Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The fake browser update scam gets a makeover

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 196 posts

Re: The fake browser update scam gets a makeover

#81

Post by 7moritz7 »

fsflover wrote: post #44
7moritz7 wrote: post #40

Earlier quoted context omitted.

I really think Monero in particular deserves way more criticism for their practice. Bitcoin is one thing, Monero is created for and marketed towards cybercriminals, you don't need to be a communications expert to get that premise. I haven't seen it used once for any legitimate purpose. Atleast with Bitcoin and Ethereum you can get buy some legitimate things like VPNs or NFTs https://arstechnica.com/information-techno…

Doesn't TorBroswer also deserve more criticism by that logic? Here is their reply to this: https://support.torproject.org/abuse/

People abandon all analysis when it comes to Tor. Yes, Tor serves a legitimate purpose (in contrast to Monero, noone has changed my mind yet), but I'd argue that value would also be fullfilled without onion services. If I have to gess 99 % of onion services are illegal activity. The only exception to this rule is SecureDrop which I am certain could be realized with just a regular server too. You need to self host it anyways.

Re: The fake browser update scam gets a makeover

#82

Post by fturst »

d11z wrote: post #78
staplers wrote: post #76

Earlier quoted context omitted.

The suffocating irony of this forum being called "Hacker News" when it is filled with comments like this never fails to amaze me. A truly unimaginative bunch.

Could you give some other concrete, practical examples of use cases for cryptocurrencies instead of the passive-aggressive snark?

Preserving privacy, reliable transactions with no, i repeat, no bank or govmnt involvement, no kyc. No/low fees (on some currencies), public immutable databases...

Re: The fake browser update scam gets a makeover

#83

Post by fturst »

7moritz7 wrote: post #40
d11z wrote: post #30

Earlier quoted context omitted.

It’s been great for gambling, cybercrime, and enabling the drug trade practically since its inception.

I really think Monero in particular deserves way more criticism for their practice. Bitcoin is one thing, Monero is created for and marketed towards cybercriminals, you don't need to be a communications expert to get that premise. I haven't seen it used once for any legitimate purpose. Atleast with Bitcoin and Ethereum you can get buy some legitimate things like VPNs or NFTs https://arstechnica.com/information-techno…

So Tor and I2P also should be criticized? IMO, something being away enough from the government that it starts to get abused shows how secure/private it is.

Re: The fake browser update scam gets a makeover

#84

Post by numtel »

jbaczuk wrote: post #80
numtel wrote: post #73

Earlier quoted context omitted.

Anybody can spin up a mirror node, even on the mostly centralized BSC. This is just a misunderstanding. Every public blockchain works this way afaik. I've even made a site for hosting webpages on Optimism: https://newgeocities.com The real discussion imo is that blockchain node operators should be pressured to respond to concerns about unwanted content. There's no reason they can't coordinate on filters in the same w…

seems like "blockchain" has nothing to do with it... they could just host the file on a server they do control. "Blockchains" aren't magic.

It's not magic but it is a radically different pricing model: pay once, host forever.

I see it as a massive bet on storage prices continuing to decrease.

Re: The fake browser update scam gets a makeover

#85

Post by anon25783 »

TeMPOraL wrote: post #3
keane wrote: post #2

The quality of full screen takeover pages seems to have dramatically risen recently. My family members, who don’t know the Escape key exists, accidentally click one from a banner ad every week now taking them to a page like examplefoobar38561.cloudfront.net and the use of elements that imitate browser or OS chrome (generally imitating Windows Defender or similar) has reached near perfection. All browsers should have…

Maybe one of these days scammers will release their UI elements as web components or React whatever, so we'll finally get some high-quality JS versions of native UI elements; maybe we could get Electron app developers to use them.

introducing the new native-feel component library for cross-platform development, Crimes.js

Re: The fake browser update scam gets a makeover

#86

Post by [deleted] »

financypants wrote: post #74
warkdarrior wrote: post #23

Earlier quoted context omitted.

According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BS…

Free storage and hosting? Does this mean anyone can store random stuff in smart contracts and read from it for free?

[deleted]

Re: The fake browser update scam gets a makeover

#87

Post by theamk »

Tokumei-no-hito wrote: post #69
theamk wrote: post #58

Earlier quoted context omitted.

Browsers cannot talk to blockchain directly, they need to go through some HTTPS server... And that server can block any request. I am kinda surprised you haven't heard about this already. This has been used in the past to take down NFTs [0] and to make Bitcoins unspendable [1] It's the famous "on chain only" caveat: all the decentralized systems are only decentralized in the ideal world, if nothing except the chain e…

to be clear the caveat has a caveat - the centralized control you're talking about is through public (privately hosted) APIs. anyone running a node on the chain can still send and receive whatever they want. unless the majority of the chain chooses to black list addresses, then you have a hard fork because the nodes don't have a consensus on the protocol (open vs black listing).

I don't see how this changes my point? Yes, on the chain you can send and receive any data you want. But if all you want to do is to exchange meaningless data, you don't need a blockchain for that.

An in practice, there was no hard fork, and yet Moxie's NFT was "removed" from opensea and from the metamask wallet. Sure, someone with a full client can still see the NFT and _techinically_ all the data is there.. and yet the data is value-less. Would you pay any amount of money for NFT you cannot show off to anyone nor use with any online service?

The same goes with bitcoin - sure, the chain will happily process your bitcoin transactions from the mixer and accept your gas fees. So if you are only looking on the chain, it is all fine and decentralized. But if you are actually trying to withdraw the money, then your accounts get blocked. So in practice, this may not be 100% useless, but this is still significantly less useful than "clean" bitcoin. And no hard fork or even community consensus required.

Re: The fake browser update scam gets a makeover

#88

Post by batch12 »

jkaptur wrote: post #16

So the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the…

I looked at an early flavor of this and spent a while reversing the malware. This was the same malware that hit McClatchy and MediaNews a few years ago (2020, but I remember being concerned about the malware's practice of replacing the DOM with the lure and how that could have been further abused to inject fake content). It ran on many regional media sites like Denver Post, etc. This one did a lot of cleverness like fingerprinting a host via JS to ensure it was legitimate, geolocating an IP, only serving the bait once to an IP, and making sure the referrer header was set-- among other things. They also had a nice pool of domains, but they were discoverable by looking for artifacts specific to the lure. It was an interesting campaign to dig into and watch evolve.

If I recall too, the intermediate domains appeared to all be subdomains from (possibly) compromised godaddy accounts.

Re: The fake browser update scam gets a makeover

#89

Post by yesco »

livueta wrote: post #56
pcwalton wrote: post #47

Earlier quoted context omitted.

I would argue that a world that didn't have JS would make these types of attacks more common, not less common. Because in that world, people would have to download desktop apps for everything, which would make people used to downloading desktop apps from random Web pages, which would make malware easier to distribute. In fact, we don't have to imagine that world: it was the world of the late 90s.

That's a very real problem, but one would hope that package managers would be a lot more widely adopted in that counterfactual world. Maybe that's a naive hope.

Most people call them app stores these days

Re: The fake browser update scam gets a makeover

#90

Post by Tokumei-no-hito »

theamk wrote: post #87
Tokumei-no-hito wrote: post #69

Earlier quoted context omitted.

to be clear the caveat has a caveat - the centralized control you're talking about is through public (privately hosted) APIs. anyone running a node on the chain can still send and receive whatever they want. unless the majority of the chain chooses to black list addresses, then you have a hard fork because the nodes don't have a consensus on the protocol (open vs black listing).

I don't see how this changes my point? Yes, on the chain you can send and receive any data you want. But if all you want to do is to exchange meaningless data, you don't need a blockchain for that. An in practice, there was no hard fork, and yet Moxie's NFT was "removed" from opensea and from the metamask wallet. Sure, someone with a full client can still see the NFT and _techinically_ all the data is there.. and yet…

> But if all you want to do is to exchange meaningless data, you don't need a blockchain for that.

in this context it does matter. cloudlfare and any other "web 2" (for lack of a better encompassing term) is censorable. they can use any other HTTP API (or host their own although that could be blocked by a VPS eventually).

i agree with the rest of what you're saying. the reality is that it's a decentralized world that inherently requires centralized bridging. the KYC push was the turning point for controlling all the on/off ramps. it's still possible to exchange entirely on chain but the recipient would have to acknowledge that if the sender is black listed then their received holdings are subject to the same control.

as long as there is "border control" back to tradfi then there will always be a centralized constraint on the concept. in theory we may see a future where people have enough markets for remaining purely on chain but anything related to government fiat (housing, taxes etc) will by definition remain centralized.

Post reply on HN