Live data from Hacker News

I was seven words away from being spear-phished

robertheaton.com

171–180 of 187 posts

Re: I was seven words away from being spear-phished

#171
One thing the article goes into is all the signs that the mail was fake. I think focusing on how one can spot such attacks is slightly silly for two reasons:

1. If these errors caused attacks to be unsuccessful then I expect (competent) attackers would stop making these mistakes

2. Plenty of real people make spelling errors or write single sentence paragraphs or even plagiarise things (or have their own descriptions plagiarised). Real people also host group things on personal sites. I think relying on this sort of thing is too likely to lead to false positives (and its a lot easier to spot the “signs” once one knows the email bad) and too unreliable in the long term for reason 1.

One thing I wonder is how this sort of thing might be prevented. It seems that once one’s pc is compromised there isn’t much one can do; newer security mechanisms like security keys don’t help much if the device is compromised. I don’t know how hardware bitcoin wallets (or similar devices) work so I can’t say whether they might have protected the targets of this attack, although I would guess they would not.

Sometimes I wonder if this is something there should be insurance for, but would anyone buy it? I think it would have to start as insurance for companies (which would require large numbers of companies to consider a breach like this a major financial risk) before people but such attacks would have to be unlikely enough to be successful for the insurance to be cheap. I suggest insurance with the vague hope that an insurer would want their customers to be more secure to decrease the chance they have to pay out. I don’t know if it would work that way in practice.

Re: I was seven words away from being spear-phished

#172
post #56

Earlier quoted context omitted.

I use a dedicated VM. It is only started when I need to do some banking, and can't talk to most of the internet.

I don't get it, shouldn't you use the VM for accessing everything except your bank? If the host gets compromised from non-banking activity, it can just take over your VM.

Almost all of my activity on that machine is in one VM or another. I mostly only work on the host OS when I'm making a new VM.

Re: I was seven words away from being spear-phished

#173

Earlier quoted context omitted.

Not all sandboxes are created equal. Modern browsers have much better sandboxes than Java ever has had. OS level virtualization is even better.

If you read something like this [1], dated 1999, it seems like they had the right ideas. I guess it went wrong in the actual implementations. [1] http://www.securingjava.com/chapter-two/chapter-two-2.html

By total coincidence, I was reading about Java sandbox exploits just a few days ago: http://phrack.org/papers/escaping_the_java_sandbox.html.

It feels to me (not a security guy!) like there was something fundamentally too complex here. I wonder if part of the problem is that unlike the browser, there's no natural boundary. JavaScript is was originally built to live in a small self-contained world with specific access to the outside. Java was built with features for writing applications that could touch the filesystem, redefine classes, and everything else. It was also supposed to make everything safe, but that led to complex checks everywhere to try to distinguish privileged from unprivileged code.

Re: I was seven words away from being spear-phished

#174

Earlier quoted context omitted.

Couple of years ago a significant news site here in .no had their ad network hacked. The result was that if you were browsing that site that morning, and was a customer of the largest bank in .no, you'd silently got served some software which would do a MITM attack against the online account page of said bank, redirecting any payments you did without your knowledge. All you had to do was to visit that site with Java…

I use firefox which I've locked down pretty hard. No site gets to run active content of any kind by default. No java, not even javascript. That and all the ad-blocking really limits likelihood of my getting infected from just an initial click, but even that isn't foolproof. IE once managed to let attackers get you just by viewing an image (CVE-2005-2308)

0-days are not limited to javascript - the next one might well be in the canvas/image/svg renderer. When someone has targeted you with a 0-day and you load the site they compromised website, all bets are off.

Re: I was seven words away from being spear-phished

#176
Every time I open the UI for the Ubiquiti UniFi console in Safari it complains that Safari may not work correctly and suggest Firefox or Chrome. Every time I curse at it, ignore it and have had no issues. The simplest way for me to not do want you ask is for you to tell me best viewed in X. If it does it working in Firefox, Safari, Chrome and Edge, then £#&$*=+&$% you. Do your job and test on the major platforms. My current company has a web UI and I make it a point when using the product to open it in a different major browsers each time I touch it. If there is an issue I file a Jira ASAP vs the UI team.

Okay I know this is about the Firefox security bug, but just a general rant anyways.

Re: I was seven words away from being spear-phished

#177
post #98

Earlier quoted context omitted.

That's what I keep my old Blackberry Z10 for. If I get something weird or want to go to dangerous places on internet (for research obviously) I use that thing. I'm pretty sure know one writes a 0-day for a 0.0% market share device.

Is your blackberry on your WiFi network? I’m guessing it hasn’t had a security patch in several years? Be aware that an attacker could be automatically looking for exploitable devices just like z10 that and using that as a jump box into your network.

I use it mostly at home where it sits in the guest wifi(all connections between devices prohibited)

Re: I was seven words away from being spear-phished

#178

One thing the article goes into is all the signs that the mail was fake. I think focusing on how one can spot such attacks is slightly silly for two reasons: 1. If these errors caused attacks to be unsuccessful then I expect (competent) attackers would stop making these mistakes 2. Plenty of real people make spelling errors or write single sentence paragraphs or even plagiarise things (or have their own descriptions…

A hardware wallet is safe even if the computer is hostile. That's why they exist!

However it's possible that some other attack method could be used, e.g. compromising the user's email account and going from there.

Re: I was seven words away from being spear-phished

#179
post #26

It's impossible to overestimate the power of expectations to create trust (even in the face of contrary indications). This just almost happened to me this week: A couple of days ago I wrote an email to a friend I hadn't been in touch with for several years. A day later I got a message from him on Facebook with what looked like a YouTube link and the cryptic message, "It's you?" I didn't want to see myself on a random…

I fell for a fake download button once, and it was when I was already working in IT. Not something I admit freely

Re: I was seven words away from being spear-phished

#180

This is a fascinating story. It's funny though how, with compromised accounts at a highly reputable university and a 0-day exploit in one of the most-used pieces of software out there, they still managed to make basic grammatical errors in their phishing email. I mean, these people were clearly not messing around. Their attack(s) were highly targeted. And yet they still didn't check their written english! If it hasn'…

Can any of you recommend a way to create a sandbox that can seal off processes within a computer? One option is to use a VPC on a cloud-hosted machine to access whatever emails, links, websites someone sends you, but this can be time-consuming and costs money. This article claims that Docker would also not be a good solution: https://security.stackexchange.com/questions/107850/docker-a... "...container solutions do n…

[deleted]
Post reply on HN