Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The fake browser update scam gets a makeover

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 196 posts

Re: The fake browser update scam gets a makeover

#31

Post by taway1237 »

jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

IPFS along with ipfs http gateways is also abused like this a lot. It's hopeless to try to take things like this down, but in general taking down domains is hard.

Re: The fake browser update scam gets a makeover

#32

Post by taway1237 »

jdjxhwvsh wrote: post #24

> The company said all addresses associated with the spread of the malware have been blacklisted. I thought web3 was supposed to be uncensored so we could serve and download all the malware we wanted?

The company here is the centralised service that josts the API, "real" data is still there.

Re: The fake browser update scam gets a makeover

#33

Post by [deleted] »

7moritz7 wrote: post #19

> New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from being taken down by security experts or law enforcement: By hosting the malicious files on a decentralized, anonymous cryptocurrency blockchain Finally a practical use for web3

[deleted]

Re: The fake browser update scam gets a makeover

#34

Post by coldpie »

sysadm1n wrote: post #4

Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessib…

Just install NoScript. Works great.

https://addons.mozilla.org/en-US/firefox/addon/noscript/

Re: The fake browser update scam gets a makeover

#35

Post by berkes »

I get that the angle of BNC here generates views (and outrage and haha blockchain bad).

But the real story is "WordPress websites still hacked in masses".

WordPress, somehow, cannot manage to turn themselves into a secure and tough system. It remains a prime target, it's installations get hacked by the thousands and it's causing real harm at that.

(Yeah, yeah, I know the users, admins, plugins, themes and hosted are to blame. And I know it's possible to truly harden a WP- I've built a WP hosting company that did exactly this. But it's saddening how poor the wider community handles it's security)

Re: The fake browser update scam gets a makeover

#36

Post by klyrs »

sublinear wrote: post #7
sysadm1n wrote: post #4

Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessib…

This isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default stance on HN is always javascript bad .

Your browser is a platform that downloads and runs arbitrary code on your local hardware. "JavaScript bad" doesn't capture the nuance I read in people's comments here, but history shows that JavaScript is a gaping maw of security nightmares.

Re: The fake browser update scam gets a makeover

#37

Post by thedaly »

> More than a decade ago, this site published Krebs’s Three Rules for Online Safety, of which Rule #1 was, “If you didn’t go looking for it, don’t install it.” It’s nice to know that this technology-agnostic approach to online safety remains just as relevant today.

Still a very good practice today.

Re: The fake browser update scam gets a makeover

#39

Post by brazzy »

pyrolistical wrote: post #20

They could also use ipfs as there are many http proxies for it including cloudflare. All proxies would individually need to blacklist the address. In general it is going to be impossible to block content. We need to charge for bytes or something like that. But that produces other problems which could be worse

> We need to charge for bytes or something like that.

I read that 25 year ago as a suggested solution to email spam, and it's many times less feasible today than it was back then.

Re: The fake browser update scam gets a makeover

#40

Post by 7moritz7 »

d11z wrote: post #30
andybak wrote: post #17

I'm just happy to finally see a practical use case for Blockchain technology.

It’s been great for gambling, cybercrime, and enabling the drug trade practically since its inception.

I really think Monero in particular deserves way more criticism for their practice. Bitcoin is one thing, Monero is created for and marketed towards cybercriminals, you don't need to be a communications expert to get that premise. I haven't seen it used once for any legitimate purpose. Atleast with Bitcoin and Ethereum you can get buy some legitimate things like VPNs or NFTs

https://arstechnica.com/information-technology/2021/06/moner...

Post reply on HN