I was tricked on Facebook into downloading an obfuscated script • Hacker News Board

Re: I was tricked on Facebook into downloading an obfuscated script

#21

Post by dang » Sun, Jun 26, 2016, 4:57 PM UTC

vanderZwan wrote: post #20

> Facebook tricked me into downloading an obfuscated script This title suggests Facebook is doing this, even though it's clearly a malware exploit

That was a badly rewritten title, and we've restored the original. (Edit: never mind–the rewrite was at the host end.)

Submitters: please use the original title unless it is misleading or linkbait. That's in the site guidelines (https://news.ycombinator.com/newsguidelines.html). Making a title more misleading and linkbait is the wrong direction!

(Submitted title was 'Facebook tricked me into downloading an obfuscated script'.)

Re: I was tricked on Facebook into downloading an obfuscated script

#22

Post by criley2 » Sun, Jun 26, 2016, 5:08 PM UTC

uxp wrote: post #16

jobigoud wrote: post #12

Earlier quoted context omitted.

I do the same. Almost no one has my landline phone number, so whenever I get a call I paste the number in Google. 9/10 times other people have already reported it as spam. I then proceed to blacklist it which can be done from the phone itself and takes about 5 keystrokes.

One app I've always wanted to write is one that intercepts incoming phone numbers that are not on your contact list and do a quick lookup on those reputation service sites and display it side-by-side with the number. Similar to how iOS has recently added the "Might Be John Doe" based on numbers it has learned about through iMessage or Mail. Maybe iOS 10 has added enough functionality on the call screen APIs to allow…

Truecaller and Contacts+ do something similar, TrueCaller is very similar to what you describe

https://play.google.com/store/apps/details?id=com.truecaller...

Re: I was tricked on Facebook into downloading an obfuscated script

#23

Post by jrs235 » Sun, Jun 26, 2016, 5:10 PM UTC

tokenizerrr wrote: post #15

uxp wrote: post #11

Earlier quoted context omitted.

Generally, if it's not in my contacts list, then it's unsolicited and flagged spam. I won't answer unknown phone numbers (as I get a large number of spam calls in Spanish for immigration and high interest loans coming from or spoofed to the same area code and CO as my number, so even "local" numbers are suspect to me). If I don't answer, they leave a message, and it is someone or someplace I know about, then I'll add…

It's insane to me that you refuse to pick up the phone for people whose phone number you don't know. Aren't you anyone's emergency contact?

If it's important they'll leave a message. I tend to check the message right away so if it's an emergency I'll know relatively soon.

Re: I was tricked on Facebook into downloading an obfuscated script

#24

Post by criley2 » Sun, Jun 26, 2016, 5:10 PM UTC

uxp wrote: post #18

tokenizerrr wrote: post #15

Earlier quoted context omitted.

It's insane to me that you refuse to pick up the phone for people whose phone number you don't know. Aren't you anyone's emergency contact?

Yes I am. I know iOS allows someone to dial their emergency contact from a locked phone, so in that case I will receive a call from the person's phone that I know about. Otherwise, they leave a message and I get to it immediately and call them back. The reality of an emergency situation where someone I know has me listed as an ICE contact and someone else calls on their behalf from an unknown number is that I cannot…

Additionally, if you're the emergency contact and I don't answer and you immediately call back, I'll probably pick up.

I don't normally block numbers, just let them voicemail me if I don't recognize it, but if a spammer will double-call like that I'll block them, and it means I'll pick up for emergencies.

Re: I was tricked on Facebook into downloading an obfuscated script

#25

Post by pavel_lishin » Sun, Jun 26, 2016, 5:38 PM UTC

ht85 wrote: post #3

Aelinsaar wrote: post #2

I treat any attempt to download like an attempt to call my phone, or ring my doorbell when I'm not expecting someone. Instant suspicion which is, 99% of the time, unfounded. Still, I've never had to deal with the Jehovah's Witnesses.

I'm always curious about how people react to unwanted solicitation. When it happens to me, as soon as I realize I say "sorry" and close the door. When my door rings unexpectedly, I'm more worried it might be someone I know, as I'm usually in the middle of my work day, as in hacking stuff in my underwear.

This has only happened to me in apartment buildings; it's either some proselytizers, or people pretending to work for Con-Ed trying to scam me out of money. Either way they're trespassing, and in the latter case actively trying to harm me.

The last time this happened, I technically wasn't on the lease, so my wife discouraged me from following them around the building, introducing myself to the neighbors and breaking their spiel.

Re: I was tricked on Facebook into downloading an obfuscated script

#26

Post by pavel_lishin » Sun, Jun 26, 2016, 5:43 PM UTC

criley2 wrote: post #24

uxp wrote: post #18

Earlier quoted context omitted.

Yes I am. I know iOS allows someone to dial their emergency contact from a locked phone, so in that case I will receive a call from the person's phone that I know about. Otherwise, they leave a message and I get to it immediately and call them back. The reality of an emergency situation where someone I know has me listed as an ICE contact and someone else calls on their behalf from an unknown number is that I cannot…

Additionally, if you're the emergency contact and I don't answer and you immediately call back, I'll probably pick up. I don't normally block numbers, just let them voicemail me if I don't recognize it, but if a spammer will double-call like that I'll block them, and it means I'll pick up for emergencies.

Ditto for double-call signifying an emergency that I should pick up for, both for people I know and unknown numbers.

Re: I was tricked on Facebook into downloading an obfuscated script

#27

Post by facetube » Sun, Jun 26, 2016, 6:05 PM UTC

tokenizerrr wrote: post #15

uxp wrote: post #11

Earlier quoted context omitted.

Generally, if it's not in my contacts list, then it's unsolicited and flagged spam. I won't answer unknown phone numbers (as I get a large number of spam calls in Spanish for immigration and high interest loans coming from or spoofed to the same area code and CO as my number, so even "local" numbers are suspect to me). If I don't answer, they leave a message, and it is someone or someplace I know about, then I'll add…

It's insane to me that you refuse to pick up the phone for people whose phone number you don't know. Aren't you anyone's emergency contact?

I do the same thing, unapologetically. In an emergency, I'll get a voicemail immediately after the call, tap once to play it, and call back. I'm not an EMT: if that extra 30 seconds matters, the number to call is 911.

Re: I was tricked on Facebook into downloading an obfuscated script

#28

Post by cbd1984 » Sun, Jun 26, 2016, 6:23 PM UTC

a3n wrote: post #10

Aelinsaar wrote: post #2

I treat any attempt to download like an attempt to call my phone, or ring my doorbell when I'm not expecting someone. Instant suspicion which is, 99% of the time, unfounded. Still, I've never had to deal with the Jehovah's Witnesses.

I engage Jehovah's Witnesses, but not in the dick way that capital A Atheists might (I'm a small a atheist). I try to learn what they're about. They're generally nice people.

Atheists are atheists. If you're going to make a distinction, make it between individuals, not groups.

Re: I was tricked on Facebook into downloading an obfuscated script

#29

Post by m-app » Sun, Jun 26, 2016, 6:24 PM UTC

dang wrote: post #21

vanderZwan wrote: post #20

> Facebook tricked me into downloading an obfuscated script This title suggests Facebook is doing this, even though it's clearly a malware exploit

That was a badly rewritten title, and we've restored the original. (Edit: never mind–the rewrite was at the host end.) Submitters: please use the original title unless it is misleading or linkbait. That's in the site guidelines ( https://news.ycombinator.com/newsguidelines.html ). Making a title more misleading and linkbait is the wrong direction! (Submitted title was 'Facebook tricked me into downloading an obfuscat…

To be honest, the original title used to be just that: http://security.stackexchange.com/posts/128254/revisions

Re: I was tricked on Facebook into downloading an obfuscated script

#30

Post by tamana » Sun, Jun 26, 2016, 6:33 PM UTC

criley2 wrote: post #24

uxp wrote: post #18

Earlier quoted context omitted.

Yes I am. I know iOS allows someone to dial their emergency contact from a locked phone, so in that case I will receive a call from the person's phone that I know about. Otherwise, they leave a message and I get to it immediately and call them back. The reality of an emergency situation where someone I know has me listed as an ICE contact and someone else calls on their behalf from an unknown number is that I cannot…

Additionally, if you're the emergency contact and I don't answer and you immediately call back, I'll probably pick up. I don't normally block numbers, just let them voicemail me if I don't recognize it, but if a spammer will double-call like that I'll block them, and it means I'll pick up for emergencies.

How can you block them? The whole point is that spammers call from unknown numbers. Double calling is just an annoying arms race.