Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Innovative Phishing Style

tehaurum.wordpress.com

Post reply on HN
Print view View original

31–40 of 83 posts

Re: An Innovative Phishing Style

#31

Post by megous »

kilburn wrote: post #17

Doesn't OAuth and similar work by redirecting you to the login page? I don't recall ever seeing a version that opens a popup to get you to login. This would immediately raise my suspicions on this basis (popup windows can be controlled by the opening website to a large degree!).

Only if the opener is on the same domain.

Anyway, this is where desktop uniformity hurts. Using i3wm it would be obvious to me what's happening, since window decorations would be different and new browser windows open in a stack, and not on top of other windows.

Re: An Innovative Phishing Style

#32

Post by quietbritishjim »

Tepix wrote: post #10

This is hard to defend against, but changing the default colour scheme (also used for every window title bar) helps somewhat.

A good solution is to force popup windows to open as a tab in the current window, so that the address bar is absolutely always in the same place. This distorts the popup window because it can't change size but that's a small price to pay. I find it annoying that any website should open a new window anyway. I'm not sure if this is possible in Chrome, or if so how to do it, but in Firefox the setting is browser.link.open_newwindow.restriction.

It would also help if Windows had proper contrast between the title bars of active and inactive windows, since then it would be obvious there's a problem from the two simultaneously active top-level windows. The contrast was excellent from at least Windows 3.1 through to Windows XP (colour vs greyscale) but in Windows 7 it dropped dramatically, and it's almost indistinguishable in Windows 10. Microsoft seems to have an endemic problem of redesigning visual styles for the sake of it, even if it makes things worse, presumably to justify the wages of full-time designer staff.

Re: An Innovative Phishing Style

#33

Post by pests »

kevincox wrote: post #5
jarcane wrote: post #3

The fake pop-up window isn't new. This does seem a fairly well engineered version of the trick, but sites have been pulling this shit since the 90s. It has been a while since I've seen it though, but then I use an ad blocker so I suppose I wouldn't.

I think the new thing is that they implemented chrome dev tools in the popup window in a convincing enough manner. This sounds far more extreme then any previous example I have heard of on the web.

Chrome DevTools is already implemented with web tech so it would just be including and using it correctly.

Furthermore modern Windows styling and even Chromes tab strip has been reimplemented in HTML/CSS/JS due to people theming Election apps.

I wouldn't be surprised if this site just cobbled together those existing libraries.

Re: An Innovative Phishing Style

#34

Post by jstanley »

askmike wrote: post #26
chii wrote: post #20

Earlier quoted context omitted.

> Browsers should implement some mechanisms to combat this type of phishing. combatting this doesn't require browsers - you can have a passwordless login mechanism (like email links!). Or, if browsers do indeed want to combat issues such as these, we'd need support for client-side certs (so you can login using a key-pair!), rather than username/password. Or, rely in a tool like lastpass to consistently enter the cred…

The problem with e-mail links is that if the e-mail inbox gets hacked the hacker now has access to all the user's services.

Unlike with passwords, where the attacker has to go to the extra step of clicking "I forgot my password" in order to convert access to the email inbox into access to all the user's services.

Re: An Innovative Phishing Style

#35

Post by gear54rus »

milankragujevic wrote: post #22
benatkin wrote: post #13

Apparently Cloudflare doesn't require a credit card to sign up for the free plan. Not that scammers couldn't figure out how to provide a credit card that wouldn't trace back to them.

Why would it require a credit card to sign up for the free plan? To "prevent" scams and abuse?

From their perspective, how else would you track unique users on the internet? By asking for CC number, you are outsourcing the identity verification to a bank. It is certainly more 'secure' than email, what other options would you suggest?

Re: An Innovative Phishing Style

#36

Post by kilburn »

michaelt wrote: post #28
kilburn wrote: post #17

Doesn't OAuth and similar work by redirecting you to the login page? I don't recall ever seeing a version that opens a popup to get you to login. This would immediately raise my suspicions on this basis (popup windows can be controlled by the opening website to a large degree!).

I don't recall ever seeing a version that opens a popup to get you to login. You'll often get a login pop-up if you pay with paypal - they call it the mini-browser in their documentation [1] - and I guess the intention is you don't have to leave the merchant's website in you main browser window. [1] https://developer.paypal.com/docs/classic/adaptive-payments/...

I think this was a bad option they offered in the past and now they are stuck with it. Notice the alert at the top of that page:

> Important: Adaptive Payments is now a limited release product. It is restricted to select partners for approved use cases and should not be used for new integrations without guidance from PayPal.

In other words, popup loading another website is just wrong and should be avoided by both website makers and their users.

Re: An Innovative Phishing Style

#37

Post by aembleton »

quietbritishjim wrote: post #32
Tepix wrote: post #10

This is hard to defend against, but changing the default colour scheme (also used for every window title bar) helps somewhat.

A good solution is to force popup windows to open as a tab in the current window, so that the address bar is absolutely always in the same place. This distorts the popup window because it can't change size but that's a small price to pay. I find it annoying that any website should open a new window anyway. I'm not sure if this is possible in Chrome, or if so how to do it, but in Firefox the setting is browser.link.op…

BTW, you need to set browser.link.open_newwindow.restriction to 0

http://kb.mozillazine.org/Browser.link.open_newwindow.restri...

Re: An Innovative Phishing Style

#38

Post by fabricexpert »

LeonM wrote: post #30
milankragujevic wrote: post #22

Earlier quoted context omitted.

Why would it require a credit card to sign up for the free plan? To "prevent" scams and abuse?

It's a common sales technique. People are willing to give their CC details for a free plan since they are not charging anyway. But by the time your site grows, this takes away the friction of switching to a paid plan. Mailgun does the same.

Also prevents freeloaders from signing up, or people who will never have any means to pay (e.g. minors)

Re: An Innovative Phishing Style

#39

Post by fabricexpert »

I'm an engineer (mostly web) and I am very tech savvy, and extremely wary on the internet of scams. However, if this site had to come me via a trusted channel, I would have fallen for it maybe 80% of the time.

I hardly ever login to steam as it's always running and while I have 2FA my password would have been stolen in this attack for sure.

I don't think teenagers and non-techy users would stand a chance against this.

Post reply on HN