Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The inception bar: a new phishing method

jameshfisher.com

Post reply on HN
Print view View original

201–210 of 238 posts

Re: The inception bar: a new phishing method

#201

Post by cmcaine »

sizzle wrote: post #190
antihero wrote: post #138

Earlier quoted context omitted.

Back in the day I made a near-perfect copy of the RM (UK school IT supplier) login page in Visual Basic 6, and had it run on computers with RunServices registry entry. Had a team of mates with custom floppy disks going around installing it on as many PCs as we could. It would log the supplied user/pw to disk, then display the "wrong password" error, then quit, then exposing the real login screen.

What did you do with the passwords you captured? Sounds unethical... You'd definitely be facing criminal charges if you got caught doing this today I'd imagine.

> Criminal charges

Heh, I don't think so. Teachers don't like to send their pupils to court for silly things. They'd just get told why not to do it again and probably get some detention and stuff.

At a uni, the consequences might be more severe.

Re: The inception bar: a new phishing method

#203

Post by Nextgrid »

saagarjha wrote: post #14
Nextgrid wrote: post #7

Related: https://feross.org/html5-fullscreen-api-attack/

FWIW, opening that link in mobile Safari shows a large “X” in the top left of the screen and trying to scroll sets of the “it looks like you’re typing in fullscreeen” warning.

Mobile Safari? On which iOS version?

On mine (latest on iPhone 7 at the time of this writing) the site just says my browser doesn’t support the full screen API.

Re: The inception bar: a new phishing method

#204

Post by saagarjha »

Nextgrid wrote: post #203
saagarjha wrote: post #14

Earlier quoted context omitted.

FWIW, opening that link in mobile Safari shows a large “X” in the top left of the screen and trying to scroll sets of the “it looks like you’re typing in fullscreeen” warning.

Mobile Safari? On which iOS version? On mine (latest on iPhone 7 at the time of this writing) the site just says my browser doesn’t support the full screen API.

MobileSafari on my iPad running iOS 12.3 (16F5139e).

Re: The inception bar: a new phishing method

#205

Post by sizzle »

cmcaine wrote: post #201
sizzle wrote: post #190

Earlier quoted context omitted.

What did you do with the passwords you captured? Sounds unethical... You'd definitely be facing criminal charges if you got caught doing this today I'd imagine.

> Criminal charges Heh, I don't think so. Teachers don't like to send their pupils to court for silly things. They'd just get told why not to do it again and probably get some detention and stuff. At a uni, the consequences might be more severe.

Yeah it's not like you did anything illicit like change grades or wreak havoc on the network by mass formatting computers, unless you intentionally left out those parts ;)

Re: The inception bar: a new phishing method

#206

Post by cmcaine »

iforgotpassword wrote: post #171
IshKebab wrote: post #100

Earlier quoted context omitted.

In high school I replicated the entire login UI of NT LAN manager (I think it was called) and had it save the password and then crash the machine (via c:\con\con). Asked the teacher to login for something and tada, admin password. If you ever wondered why you have to press ctrl-alt-del to log in, that is why (nobody ever fixed this for Linux).

> If you ever wondered why you have to press ctrl-alt-del to log in, that is why (nobody ever fixed this for Linux). Seems you're not familiar with Linux. It had SAK since forever.

I have never seen a SAK-before-login notice on any linux machine. Only one institutional setting, I suppose.

Re: The inception bar: a new phishing method

#207

Post by colanderman »

snazz wrote: post #183
colanderman wrote: post #149

I understand why this was a problem in 1995, but honestly, in 2019, with image recognition technology as advanced as it is now – especially due to efforts by Google – why can't browsers detect this? Surely "does this rectangle look vaguely like a URL bar" is an easier problem to solve than "is this a photograph of a cat"? Sure, image recognition is CPU intensive, but even just checking once every 5 seconds or so woul…

MobileSafari has an interesting feature that your idea reminded me of: it tries to detect when a site using the Fullscreen API presents an iOS keyboard-lookalike through the location and frequency of your taps on that side of the screen. I’ve gotten the warning when doing something else and was impressed they thought of it.

Neat! That's an interesting way to detect phishing.

Re: The inception bar: a new phishing method

#208

Post by cmcaine »

geuszb wrote: post #172
akersten wrote: post #68

With a little polishing this would be quite the "exploit" - trap the user in your fake browser, actually load pages that are entered into the fake URL bar, replace content only on certain patterns... The only solution here is a proper line of death [0]. It defeats the purpose of the LoD when it dynamically shrinks from user action. [0]: https://textslashplain.com/2017/01/14/the-line-of-death/

Thanks. This is a great reference indeed! The challenge is preserving ability for content to control all pixels; without it, the content ecosystem ends up developing single-purpose, generally crappy apps, which isn't necessarily a better thing either... I'm not sure it is the only solution either - what about "secure attention key" type ways to get the system's attention (in this case the browser's), bypassing any co…

Escape will always exit fullscreen in browsers, which is a SAK that is well publicised.

We aren't trained to press escape before entering passwords, though.

Re: The inception bar: a new phishing method

#209

Post by m1sta_ »

userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

If everything were standard then a screen reader could confidently identify fraudulent content.

Re: The inception bar: a new phishing method

#210

Post by jfoster »

ehnto wrote: post #166
jfoster wrote: post #108

Earlier quoted context omitted.

What's the idea behind those? Do they just get permission before showing the real dialog, or is it more sinister than that?

It can be more sinister. Although I am sure the other answers are right in some circumstances, I was curious a while ago, so I actually clicked one. Whether you click allow or deny, it shot off a network request to a third party domain. This lets the third party know your browser's user agent, and if they have an exploit for your browser they will send a payload that compromises the browser with the intent of install…

But any click can do that, right? No need for it to be a fake Allow/Deny prompt.

The best I can think of is that it does 2 things:

1. Preserves the "true" allow/deny prompt for a time when the user will allow.

2. Lulls the user into a sense of security. The page is nice and/or their browser will ask about anything the page tries to do.

Post reply on HN