Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The inception bar: a new phishing method

jameshfisher.com

Post reply on HN
Print view View original

221–230 of 238 posts

Re: The inception bar: a new phishing method

#221

Post by ehnto »

jfoster wrote: post #210
ehnto wrote: post #166

Earlier quoted context omitted.

It can be more sinister. Although I am sure the other answers are right in some circumstances, I was curious a while ago, so I actually clicked one. Whether you click allow or deny, it shot off a network request to a third party domain. This lets the third party know your browser's user agent, and if they have an exploit for your browser they will send a payload that compromises the browser with the intent of install…

But any click can do that, right? No need for it to be a fake Allow/Deny prompt. The best I can think of is that it does 2 things: 1. Preserves the "true" allow/deny prompt for a time when the user will allow. 2. Lulls the user into a sense of security. The page is nice and/or their browser will ask about anything the page tries to do.

My guess is something to do with needing to have a user prompt certain types of cross site javascript actions.

It also needs to seem legitimate so people click it but don't report it.

Re: The inception bar: a new phishing method

#222

Post by BentFranklin »

Reading this reminded me of the time in the 80s when I discovered hex editors and changed COMMAND.COM to reverse every DOS command. So to get a directory listing you had to type RID, COPY became YPOC, etc. The error message was !sdrawkcaB. I know I'm no hacker but everyone else thought I was.

Re: The inception bar: a new phishing method

#223

Post by WorldMaker »

yjftsjthsd-h wrote: post #179
DownGoat wrote: post #163

Earlier quoted context omitted.

HTTPS everywhere is a good thing. HTTPS was never about protecting against phishing, and has never protected you against phishing. There is no way to educate people about phishing, only way to protect against it is U2F. Education against phishing is not very effective, and only works short term.

Right, but it was pushed as "lock icon means secure" and end users don't distinguish threat models.

Which is arguably why the push is increasingly to "Not Secure" and "Is Maybe Secure" notifications over "Is Secure". Maybe that will help more end users.

Re: The inception bar: a new phishing method

#224

Post by dyoo1979 »

colanderman wrote: post #149

I understand why this was a problem in 1995, but honestly, in 2019, with image recognition technology as advanced as it is now – especially due to efforts by Google – why can't browsers detect this? Surely "does this rectangle look vaguely like a URL bar" is an easier problem to solve than "is this a photograph of a cat"? Sure, image recognition is CPU intensive, but even just checking once every 5 seconds or so woul…

... and people ask why browsers are so complicated.

Re: The inception bar: a new phishing method

#225

Post by geuszb »

cmcaine wrote: post #208
geuszb wrote: post #172

Earlier quoted context omitted.

Thanks. This is a great reference indeed! The challenge is preserving ability for content to control all pixels; without it, the content ecosystem ends up developing single-purpose, generally crappy apps, which isn't necessarily a better thing either... I'm not sure it is the only solution either - what about "secure attention key" type ways to get the system's attention (in this case the browser's), bypassing any co…

Escape will always exit fullscreen in browsers, which is a SAK that is well publicised. We aren't trained to press escape before entering passwords, though.

This gives me an idea... Even in fullscreen, I believe hovering the mouse near the top of the screen will also bring back some controls into view, but temporarily... So there's already some kind of "peek mode" for the controls... Entering this mode while typing a password in a standard password input field might make sense!

Re: The inception bar: a new phishing method

#226

Post by bena »

teh_klev wrote: post #218
emmelaich wrote: post #94

Earlier quoted context omitted.

Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts. Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message. People will just assume they made a typo and continue as if nothing happened. I've argued before for a genuine out-of-band independent display on…

This was how I gained full sysadmin access to our college's VAX 11/780 mini computer in late 1986. This machine ran pretty much everything from accounting to exam marking. There were three terminals that the admins would logon to pretty much regularly on the "student" side of the computer room. I knocked up a script to run on these three terminals that looked exactly like the standard login and mailed me the credenti…

I mocked up something similar on a VAX system at school as well.

Re: The inception bar: a new phishing method

#227

Post by CodeWriter23 »

mastef wrote: post #180
CodeWriter23 wrote: post #175

Earlier quoted context omitted.

Mine would log you in. Of course the OS (Oasis) had a way to exec the login program and feed it the password. I stole the teacher’s password and then changed it. He busted me by booting up the system from floppy and typed in the commend to format the hard drive and waited for me to return to the lab after school. I asked him what he was doing and he said he had no choice but to reinstall from scratch because someone…

Interesting reaction. What was the thought process behind it? E.g. what did you use them for

I became the help desk. It seemed like an elevated status but in reality it meant I got some of the drudgery piled on to me. Password changes, adding students, disk quota increases and such.

Re: The inception bar: a new phishing method

#228

Post by yencabulator »

akersten wrote: post #177
geuszb wrote: post #172

Earlier quoted context omitted.

Thanks. This is a great reference indeed! The challenge is preserving ability for content to control all pixels; without it, the content ecosystem ends up developing single-purpose, generally crappy apps, which isn't necessarily a better thing either... I'm not sure it is the only solution either - what about "secure attention key" type ways to get the system's attention (in this case the browser's), bypassing any co…

Those are some good ideas too - "only solution" was a bit hyperbolic - but I do think our options are limited, especially on mobile. The Secure Attention Key is interesting, but would need the user to know you press it. And on mobile, it would probably need to be a dedicated button on the device, since I could just fake the on screen keyboard too. Password manager auto-fill failing would clue a savvy user that someth…

Edge swipe from the top could be made impossible to hijack.

Re: The inception bar: a new phishing method

#229

Post by dcbadacd »

yjftsjthsd-h wrote: post #179
DownGoat wrote: post #163

Earlier quoted context omitted.

HTTPS everywhere is a good thing. HTTPS was never about protecting against phishing, and has never protected you against phishing. There is no way to educate people about phishing, only way to protect against it is U2F. Education against phishing is not very effective, and only works short term.

Right, but it was pushed as "lock icon means secure" and end users don't distinguish threat models.

Past malpractice shouldn't be the reason for no future improvement. It's simply the time to relearn.

Re: The inception bar: a new phishing method

#230

Post by fredley »

lysp wrote: post #74

There was a similar thing reported a few months ago relating to a fake Facebook social login popup. https://myki.com/blog/facebook-login-phishing-campaign/ It adds the browser elements to make it appear like a verified popup. The only reason it was discovered was due to users complaining that the password manager did not auto-populate the form. https://news.ycombinator.com/item?id=19188386

This is pretty scary. Is there any way a desktop browser can mitigate against this sort of attack?
Post reply on HN