Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crates.io phishing attempt

fasterthanli.me

Post reply on HN
Print view View original

61–70 of 83 posts

Re: Crates.io phishing attempt

#61

Post by ziml77 »

coldfoundry wrote: post #4

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

Again? Phishing is a constant threat. And it's easy to fall for them because you only need to drop your guard once to become a victim. Stress, tiredness, or intoxication can all contribute to even someone who thinks they're good at spotting phishing attempts suddenly falling for one.

Re: Crates.io phishing attempt

#62

Post by ranger207 »

whatamidoingyo wrote: post #22
stravant wrote: post #11

Earlier quoted context omitted.

People realized that past phishing attempts were quite badly constructed and a well constructed one is actually really easy to fall for.

> People realized that past phishing attempts were quite badly constructed I seem to recall that the typos and grammar errors were intentional. This gets rid of skeptical people, and you're left with those who are extremely gullible and likely to fall for it.

This current spate of attacks might be _because_ of that, in fact. Enough people know that phishing attacks are obviously low quality, so when they see a well-constructed message they're less suspicious

Re: Crates.io phishing attempt

#63

Post by tialaramex »

immibis wrote: post #37
tialaramex wrote: post #30

Earlier quoted context omitted.

> Don’t worry, when they actually target you, you’ll be caught. When they target me, which happens, it doesn't work because of WebAuthn. Buy a Security Key. If you think you might lose it, buy at least two more. For critical sites like GitHub (which was targeted here) set up your Security Keys and get into the habit of relying on them. It's the same philosophy as Rust itself, machines are really good at diligently pe…

"Your WebAuthn key enrollment period has expired. Please log in to re-enroll a new key." Something similar to this was in the recent npmjs thing.

I can't find any trace of such a thing, do you have links?

What would it even mean to "log in" if they reject my authenticator ? Logging in is what it's for.

Re: Crates.io phishing attempt

#64

Post by latexr »

ranger207 wrote: post #20

If you get a message (text, email or call), it's best to not trust the contents of the message until you verify it by logging in or whatever yourself. If crates.io says you have a problem, close the email and go to crates.io yourself. If your bank calls you, hang up and log in or call their support number yourself. Don't trust anyone contacting you for sensitive stuff

Same applies in person. I’ve had people knocking on my door offering a discount on my electric bill.

— You just need to do accept and you’ll pay less.

— But I don’t want to switch providers, I’m happy with the current one.

— Oh no, you’ll stay with the same provider, we’re with them, that doesn’t change.

— Alright, then I’ll call the company to discuss this further and get the discount.

— Unfortunately, this is only valid this way. Not by calling or online.

— Then I’m not interested. Bye.

One of my neighbours was tricked at a different time by a similar scam, forcing them into a contract with a different company.

Re: Crates.io phishing attempt

#65

Post by dmarto »

autoexec wrote: post #60
dmarto wrote: post #2

Heh, the phishing page now redirects to a rickroll.

All I get is the message "onto the next package manager. WHOHOOO! - stdout"

And now the phishing page is advertising data for sale:

> crates.io db along with juicy tokens for sale. email for buying! (free leak if no offer till sunday >.So far: rickroll → Strong Dog vs Weak Dog meme → future plans → advertisement.

Re: Crates.io phishing attempt

#67

Post by diggan »

inetknght wrote: post #59
rustc wrote: post #44

Earlier quoted context omitted.

> If your bank calls you, hang up and log in or call their support number yourself. And don't trust the number you see on Google. Google is known to show scammers' phone numbers in featured snippets or in their new "AI Mode". Click on the link and make sure it's the correct site before trusting the number.

Call the number on the back of your card. You do still have a physical card, right? You don't just have a banking app? Apps can be... uhhh... wrong...

Phone number on the card? My latest card doesn't even have the card number itself, validity dates or CVV number on it anymore, just the bank logo, some background graphics and some words about how safe it is and that it was made with recyclable materials.

Re: Crates.io phishing attempt

#68

Post by quectophoton »

otterley wrote: post #28

GitHub supports passkeys. Just a friendly reminder for everyone to update their accounts to require passkey auth to prevent credential stealing. https://docs.github.com/en/authentication/authenticating-wit...

This prompted me to check, and seems like KeePassXC supports storing passkeys, at least if you use the browser extension and enable a flag in its config. Until now I had thought it only supported unlocking your database with passkeys, I didn't know about it being able to actually store them.

I guess I'll try setting them up on some unimportant website to see for myself what all the hype is about.

Re: Crates.io phishing attempt

#69

Post by otterley »

quectophoton wrote: post #68
otterley wrote: post #28

GitHub supports passkeys. Just a friendly reminder for everyone to update their accounts to require passkey auth to prevent credential stealing. https://docs.github.com/en/authentication/authenticating-wit...

This prompted me to check, and seems like KeePassXC supports storing passkeys, at least if you use the browser extension and enable a flag in its config. Until now I had thought it only supported unlocking your database with passkeys, I didn't know about it being able to actually store them. I guess I'll try setting them up on some unimportant website to see for myself what all the hype is about.

Whatever you do, don't export passkeys with KeePassXC. It exports them in the clear. It's not considered kosher to export passkeys from any credential manager's data store anyway.

Re: Crates.io phishing attempt

#70

Post by tialaramex »

diggan wrote: post #67
inetknght wrote: post #59

Earlier quoted context omitted.

Call the number on the back of your card. You do still have a physical card, right? You don't just have a banking app? Apps can be... uhhh... wrong...

Phone number on the card? My latest card doesn't even have the card number itself, validity dates or CVV number on it anymore, just the bank logo, some background graphics and some words about how safe it is and that it was made with recyclable materials.

Have you checked the other side? My newest bank cards are very minimal on the front, but all the information was printed on the back.
Post reply on HN