Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The fake browser update scam gets a makeover

krebsonsecurity.com

Post reply on HN
Print view View original

151–160 of 196 posts

Re: The fake browser update scam gets a makeover

#151

Post by nilsherzig »

gjsman-1000 wrote: post #11
keane wrote: post #2

The quality of full screen takeover pages seems to have dramatically risen recently. My family members, who don’t know the Escape key exists, accidentally click one from a banner ad every week now taking them to a page like examplefoobar38561.cloudfront.net and the use of elements that imitate browser or OS chrome (generally imitating Windows Defender or similar) has reached near perfection. All browsers should have…

> All browsers should have a setting to permanently block full screen mode for all sites (not “ask”). Never going to happen, because that's breaking YouTube.

Don't they already whitelist YouTube for Autoplay with sound or something like that

Re: The fake browser update scam gets a makeover

#152

Post by EliRivers »

xcdzvyn wrote: post #63
7moritz7 wrote: post #40

Earlier quoted context omitted.

I really think Monero in particular deserves way more criticism for their practice. Bitcoin is one thing, Monero is created for and marketed towards cybercriminals, you don't need to be a communications expert to get that premise. I haven't seen it used once for any legitimate purpose. Atleast with Bitcoin and Ethereum you can get buy some legitimate things like VPNs or NFTs https://arstechnica.com/information-techno…

You could say exactly the same thing about any form of encryption. I haven't bought much with Monero, but I always offer it because I adore the premise. I personally think its great, one of the few truly valuable cryptocurrencies.

"Monero is created for and marketed towards cybercriminals..."

"You could say exactly the same thing about any form of encryption..."

That seems very untrue. I like my credit card details to be encrypted when I send them for the exact opposite of assisting cybercrime.

Re: The fake browser update scam gets a makeover

#153

Post by everdrive »

sublinear wrote: post #7
sysadm1n wrote: post #4

Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessib…

This isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default stance on HN is always javascript bad .

It's simple; the web becomes a much nicer place when you block javascript by default. Some things don't work, but they never compromise you, or bog down your computer, and throw huge ads and banners in your face. I could go on. I obviously see that JS can be used for good things, but it seems like people can't constrain themselves to that.

Re: The fake browser update scam gets a makeover

#154

Post by amelius »

sublinear wrote: post #118
klyrs wrote: post #36

Earlier quoted context omitted.

Your browser is a platform that downloads and runs arbitrary code on your local hardware. "JavaScript bad" doesn't capture the nuance I read in people's comments here, but history shows that JavaScript is a gaping maw of security nightmares.

Modern browsers are what have removed the nuance. Please tell me what about the Web API for JS is truly dangerous. Native apps and programmable documents (PDFs and spreadsheets for example) are the real security nightmare. The danger on the web lies squarely with easily fooled idiots visiting shady sites.

Fingerprinting is one example.

Re: The fake browser update scam gets a makeover

#155

Post by Gare »

kevmo314 wrote: post #26
jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

> It seems like they (like Cloudflare, or a regular hosting service) are opening themselves up to all sorts of risks by serving arbitrary content. That's pretty much any website that accepts user input or integrates with an external service. I could post a base64-encoded malware to HN too, it would just get caught a lot faster (wasn't this a real thing on reddit?). I think the trick here is that it doesn't look out o…

Yes, but the HN can easily remove offending content. How do you remove something from blockchain?

Re: The fake browser update scam gets a makeover

#156

Post by WhyNotHugo »

pcwalton wrote: post #47
sysadm1n wrote: post #4

Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessib…

I would argue that a world that didn't have JS would make these types of attacks more common, not less common. Because in that world, people would have to download desktop apps for everything, which would make people used to downloading desktop apps from random Web pages, which would make malware easier to distribute. In fact, we don't have to imagine that world: it was the world of the late 90s.

Native applications should be downloaded via your distributions' channels, not from random websites.

Re: The fake browser update scam gets a makeover

#157

Post by ComodoHacker »

jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

I think one more important reason for hosting payload on the blockchain is to avoid automatic detection by scanning and auditing tools.

Re: The fake browser update scam gets a makeover

#158

Post by quickthrower2 »

Gigachad wrote: post #75
financypants wrote: post #74

Earlier quoted context omitted.

Free storage and hosting? Does this mean anyone can store random stuff in smart contracts and read from it for free?

You have to pay for the initial insert but it's then hosted forever for free. For reads, you can either download the data from nodes in the network which works somewhat like a torrent, or find a service that has a full copy of the blockchain and is providing it via a HTTP interface.

No absolute guarantee of forever.

Re: The fake browser update scam gets a makeover

#159

Post by quickthrower2 »

andybak wrote: post #17

I'm just happy to finally see a practical use case for Blockchain technology.

Lol you don’t need blockchain, you need a host that doesn’t take down malware payloads. A floppy disk is sufficient technology if cached behind a CDN

Re: The fake browser update scam gets a makeover

#160

Post by quickthrower2 »

lazide wrote: post #141
vhcr wrote: post #94

Earlier quoted context omitted.

In an ideal world, native apps shouldn't be able to compromise your whole system.

And how would that ideal world come to pass? Hell, we even tried applets!

Webassembly will get us there
Post reply on HN