The inception bar: a new phishing method • Hacker News Board

Re: The inception bar: a new phishing method

#51

Post by Waterluvian » Sun, Apr 28, 2019, 2:57 AM UTC

userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

In high school we would screenshot the windows 98 desktop, make it the wallpaper, hide everything, and watch people fluster about.

Re: The inception bar: a new phishing method

#52

Post by 29athrowaway » Sun, Apr 28, 2019, 2:58 AM UTC

Change your system font.

Re: The inception bar: a new phishing method

#53

Post by woliveirajr » Sun, Apr 28, 2019, 2:59 AM UTC

Well, people still believe that they will help a prince from Nigeria.

Also I've seem some old ladies believing that a younger soldier from US needs help taking money out of %some country%.

A fake address bar, with a fake "look, I'm safe" mark on it? Yes, it'll do it.

Re: The inception bar: a new phishing method

#54

Post by burlesona » Sun, Apr 28, 2019, 2:59 AM UTC

doctorless wrote: post #3

Interesting. iOS Safari seems to force the address bar to stay visible on this page.

Safari doesn’t hide the url bar when you employ the “scroll jail” technique he described. It also doesn’t feel right scrolling because he omitted the css property for inertial scrolling in his “scroll jail.”

Re: The inception bar: a new phishing method

#55

Post by skunkworker » Sun, Apr 28, 2019, 3:08 AM UTC

A recent example that I've been seeing more and more is pages taking over some system keyboard shortcuts. I've seen pages taking over Command-F and using their own search interface instead of the browsers. I've found utilities for not messing with copy/paste, but is there a way to block pages with keyboard shortcuts in Chrome?

Re: The inception bar: a new phishing method

#56

Post by dzhiurgis » Sun, Apr 28, 2019, 3:17 AM UTC

userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

Prolly need some sort of ml to parse every image used on device and tag potentially dangerous ones. Wouldn’t be too expensive on devices with tensor units...

Apparently Apple already reports your offensive photos already, can’t imagine why browsing should be treated differently.

Re: The inception bar: a new phishing method

#57

Post by Ayesh » Sun, Apr 28, 2019, 3:18 AM UTC

zzo38computer wrote: post #24

jamesfisher wrote: post #13

Earlier quoted context omitted.

Cool - this attack is perhaps worse! Fullscreen should require a more explicit permission dialog, like webcam access, web push notifications, etc.

At least on my computer there is a permission dialog for the fullscreen API. However, if document scripting is disabled (which is what I have by default anyways) then the link does not do those stuff. (I also use an unusual window layout, so if someone tries to spoof the window layout, it is likely that I can easily see the problem immediately anyways.)

Relax, he was just joking.

Re: The inception bar: a new phishing method

#58

Post by Ayesh » Sun, Apr 28, 2019, 3:22 AM UTC

This worked brilliantly on my Chime Android, and I'm quite surprised the scroll-jail trick worked too.

I suppose the author just wanted a quick PoC, but with enough work, one could mimic an interactive browser address bar, including the menu that with refresh, bookmark, etc and even the HTTPS padlock with security information. Browser UIs being designed in CSS itself, one could easily copy/paste from the browser itself.

Re: The inception bar: a new phishing method

#59

Post by sandworm101 » Sun, Apr 28, 2019, 3:30 AM UTC

walrus01 wrote: post #47

userbinator wrote: post #42

"Ceci n'est pas un UI." This specific example may be new, but the concept of fooling users with websites containing images of the system's own UI is not new --- for example, all the fake antivirus alert boxes. That had a relatively easy mitigation --- using non-default appearance on your system (e.g. an XP-style "you have a virus!" dialog box image would just look silly if you weren't using XP with the default theme)…

I have an unquantified theory that the number of users that can distinguish between a Windows 7/8/10 dialog box that is presented directly by the operating system, versus as an image inside a browser coming from external http/https server, is diminishing greatly every year.

Except all the colorblind people who have altered their system defaults enough that anything internal to the browser will look very out of place.

Re: The inception bar: a new phishing method

#60

Post by b34r » Sun, Apr 28, 2019, 3:41 AM UTC

Yahoo actually tried to do this in 2015 with an internal initiative called “Silver Search” to try and trick Firefox users into using their own yahoo-powered omnibux. I was fucking livid when I found out about it and complained.