Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Innovative Phishing Style

tehaurum.wordpress.com

Post reply on HN
Print view View original

41–50 of 83 posts

Re: An Innovative Phishing Style

#41

Post by code_duck »

fabricexpert wrote: post #39

I'm an engineer (mostly web) and I am very tech savvy, and extremely wary on the internet of scams. However, if this site had to come me via a trusted channel, I would have fallen for it maybe 80% of the time. I hardly ever login to steam as it's always running and while I have 2FA my password would have been stolen in this attack for sure. I don't think teenagers and non-techy users would stand a chance against this…

Non-techy users don’t really stand a chance against anything, especially when you consider the attackers only need to get .1% for meaningful results.

Re: An Innovative Phishing Style

#42

Post by code_duck »

WorkLifeBalance wrote: post #19
cyberjunkie wrote: post #15

I will vouch for the author of this article. Smart kid! On a slightly off-topic, I think it's safe to say that trading and farming items in popular games, is responsible for cheaters, unfair practices, and in turn developers churning out more of these. I hope we can return to games, where I pay for a title for its entertainment value, bar of all loopholes and caveats.

It's a stretch to say it results in cheaters, people have been writing cheats since quakeworld.

The rate may have accelerated due to present incentives.

Re: An Innovative Phishing Style

#43

Post by lokedhs »

quietbritishjim wrote: post #32
Tepix wrote: post #10

This is hard to defend against, but changing the default colour scheme (also used for every window title bar) helps somewhat.

A good solution is to force popup windows to open as a tab in the current window, so that the address bar is absolutely always in the same place. This distorts the popup window because it can't change size but that's a small price to pay. I find it annoying that any website should open a new window anyway. I'm not sure if this is possible in Chrome, or if so how to do it, but in Firefox the setting is browser.link.op…

If you go to the page, you'll notice that they are not displaying a popup. Instead, they have recreated the entire UI experience, and if you're on Windows the only way to tell that something fishy is going on is if you try to move the window and you'll notice you can't move it outside the bounds of the parent Window.

It's incredibly well done, and I was almost fooled by it when I went to the web site. If I hadn't been using Qubes OS where my dispvm's are using red borders, I probably wouldn't have noticed at all.

Re: An Innovative Phishing Style

#44

Post by julianwachholz »

chii wrote: post #20
cbg0 wrote: post #6

Browsers should implement some mechanisms to combat this type of phishing. I've gone ahead and reported this as a phishing site on Google safe browsing and other services.

> Browsers should implement some mechanisms to combat this type of phishing. combatting this doesn't require browsers - you can have a passwordless login mechanism (like email links!). Or, if browsers do indeed want to combat issues such as these, we'd need support for client-side certs (so you can login using a key-pair!), rather than username/password. Or, rely in a tool like lastpass to consistently enter the cred…

You can see in the screenshots that the author indeed uses LastPass. No autofill suggestion by your password manager (even your browser's built-in one) in the login fields would be a dead giveaway in this case.

Re: An Innovative Phishing Style

#45

Post by quietbritishjim »

lokedhs wrote: post #43
quietbritishjim wrote: post #32

Earlier quoted context omitted.

A good solution is to force popup windows to open as a tab in the current window, so that the address bar is absolutely always in the same place. This distorts the popup window because it can't change size but that's a small price to pay. I find it annoying that any website should open a new window anyway. I'm not sure if this is possible in Chrome, or if so how to do it, but in Firefox the setting is browser.link.op…

If you go to the page, you'll notice that they are not displaying a popup. Instead, they have recreated the entire UI experience, and if you're on Windows the only way to tell that something fishy is going on is if you try to move the window and you'll notice you can't move it outside the bounds of the parent Window. It's incredibly well done, and I was almost fooled by it when I went to the web site. If I hadn't bee…

> they are not displaying a popup

But that's exactly my point! If you have set your browser to make all popups appear as a tab taking up the whole of your existing window (and adding an entry to your tab list), and then a fake one looks like a separate window, then it will stick out as fake immediately. For me, a browser-like window within the boundary of my actual browser is so foreign that I wouldn't even consider the possibility that it's real.

Re: An Innovative Phishing Style

#46

Post by hycaria »

fabricexpert wrote: post #39

I'm an engineer (mostly web) and I am very tech savvy, and extremely wary on the internet of scams. However, if this site had to come me via a trusted channel, I would have fallen for it maybe 80% of the time. I hardly ever login to steam as it's always running and while I have 2FA my password would have been stolen in this attack for sure. I don't think teenagers and non-techy users would stand a chance against this…

When it's too good to be true, it just isn't. Here, you can avoid all those scams !

Re: An Innovative Phishing Style

#47

Post by hsnewman »

oriettaxx wrote: post #12

Wanna bet that if I call anybody working in a bank, telling them I am from the IT department and I want them to check the new login page (done the way described in this article), they will enter there their login & password?

Well, first, phishing is not calling someone, but at our bank we train our employees monthly about phishing by testing them, and if they fail they must take a class. Serial failures could result up to termination. So, how much you wanna bet?

Re: An Innovative Phishing Style

#48

Post by def_true_false »

askmike wrote: post #29
solarkraft wrote: post #9

Earlier quoted context omitted.

Unthemed Windows & Mac OS will be convincing to a lot, Linux will be pretty hard. Then again those who tinker with their computers are unlikely to fall into this trap.

This specific phishing website mimics an ingame website for Counter-Strike Global Offensive, a shooter game with the vast majority of players using Windows. Linux isn't supported at all and while the game technically runs on a Mac most people don't (or play it with Bootcamp). I would not be surprised if 99% of the audience for this website is using Windows, the vast majority with default themes (and the ones without…

>Linux isn't supported at all

What? Valve games tend to have pretty good Linux support.

Re: An Innovative Phishing Style

#49

Post by owenmarshall »

hsnewman wrote: post #47
oriettaxx wrote: post #12

Wanna bet that if I call anybody working in a bank, telling them I am from the IT department and I want them to check the new login page (done the way described in this article), they will enter there their login & password?

Well, first, phishing is not calling someone, but at our bank we train our employees monthly about phishing by testing them, and if they fail they must take a class. Serial failures could result up to termination. So, how much you wanna bet?

> So, how much you wanna bet?

You're not resigned enough to be on an infosec team, and if you're not on an infosec team you probably don't know the true percentage of how many employees are failing over and over (it's a ton, it's always a ton).

I'd go big :)

Re: An Innovative Phishing Style

#50

Post by tjoff »

LeonM wrote: post #30
milankragujevic wrote: post #22

Earlier quoted context omitted.

Why would it require a credit card to sign up for the free plan? To "prevent" scams and abuse?

It's a common sales technique. People are willing to give their CC details for a free plan since they are not charging anyway. But by the time your site grows, this takes away the friction of switching to a paid plan. Mailgun does the same.

Maybe it's a cultural thing?

I've never come across a situation where anyone would give their CC number for a free service. That gives a really shady impression.

Or expose myself to that risk.

Post reply on HN