Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kurt Got Got

fly.io

Post reply on HN
Print view View original

151–160 of 256 posts

Re: Kurt Got Got

#151

Post by haruka_ff »

reassess_blind wrote: post #129

Is there an anti-phishing extension that detects whether the domain is close to, but not exactly the popular legitimate domain? Would probably need to use a local LLM for the detection. If not I might look into making one.

MetaMask (the crypto wallet) has one that shows warning pages to all domains that are remotely similar to crypto-related domains, and it is very prone to false positives and annoying. They have to maintain a list to skip the detection for real domains, and it's really inefficient.

Feels like this kind of detection is hard to balance, and calling legit websites possible phishing might be problematic...

Re: Kurt Got Got

#152

Post by FreakLegion »

amenghra wrote: post #96
tialaramex wrote: post #94

Earlier quoted context omitted.

If you're getting pwned a physical Security Key still means bad guys don't have the actual credential (there's no way to get that), and they have to work relatively hard to even create a situation where maybe you to let them use the credential you do have (inside the Security Key) while they're in position to exploit you. These devices want a physical interaction (this is called "User present") for most operations, t…

Malicious binary steals browser cookies giving attacker access to all active sessions?

It gets better. With malware on the box you own the primary refresh token, which can mint new browser tokens without needing passwords or MFA.

Definitely use FIDO2, but understand that it's not foolproof. Malware, OAuth phishing, XSS, DNS hijacking, etc. will still pwn you.

Re: Kurt Got Got

#153

Post by FreakLegion »

dilyevsky wrote: post #38
bradgessler wrote: post #13

When we did annual pen testing audits for my last company, the security audit company always offered to do phishing or social engineering attacks, but advised against it because they said it worked every single time. One of the most memorable things they shared is they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on…

The stray USB stick is how Stuxnet allegedly got deployed. Tbh I doubt that works in this day and age.

Versions of it work necessarily. The gist is that the USB device presents as a keyboard and is pre-programmed to pop a shell and start blasting. No exploits required. See: https://en.wikipedia.org/wiki/BadUSB.

Re: Kurt Got Got

#157

Post by classified »

KingOfCoders wrote: post #146

Phishing training does not work. "Understanding the Efficacy of Phishing Training in Practice" https://arianamirian.com/docs/ieee-25.pdf

> We are reliably informed by our zoomer children that we are too cringe to be trusted on these matters.

Bullseye. At least they take it with good humor.

Re: Kurt Got Got

#158

Post by reassess_blind »

haruka_ff wrote: post #151
reassess_blind wrote: post #129

Is there an anti-phishing extension that detects whether the domain is close to, but not exactly the popular legitimate domain? Would probably need to use a local LLM for the detection. If not I might look into making one.

MetaMask (the crypto wallet) has one that shows warning pages to all domains that are remotely similar to crypto-related domains, and it is very prone to false positives and annoying. They have to maintain a list to skip the detection for real domains, and it's really inefficient. Feels like this kind of detection is hard to balance, and calling legit websites possible phishing might be problematic...

Seems like the kind of problem LLMs would be perfect for. ChatGPT does a great job at giving a score of whether domains are attempting to appear legitimate, but of course no one wants their browsing history being sent off to OpenAI. Unfortunately from my testing local 4B-7B LLMs aren't up to the task.

Re: Kurt Got Got

#159

Post by KingOfCoders »

man8alexd wrote: post #156
KingOfCoders wrote: post #146

Phishing training does not work. "Understanding the Efficacy of Phishing Training in Practice" https://arianamirian.com/docs/ieee-25.pdf

The same paper is linked in the original article.

Thanks. Stopped reading after I found out the article was not by the CEO.

Re: Kurt Got Got

#160

Post by taneq »

solid_fuel wrote: post #117
Aeolun wrote: post #116

Earlier quoted context omitted.

Our company does regular phishing attacks against our own team, which apparently gets us a noteworthy 90% ‘not-click’ rate (don’t quote me on numbers). Never mind that that 10% is still 1500 people xD It’s gone so far that they’re now sending them from our internal domains, so when the banner to warn me it was an external email wasn’t there, I also got got.

At a previous position, I had a rather strained relationship with the IT department - they were very slow to fill requests and maintained an extremely locked down windows server that we were supposed to develop for. It wasn't the worse environment, but the constant red tape was pretty frustrating. I got got when they sent out a phishing test email disguised as a survey of user satisfaction with the IT department. Hon…

TBH this is probably the best argument for actually conducting phishing pentests. It shuts up the technical users who think they're too smart to need the handrails and safety nets that the IT department set up for the rest of the average plebs who work there.

(Speaking as one of the technical users here. Of course, it wouldn't happen to ME! :P )

Post reply on HN