Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The fake browser update scam gets a makeover

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 196 posts

Re: The fake browser update scam gets a makeover

#41

Post by thedaly »

andybak wrote: post #18
simion314 wrote: post #8

Earlier quoted context omitted.

>I'll never understand why the default stance on HN is always javascript bad. I am a web dev, and I agree that JS on the web is bad for pages that should be just documents like a news webpage or wiki page. JS makes sense for applications like a video game, video/audio/level/text editor, or some internal app that your company trust, but for random untrusted document pages JavaScript is a detriment, even if we only con…

You're a web developer but your mental map of the web consists of "documents" on one end and "applications like a video game, video/audio/level/text editor(s)" on the other? You haven't in your career, stumbled across web (sites/apps) that sit somewhere on the spectrum between the extremes of "document" vs "app"? It strikes me that there's a fairly even distribution between those two points - even if we discount all…

> Progressive enhancement is a strategy in web design that puts emphasis on web content first, allowing everyone to access the basic content and functionality of a web page, whilst users with additional browser features or faster Internet access receive the enhanced version instead.

Why isn't this still the norm?

Re: The fake browser update scam gets a makeover

#42

Post by flowless »

pyrolistical wrote: post #20

They could also use ipfs as there are many http proxies for it including cloudflare. All proxies would individually need to blacklist the address. In general it is going to be impossible to block content. We need to charge for bytes or something like that. But that produces other problems which could be worse

I’ve recently received a scam email with ‘Incoming mail delayed’ subject saying that my mailbox is almost full.

It contained IPFS url with a login form sending data to some hacked site so this is already a standard practice.

It is also a bit amusing when you host your own mailserver for years.

Re: The fake browser update scam gets a makeover

#43

Post by gumby »

warkdarrior wrote: post #23
jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

Sounds like we should poison this vector (and IPFS) by uploading copyrighted movie torrents to this free storage system. For a change we’d be doing good.

Re: The fake browser update scam gets a makeover

#44

Post by fsflover »

7moritz7 wrote: post #40
d11z wrote: post #30

Earlier quoted context omitted.

It’s been great for gambling, cybercrime, and enabling the drug trade practically since its inception.

I really think Monero in particular deserves way more criticism for their practice. Bitcoin is one thing, Monero is created for and marketed towards cybercriminals, you don't need to be a communications expert to get that premise. I haven't seen it used once for any legitimate purpose. Atleast with Bitcoin and Ethereum you can get buy some legitimate things like VPNs or NFTs https://arstechnica.com/information-techno…

Doesn't TorBroswer also deserve more criticism by that logic? Here is their reply to this:

https://support.torproject.org/abuse/

Re: The fake browser update scam gets a makeover

#45

Post by gumby »

d11z wrote: post #30
andybak wrote: post #17

I'm just happy to finally see a practical use case for Blockchain technology.

It’s been great for gambling, cybercrime, and enabling the drug trade practically since its inception.

Easier to do money laundering this way instead of selling trump a house.

Re: The fake browser update scam gets a makeover

#46

Post by dmoy »

gumby wrote: post #43
warkdarrior wrote: post #23

Earlier quoted context omitted.

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

Sounds like we should poison this vector (and IPFS) by uploading copyrighted movie torrents to this free storage system. For a change we’d be doing good.

Shoot don't even need a movie, just a picture of Mickey Mouse

Re: The fake browser update scam gets a makeover

#47

Post by pcwalton »

sysadm1n wrote: post #4

Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessib…

I would argue that a world that didn't have JS would make these types of attacks more common, not less common. Because in that world, people would have to download desktop apps for everything, which would make people used to downloading desktop apps from random Web pages, which would make malware easier to distribute.

In fact, we don't have to imagine that world: it was the world of the late 90s.

Re: The fake browser update scam gets a makeover

#48

Post by DrThunder »

thedaly wrote: post #37

> More than a decade ago, this site published Krebs’s Three Rules for Online Safety, of which Rule #1 was, “If you didn’t go looking for it, don’t install it.” It’s nice to know that this technology-agnostic approach to online safety remains just as relevant today. Still a very good practice today.

Easier to just remove local admin from end-users than hope they'll act intelligently.

Re: The fake browser update scam gets a makeover

#49

Post by fsflover »

sysadm1n wrote: post #4

Seriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessib…

Or alternatively, you can pursue security through compartmentalization. My VM for random browsing has JS enabled, but if I'm hacked, the attacker will not get access to any files. Also the VM is destroyed when the browser is closed.
Post reply on HN