Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was seven words away from being spear-phished

robertheaton.com

Post reply on HN
Print view View original

151–160 of 187 posts

Re: I was seven words away from being spear-phished

#151

Post by rcthompson »

differentView wrote: post #94
CydeWeys wrote: post #72

Earlier quoted context omitted.

I doubt it in this case. It sounds like they had a browser zero-day, and could potentially steal cryptocurrencies from people they were targeting. You don't particularly care how gullible someone is; if you get your zero-day to successfully work on them and steal all their Bitcoin, there's nothing they can do about it. I think the default assumption is the correct one here; the attacker(s) are a solo or small group o…

You may be overestimating the writing ability of native English speakers.

You're right that most native English speakers don't have anywhere near immaculate grammar. However, the grammar errors that native speakers make are generally quite different from those that non-native speakers make.

Re: I was seven words away from being spear-phished

#152

Post by kurthr »

albertgoeswoof wrote: post #68
zubi wrote: post #35

Earlier quoted context omitted.

A few days ago, I also received the same message from a friend with a link to a fake youtube page, but unlike you, I actually clicked it despite intuitively knowing that it was malicious. Seemed like a "regular" phishing attempt but I now wonder if it is more than that, having read this article.

Probably not a good idea to click a link you know is malicious, you never know what 0-Day they might have

Also, don't browse outside of your own VM...

Re: I was seven words away from being spear-phished

#153

Post by ndiscussion »

tempodox wrote: post #133
albertgoeswoof wrote: post #106

Earlier quoted context omitted.

Exactly, they’re not stupid. So you’d expect them to use a spell checker if they intended for the attack to have a high success rate on English speakers. There may have been a second step for the attackers goals after the zero day, e.g. ransomware or some other social engineering

A spell checker still doesn't detect faulty grammar.

A sufficiently good one does, grammarly being the most well-known example I'm aware of.

Re: I was seven words away from being spear-phished

#154

Post by albertgoeswoof »

lhoff wrote: post #98
albertgoeswoof wrote: post #68

Earlier quoted context omitted.

Probably not a good idea to click a link you know is malicious, you never know what 0-Day they might have

That's what I keep my old Blackberry Z10 for. If I get something weird or want to go to dangerous places on internet (for research obviously) I use that thing. I'm pretty sure know one writes a 0-day for a 0.0% market share device.

Is your blackberry on your WiFi network? I’m guessing it hasn’t had a security patch in several years?

Be aware that an attacker could be automatically looking for exploitable devices just like z10 that and using that as a jump box into your network.

Re: I was seven words away from being spear-phished

#155

Post by newsoul2019 »

hyperpape wrote: post #139
newsoul2019 wrote: post #132

Earlier quoted context omitted.

That's what Java applets were supposed to be originally, they were supposed to run in a sandbox....

Not all sandboxes are created equal. Modern browsers have much better sandboxes than Java ever has had. OS level virtualization is even better.

If you read something like this [1], dated 1999, it seems like they had the right ideas. I guess it went wrong in the actual implementations.

[1] http://www.securingjava.com/chapter-two/chapter-two-2.html

Re: I was seven words away from being spear-phished

#156

Post by proactivesvcs »

miles wrote: post #102

A case of "flattery will get you everywhere": > I received a very flattering email from the University of Cambridge, asking me to judge the Adam Smith Prize for Economics ... > I wouldn’t say I’m an “expert” in economics exactly, but the university’s request wasn’t that surprising. I do have a subscription to The Economist ... > I’ve read a few books by Paul Krugman, but aside from that have never studied or practice…

Which, in my experience, is not a typical tactic employed by phishers. Usually it's greed (Here's $50 million for you) or alarm (You've been hacked!).

Re: I was seven words away from being spear-phished

#157

Post by ultrarunner »

js2 wrote: post #149

I thought myself fairly well informed about macOS, having run it since the 10.1 days, administering it over the years, etc. But TIL that the quarantine bit and gatekeeper which normally prevent unauthorized executables from running is trivially bypassed, as was the case in this attack. My paranoia level has increased. https://objective-see.com/blog/blog_0x43.html https://speakerd.s3.amazonaws.com/presentations/9e724e…

I just checked my login items and found runChmm, adware that was apparently installed as part of an FTP client used at work. I was trying to replicate a scenario we see at work and got adware. Paranoia level increased indeed.

Re: I was seven words away from being spear-phished

#158

Post by autoexec »

magicalhippo wrote: post #108
throwayEngineer wrote: post #41

Earlier quoted context omitted.

Okay but let's be clear. Clicking a link won't steal your information. Going to a bad link and giving your details is how you are phished.

Couple of years ago a significant news site here in .no had their ad network hacked. The result was that if you were browsing that site that morning, and was a customer of the largest bank in .no, you'd silently got served some software which would do a MITM attack against the online account page of said bank, redirecting any payments you did without your knowledge. All you had to do was to visit that site with Java…

I use firefox which I've locked down pretty hard. No site gets to run active content of any kind by default. No java, not even javascript. That and all the ad-blocking really limits likelihood of my getting infected from just an initial click, but even that isn't foolproof. IE once managed to let attackers get you just by viewing an image (CVE-2005-2308)

Re: I was seven words away from being spear-phished

#159

Post by noir-york »

antiviral wrote: post #129
scotchmi_st wrote: post #34

This is a fascinating story. It's funny though how, with compromised accounts at a highly reputable university and a 0-day exploit in one of the most-used pieces of software out there, they still managed to make basic grammatical errors in their phishing email. I mean, these people were clearly not messing around. Their attack(s) were highly targeted. And yet they still didn't check their written english! If it hasn'…

Can any of you recommend a way to create a sandbox that can seal off processes within a computer? One option is to use a VPC on a cloud-hosted machine to access whatever emails, links, websites someone sends you, but this can be time-consuming and costs money. This article claims that Docker would also not be a good solution: https://security.stackexchange.com/questions/107850/docker-a... "...container solutions do n…

I had written a jail for Windows a long long time ago - it was inspired by Unix's jail.

For an app you could configure what filesystem and registry access was allowed and you could redirect FS access.

Implemented it as a kernel driver that hooked into the relevant system calls. It was easier to do kernel dev back then (we are talking mid 2000's) - i havent touched windows kernel coding in years.

I wonder if Microsoft has implemented a jail for processes in recent versions of windows. Running browsers in a VM can be cumbersome.

Re: I was seven words away from being spear-phished

#160

Post by btilly »

matthewowen wrote: post #33

The specifics of this - the request to judge a prize one is clearly unqualified for - are we as software engineers particularly vulnerable to? Most people would, I think, conclude "this is fake, because why would I be asked to do this?". But I often think that as software engineers we fancy ourselves to have more insight into other fields than we really do. Does this ring true to anyone else?

Speaking personally, I would know myself to be unqualified, but I'd assume that someone's software picked up the fact that my name is on a refereed economics paper that has been cited over 100x.

So I could have fallen for this. Not because I have an overinflated sense of my own importance. But because I have a healthy respect for the erroneous conclusions that can be reached by automated incompetence.

Post reply on HN