Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The inception bar: a new phishing method

jameshfisher.com

Post reply on HN
Print view View original

211–220 of 238 posts

Re: The inception bar: a new phishing method

#211

Post by glandium »

0db532a0 wrote: post #109
Waterluvian wrote: post #51

Earlier quoted context omitted.

In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

The company where I first worked out of university had a custom which the CEO named ‘shemaling’. The company had quite strict security standards. It was encouraged that anyone who found an unlocked screen in the office would ‘shemale’ the wallpaper. It did the job. I never forgot again after being ’shemaled’ the first time.

At a previous job, we had a "pipi" mailing list (pee, in French), where people would send "I went to pee" from unlocked computers. The "victim" themselves would often be members of said mailing list. That worked quite well, so organically, the list ended up being used mainly for random jokes, news and stuff, rather than the "I went to pee" messages.

Re: The inception bar: a new phishing method

#213

Post by baud147258 »

userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

"Ceci n'est pas un UI."

Shouldn't it be "Ceci n'est pas une UI."? Since interface is a feminine word in French, the article in front of UI need to be feminine too.

Re: The inception bar: a new phishing method

#214

Post by tacone »

JeanMarcS wrote: post #116
Waterluvian wrote: post #51

Earlier quoted context omitted.

In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

Back in the days (1990) I found amusing to edit the autoexec.bat on my first CS session and add « You have a virus... of the flu », and signed with my pseudo. Made me and my friend laugh. Next session the teacher ask us to sit at the same computer, and after 20mn a guy come to me and ask « Are you pseudo ? » Turns out that the computers really had viruses and they thought it was me ! They threatened to expel me (more…

In 1990 I also edited a friend's autoexec.bat to launch a quick basic script that would falsely check the disk for viruses and then prompt the user to delete their entire hard disk. Of course pressing "n" would print "y" on the screen and then display a fake progress bar along with a warning to not interrupt the operation in order to avoid disk damage.

I definitely had too much free time at the times. :)

Re: The inception bar: a new phishing method

#215

Post by CodeWriter23 »

windsurfer wrote: post #186
CodeWriter23 wrote: post #175

Earlier quoted context omitted.

Mine would log you in. Of course the OS (Oasis) had a way to exec the login program and feed it the password. I stole the teacher’s password and then changed it. He busted me by booting up the system from floppy and typed in the commend to format the hard drive and waited for me to return to the lab after school. I asked him what he was doing and he said he had no choice but to reinstall from scratch because someone…

Why would someone that could boot a system from floppy have to "format the hard drive" instead of just setting a new password?

The instructor had the only admin account and I had changed the password to his account; he was locked out.

Re: The inception bar: a new phishing method

#216

Post by yiyus »

sizzle wrote: post #205
cmcaine wrote: post #201

Earlier quoted context omitted.

> Criminal charges Heh, I don't think so. Teachers don't like to send their pupils to court for silly things. They'd just get told why not to do it again and probably get some detention and stuff. At a uni, the consequences might be more severe.

Yeah it's not like you did anything illicit like change grades or wreak havoc on the network by mass formatting computers, unless you intentionally left out those parts ;)

As long as you do not start a thermonuclear war with Russia you should be ok.

Re: The inception bar: a new phishing method

#217

Post by hvidgaard »

baddox wrote: post #200
joe5150 wrote: post #118

Earlier quoted context omitted.

how is it worse? touch id’s serving as authentication and approval for payment was actually exploited as a scam. I don’t see how this could be done with face id. https://www.wired.com/story/iphone-touch-id-scam-apps/

That’s fair. I never encountered anything like that. In my experience Touch ID was faster, more reliable, and more versatile (e.g. able to be activated with the phone lying on a table without peering over it with my face).

I happen to be in a situation where I have a phone with Face ID and one with Touch ID.

Touch ID with wet or slightly dirty fingers are not good. I've been doing some gardening over Easter and Touch ID is barely working because my fingers are more rough than they normally are.

Face ID on the other hand, works just as expected. It doesn't work optimally if I'm lying down, but that's not a problem for me personally.

Re: The inception bar: a new phishing method

#218

Post by teh_klev »

emmelaich wrote: post #94
Waterluvian wrote: post #51

Earlier quoted context omitted.

In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts. Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message. People will just assume they made a typo and continue as if nothing happened. I've argued before for a genuine out-of-band independent display on…

This was how I gained full sysadmin access to our college's VAX 11/780 mini computer in late 1986. This machine ran pretty much everything from accounting to exam marking. There were three terminals that the admins would logon to pretty much regularly on the "student" side of the computer room. I knocked up a script to run on these three terminals that looked exactly like the standard login and mailed me the credentials entered before displaying the standard "incorrect username/password" (and then silently logoff). The risk for me, had the IT team been a bit more up on their game, was spotting my account being logged into these three terminals for long periods of time with me no-where to be seen :)

I kept silent about this until years afterwards for fear of being chucked out of college, which to be honest would've been a good thing seeing as the course was a waste of time.

Re: The inception bar: a new phishing method

#220

Post by vectorEQ »

jsmith99 wrote: post #101
emmelaich wrote: post #94

Earlier quoted context omitted.

Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts. Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message. People will just assume they made a typo and continue as if nothing happened. I've argued before for a genuine out-of-band independent display on…

That's why Windows can be set to require Ctrl+Alt+Del before login as it can't be intercepted by a fake login screen.

now i know why it makes me type that every time :D guess i never wondered. thanks!
Post reply on HN