Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I was seven words away from being spear-phished

robertheaton.com

Post reply on HN
Print view View original

181–187 of 187 posts

Re: I was seven words away from being spear-phished

#181

Post by 0xffff2 »

hdfbdtbcdg wrote: post #175
0xffff2 wrote: post #148

Earlier quoted context omitted.

It would mean you need an additional vulnerability to escape the VM sandbox.

Yeah if you check email in a VM. But how would a Docker container help?

Maybe I'm using terms interchangeably when I shouldn't be (I haven't jumped on the containerization bandwagon), but a Docker container is still just a "VM light", right? Part of its purpose is to isolate the things running inside of it from anything else running on the system. I'm fairly certain my comment still stands if you just `s/VM/container`.

Re: I was seven words away from being spear-phished

#182

Post by jjwhitaker »

safetyfirstb wrote: post #163
jjwhitaker wrote: post #100

Earlier quoted context omitted.

I think a process like with unwarranted phone calls is in order. Take the name and contact info provided but Google for the information yourself and contact the official site/email/phone number for information.

A word of warning: go to the actual site and find the contact details there. I've seen an attacker change the contact details listed on Google search results (the ones that appear in the boxes) to their own. I saw it used as part of a Windows help center scam, but I don't see why it wouldn't work here too.

That is what I had meant but not how my wording ended up. Verify the contact info from the vendor/firm's site itself if possible.

Re: I was seven words away from being spear-phished

#183

Post by wutbrodo »

cf498 wrote: post #107
wutbrodo wrote: post #82

Earlier quoted context omitted.

Yup, it was a Microsoft Research paper IIRC. That's more applicable to scams that cast a wide net to avoid investing resources on savvier targets in the second, more labor-intensive phase. I don't think it would be too relevant to spear-phishing like this case where the resources are already invested in step 1.

https://www.microsoft.com/en-us/research/publication/why-do-... Here is the paper

Thank you!

Re: I was seven words away from being spear-phished

#184

Post by CydeWeys »

differentView wrote: post #94
CydeWeys wrote: post #72

Earlier quoted context omitted.

I doubt it in this case. It sounds like they had a browser zero-day, and could potentially steal cryptocurrencies from people they were targeting. You don't particularly care how gullible someone is; if you get your zero-day to successfully work on them and steal all their Bitcoin, there's nothing they can do about it. I think the default assumption is the correct one here; the attacker(s) are a solo or small group o…

You may be overestimating the writing ability of native English speakers.

If you're going to involve someone specifically for the purpose of writing English, then obviously you'd pick someone who's good at it. It's not a native/non-native distinction so much as it is "good at writing in English" vs not.

Re: I was seven words away from being spear-phished

#185

Post by hdfbdtbcdg »

0xffff2 wrote: post #181
hdfbdtbcdg wrote: post #175

Earlier quoted context omitted.

Yeah if you check email in a VM. But how would a Docker container help?

Maybe I'm using terms interchangeably when I shouldn't be (I haven't jumped on the containerization bandwagon), but a Docker container is still just a "VM light", right? Part of its purpose is to isolate the things running inside of it from anything else running on the system. I'm fairly certain my comment still stands if you just `s/VM/container`.

No.

Docker isolation is for convenience not security isolation.

Re: I was seven words away from being spear-phished

#186

Post by jakejarvis »

noir-york wrote: post #159
antiviral wrote: post #129

Earlier quoted context omitted.

Can any of you recommend a way to create a sandbox that can seal off processes within a computer? One option is to use a VPC on a cloud-hosted machine to access whatever emails, links, websites someone sends you, but this can be time-consuming and costs money. This article claims that Docker would also not be a good solution: https://security.stackexchange.com/questions/107850/docker-a... "...container solutions do n…

I had written a jail for Windows a long long time ago - it was inspired by Unix's jail. For an app you could configure what filesystem and registry access was allowed and you could redirect FS access. Implemented it as a kernel driver that hooked into the relevant system calls. It was easier to do kernel dev back then (we are talking mid 2000's) - i havent touched windows kernel coding in years. I wonder if Microsoft…

Agreed about VMs in everyday use, and I'm wondering if the new Windows 10 Pro/Enterprise sandboxes would be a sufficiently safe alternative in these scenarios. After skimming this white paper it seems like they would, but I'm no expert in this area:

https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...

Re: I was seven words away from being spear-phished

#187

Post by jakejarvis »

noja wrote: post #123

So did the attackers get control of a Cambridge e-mail account and web page?

That was probably the easiest part of their escapade, sadly — spoofing a WiFi access point with a fake portal comes to mind. Or posing as IT and mass-emailing the university directory (which are rather easy to scrape at most universities), keyloggers on lab computers, etc. Always possible that it could have been as simple as just asking!

Out of ~20,000 students and ~10,000 staff, they only needed to get lucky once, unfortunately.

Post reply on HN