Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crates.io phishing attempt

fasterthanli.me

Post reply on HN
Print view View original

21–30 of 83 posts

Re: Crates.io phishing attempt

#21

Post by stronglikedan »

koakuma-chan wrote: post #5
coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

Phishing attempts are usually low-effort and easily seen through, npmjs.help one was good though.

> low-effort and easily seen through

To make up for that, they cast a wide net. It's a numbers game, like the guys that ask every single woman they meet for their phone number. It costs nothing or next to it, and all you need is one for a payoff.

Re: Crates.io phishing attempt

#22

Post by whatamidoingyo »

stravant wrote: post #11
coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

People realized that past phishing attempts were quite badly constructed and a well constructed one is actually really easy to fall for.

> People realized that past phishing attempts were quite badly constructed

I seem to recall that the typos and grammar errors were intentional. This gets rid of skeptical people, and you're left with those who are extremely gullible and likely to fall for it.

Re: Crates.io phishing attempt

#23

Post by rkomorn »

whatamidoingyo wrote: post #22
stravant wrote: post #11

Earlier quoted context omitted.

People realized that past phishing attempts were quite badly constructed and a well constructed one is actually really easy to fall for.

> People realized that past phishing attempts were quite badly constructed I seem to recall that the typos and grammar errors were intentional. This gets rid of skeptical people, and you're left with those who are extremely gullible and likely to fall for it.

First time I've heard this but it actually makes an awful lot of sense.

Re: Crates.io phishing attempt

#24

Post by entropie »

kannanvijayan wrote: post #16
coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

Pure speculation - but I'm wondering if one or a few of the black hat players has figured out a good way to leverage AI to phish more effectively at scale, and are taking a stab at all the venues that host code that's within a lot of dependency chains.

You might be on point:

https://www.anthropic.com/news/detecting-countering-misuse-a...

Re: Crates.io phishing attempt

#25

Post by warwren »

ranger207 wrote: post #20

If you get a message (text, email or call), it's best to not trust the contents of the message until you verify it by logging in or whatever yourself. If crates.io says you have a problem, close the email and go to crates.io yourself. If your bank calls you, hang up and log in or call their support number yourself. Don't trust anyone contacting you for sensitive stuff

Sage advice

Re: Crates.io phishing attempt

#26

Post by koakuma-chan »

stronglikedan wrote: post #21
koakuma-chan wrote: post #5

Earlier quoted context omitted.

Phishing attempts are usually low-effort and easily seen through, npmjs.help one was good though.

> low-effort and easily seen through To make up for that, they cast a wide net. It's a numbers game, like the guys that ask every single woman they meet for their phone number. It costs nothing or next to it, and all you need is one for a payoff.

I think that if you actually make a proper phishing website, get an actually plausible domain, and not make spelling mistakes, you can increase your conversion rate dramatically. Also why do they ask for a phone number if you can just ask her out right away.

Re: Crates.io phishing attempt

#27

Post by twodave »

prameshbajra wrote: post #14

That email looked very genuine. I would have fallen for it. Not gonna lie.

Being asked to login via an “internal login page” is a huge, bright red flag. It doesn’t matter what the reasoning is, if it’s not the same domain or an SSO integration that is well known to both you and the vendor then you shouldn’t be using it. This is security 101 type stuff.

Re: Crates.io phishing attempt

#29

Post by hombre_fatal »

I got an official email from Paypal last week saying that I had a charge for $900 at Kraken, and to call some number if it's suspicious.

What's great about the attack is that it's sent from paypal.com and signed by paypal. And the email contains a legit link to paypal, not some phishing site. But the phone number is the attack.

The attack:

1. Register a paypal business account

2. Add the victim's email address (or one that forwards to them) to the biz account's "secondary users"

3. Add a custom invitation message about how they have a $900 charge that they need to contest by calling a phone number that you control.

4. Paypal shows your custom invitation message inline with their official email with no indication that it was written by someone other than paypal (wtf?)

Here's the email that was of course surrounded by Paypal's own official email chrome:

> New Profile Charge: We have detected a new payment profile with a charge of $910.45 USD at Kraken.com. To dispute, contact PayPal at (805) 500-8413. Otherwise, no action is required. PayPal accept automatic pending bill from this account.Your New PayPal Account added you to the Crypto Wallet account.

I called the number and some guy started asking me for my info starting with my full name. I didn't hang around on the call long enough to see what the attack was.

Re: Crates.io phishing attempt

#30

Post by tialaramex »

WesolyKubeczek wrote: post #8
coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

When you grab a domain which is plausibly very similar to the legit domain the organization you work with is using, you can forge emails that will make your email client show all sorts of “verification passed” badges next to them. You can further appeal to developers’ geeky hearts by not making language mistakes and actually using verbiage present in real emails as sent by them. You can exploit recent supply chain at…

> Don’t worry, when they actually target you, you’ll be caught.

When they target me, which happens, it doesn't work because of WebAuthn.

Buy a Security Key. If you think you might lose it, buy at least two more. For critical sites like GitHub (which was targeted here) set up your Security Keys and get into the habit of relying on them. It's the same philosophy as Rust itself, machines are really good at diligently performing a simple task, so don't leave those tasks to human vigilance, that is a foolish misallocation of resources.

Post reply on HN