How the Syrian Electronic Army Hacked The Onion • Hacker News Board

Re: How the Syrian Electronic Army Hacked The Onion

#61

Post by Sprint » Thu, May 09, 2013, 8:27 AM UTC

nucleardog wrote: post #37

pserwylo wrote: post #9

I often think about creating a browser and email plugin/extension to help with this: - Look at all link tags. - If it looks like a URL (has a scheme at the beginning, or something which resembles a hostname, or a bunch of path or query parameters), inspect the actual link. - If they have different hosts, warn the user, and perhaps give them the option of just visiting what the contents of the link tag say (rather tha…

http://google.com/ onclick="document.location.href=' http://google.com/ http://www.hackersite.com/>http://google.com/ ; Oh, so you check that? How about I just position an invisible element overtop of the valid looking link? Or use the click handler to do a preventDefault/setTimeout? The only way I can think of to even remotely feasibly try and catch this is to just track the last URL clicked if it looks like a FQDN,…

No sane e-mail client executes Javascript from mails.

Re: How the Syrian Electronic Army Hacked The Onion

#62

Post by 5555624 » Thu, May 09, 2013, 9:30 AM UTC

mjn wrote: post #45

mentat wrote: post #24

Earlier quoted context omitted.

That's odd because I never do. I'm using two-factor and I only have to retype login information when that expires (approximately 30 days I believe.) Also, someone did phish my Google cookies and Google immediately shutdown my account and made me type in something from a text to reactivate my account. Overall I'm pretty happy with both of those circumstances.

Good point; I wonder how many people take that approach. I personally tend to log out of Gmail after I read my email, which signs me out of my Google Account fairly regularly. But maybe that's an unusual use pattern.

I always log out of my Gmail account when I am done reading my e-mail, as well. Until recently, when I've come across several people who stay logged in all the time, I thought that was the 'normal' use pattern. Then again, I'm old and "back in the day" you always logged out of an application/system when you were done.

Re: How the Syrian Electronic Army Hacked The Onion

#63

Post by dmdeller » Thu, May 09, 2013, 9:57 AM UTC

CyberDroiD wrote: post #59

I think it is hilarious that people still click on links in e-mails. Just go to the website directly via a URL. Don't ever click on links in e-mails. Once you learn this, you're much safer.

People do what they're told. Or more accurately, they do the last thing they're told.

The IT department yells at them not to click any links in emails. But then, every legitimate web site also still routinely sends emails instructing their users to click links within.

Re: How the Syrian Electronic Army Hacked The Onion

#64

Post by swombat » Thu, May 09, 2013, 11:40 AM UTC

It's good to see that the Syrian regime has its priorities well thought through (assuming this has anything to do with Syria). First, hack the Onion. Then, fight off the rebels.

Re: How the Syrian Electronic Army Hacked The Onion

#65

Post by yebyen » Thu, May 09, 2013, 12:50 PM UTC

plorkyeran wrote: post #30

danielweber wrote: post #14

Earlier quoted context omitted.

My brain is a bit fried, but what about a rule that "if the text contained in the tag is a FQDN, it should match the FQDN in the href exactly"? What are the false positives?

Things like Google results that go through a redirector for click tracking.

So, another practice that should be highlighted and made to stop.

Re: How the Syrian Electronic Army Hacked The Onion

#66

Post by bjhoops1 » Thu, May 09, 2013, 1:58 PM UTC

mafro wrote: post #54

bjhoops1 wrote: post #31

Wait, did did The Onion actually get hacked? I just assumed that was a joke. Now I'm confused...

Notice that the Onion Tech Blog is an entirely new site with a single post. Presumably because if this was posted on theonion.com no one would've believed it.

That's wild. Yeah, I read both of the Syrian Electronic Army articles, but it never occurred to me they had actually been targeted. That makes a "SEA has some fun before their inevitable deaths" a bit cruel perhaps. Since that could very well happen.

Re: How the Syrian Electronic Army Hacked The Onion

#67

Post by RegEx » Fri, May 10, 2013, 3:13 AM UTC

mig39 wrote: post #20

RegEx wrote: post #15

Earlier quoted context omitted.

2FA is great, but it wouldn't save you here if you ask it to remember you for 30 days.

Can you explain? I use 2FA and tell it to remember me on this device, right? If a Syrian hacker phished my password, he wouldn't be able to login on his system, would he?

You're completely right. I was too focused on the fact that 2FA doesn't text you every time you log in, meaning a 2FA user wouldn't find a google login prompt without a text code requirement abnormal. They couldn't login from their own machines - that's the whole point! Silly me.

Re: How the Syrian Electronic Army Hacked The Onion

#68

Post by RegEx » Fri, May 10, 2013, 3:16 AM UTC

jonknee wrote: post #47

ben1040 wrote: post #2

One more reason to use 2FA on your Google Apps account.

Why not? If you think you're logging in you'll also need to enter the 2FA code and if you do that the attacker can get an active session.

The attacker (most likely) wouldn't know the phone number, so the user would have to recognize that the text prompt isn't displaying the last 4 digits of their phone number like it usually does. Then again, if you're already oblivious to the fact you're not on an official google login form, it's completely possible to miss that as well.