
jbaczuk wrote: post #80

Earlier quoted context omitted.

seems like "blockchain" has nothing to do with it... they could just host the file on a server they do control. "Blockchains" aren't magic.

It's not magic but it is a radically different pricing model: pay once, host forever. I see it as a massive bet on storage prices continuing to decrease.

I think nocoiners completely miss this aspect, the media too

many devs will always post their applications on blockchains, and simply do system design conducive to that environment, because web 2.0 cloud models do not compete in pricing especially if you have a burst of activity

many devs bring their whole audience over, and the audience is willing to pay to update the state of the application with no overhead cost to the dev, which is also impossible to implement in web 2.0 cloud offerings, aside from just searching and hoping for free tiers

who cares if none of those applications match your use case, just call it the entertainment sector then and you still have value and utility to someone, that self perpetuates

Re: The fake browser update scam gets a makeover

#137

Post by BHSPitMonkey »

gjsman-1000 wrote: post #11
keane wrote: post #2

The quality of full screen takeover pages seems to have dramatically risen recently. My family members, who don’t know the Escape key exists, accidentally click one from a banner ad every week now taking them to a page like examplefoobar38561.cloudfront.net and the use of elements that imitate browser or OS chrome (generally imitating Windows Defender or similar) has reached near perfection. All browsers should have…

> All browsers should have a setting to permanently block full screen mode for all sites (not “ask”). Never going to happen, because that's breaking YouTube.

Google probably prefers when you don't fullscreen the video; More ways to have your eyes drawn to ads, recommendations, and comments in the periphery. Maybe this is why they added the different "bigger but still not fullscreen" modes a few years back.

Re: The fake browser update scam gets a makeover

#138

Post by lazide »

yjftsjthsd-h wrote: post #125
gumby wrote: post #43

Earlier quoted context omitted.

Sounds like we should poison this vector (and IPFS) by uploading copyrighted movie torrents to this free storage system. For a change we’d be doing good.

Your plan is to DOS a system because someone abused it?

I think it was more for the lulz.

Re: The fake browser update scam gets a makeover

#139

Post by sowbug »

d11z wrote: post #78
staplers wrote: post #76

Earlier quoted context omitted.

The suffocating irony of this forum being called "Hacker News" when it is filled with comments like this never fails to amaze me. A truly unimaginative bunch.

Could you give some other concrete, practical examples of use cases for cryptocurrencies instead of the passive-aggressive snark?

You can generate this list yourself.

Take your favorite payment provider (PayPal, Stripe, whichever bank provides your Visa/MasterCard, etc.), and look at their terms of service. Enumerate all the prohibited usages. From that list, delete illegal activities, of course.

The remaining items on the list are your practical examples of use cases. It's roughly the set of things that are legal, but that big corporations have decided you can't do because they're morally questionable or financially risky.

Stripe has an excellent list of examples (https://stripe.com/legal/restricted-businesses). Here is a selection:

* Pornography and other mature audience content (including literature, imagery and other media) depicting nudity or explicit sexual acts

* Online dating services

* Bankruptcy attorneys and bail bonds

* Sports forecasting or odds making with a monetary or material prize

* Charity sweepstakes and raffles for the explicit purpose of fundraising

* Unauthorized sale of brand name or designer products or services

And so on. All these are legal, but in a cashless society without decentralized currency, they might as well be illegal because no centralized payment processor will allow them.

But hey, Bitcoin can also be used for CSAM, unlike VPNs, Tor, or cash, which is why the HN cognoscenti condemns it.

Re: The fake browser update scam gets a makeover

#140

Post by lazide »

fturst wrote: post #82
d11z wrote: post #78

Earlier quoted context omitted.

Could you give some other concrete, practical examples of use cases for cryptocurrencies instead of the passive-aggressive snark?

Preserving privacy, reliable transactions with no, i repeat, no bank or govmnt involvement, no kyc. No/low fees (on some currencies), public immutable databases...

Yet most blockchains do the opposite of all of these things?
Post reply on HN