Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If malware authors ever learn how to spell we're all screwed

hanselman.com

Post reply on HN
Print view View original

81–90 of 106 posts

Re: If malware authors ever learn how to spell we're all screwed

#81

Post by jaylevitt »

gerts wrote: post #75
csmeder wrote: post #50

Earlier quoted context omitted.

Easy solution. Logging in takes two passwords. After you enter your first password (first 8 chars of your 16 char password) you are presented with an image of a Tiger. You now trust the system. (The picture of a tiger was your secret image). You now enter your second password (the remaining 8 chars of your 16 digit password). See site key: http://en.wikipedia.org/wiki/SiteKey

SiteKey is completely susceptible to Man-in-the-middle (unless the user is a scrupulous cookie-manager and refuses to re-authenticate a computer more than once), so adds minimal value over regular SSL.

SiteKey is also trivially vulnerable to the attack known as "I bet you didn't remember that this page should show you a SiteKey."

Re: If malware authors ever learn how to spell we're all screwed

#82

Post by jaylevitt »

tlrobinson wrote: post #22

I forget what the term for it is, but there's a principle that any dialog that's asking the user for credentials or authorization must be clearly delineated from the rest of the UI and thus "unspoofable". The example I recall was a "ribbon" in the OS that slide out to reveal the dialog. If a dialog presented itself but the ribbon remained along the edge you could immediately tell it was spoofed. Of course this requir…

This assumes that users are computer-savvy enough to (a) expect an unspoofable dialog at all, and (b) know which parts are unspoofable and how they should look.

We tried this with "AOL Certified Mail", which had an unspoofable official chrome, and I don't remember any serious drop in phishing.

Re: If malware authors ever learn how to spell we're all screwed

#83

Post by pacaro »

juhanima wrote: post #72
csmeder wrote: post #54

Earlier quoted context omitted.

"The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,000 images." I should have made this more clear. The ten images are chosen randomly from the group of 10,000 The question is: are there 10,000 images that are different enough people won't be fooled. Say my picture is a green house. And a prompt has a picture of a red house, will I accidentally think its the right site key? Th…

That is a fair attempt. The weak point of course is the bit of data which stores which image you chose. If the attacker is able to read that, then he can display the right image.

There are other problems.

1) If the attacker can scrape the screen, they can detect which image you are using - securing the entire pipeline to the screen is hard.

2) 10,000 images is way too few.

Even if we can assume an even distribution of images, as an attacker I can serve the same image to all targets, 1 in 10,000 will now think that they are interacting with a trusted component

Re: If malware authors ever learn how to spell we're all screwed

#84

Post by ams6110 »

Karunamon wrote: post #78
shanselman wrote: post #46

Earlier quoted context omitted.

Unless the entire image is a clickable hotspot that starts the next step in the process of their evil. ;)

Can you do that? I.e. launch events on mouse down but not a full "click"?

mousedown is an event yes. So is mouseover. I'm not even sure why any action is necessary though. If you can present the popup, you can just feed a tag to the browser and do whatever the click was going to do, right?

Re: If malware authors ever learn how to spell we're all screwed

#85

Post by ams6110 »

gerts wrote: post #77

This is why you don't run your computer using the default UI theme on the most popular OS.

Yeah exactly. I always set my theme to the most minimal, "classic", non-effects, whatever options I can turn off. That way this kind of stuff really stands out.

Re: If malware authors ever learn how to spell we're all screwed

#86

Post by mgkimsal »

I've suggested for years now that someone could make a killing selling copywriting services to spammers. Poor spelling, bad fonts, random crap, etc - these are all the hallmarks of spam which makes it easy to classify as spam. Well-written, intelligent-sounding, professionally-produced spam would likely get past more filters, and be harder for people to dismiss out of hand, and likely get more sales.

Re: If malware authors ever learn how to spell we're all screwed

#88

Post by hexagonc »

astral303 wrote: post #52
csmeder wrote: post #49

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam. For example when I install Windows 8 or Mountain lion one of the first prompts I must address is: "Please choose an image to help you identify valid system prompts" The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,0…

Tech savvy users are not the main problem in malware. The whole SiteKey/tiger image solution only gives you an illusion of the solution. What happens when the system displays "System error, unable to display the image?" How will a convincingly-written error message prevent your average gullible or below-average competence computer user from logging in to a phishing site? Think of how many things can go wrong on a com…

I use (unfortunately) Bank of America online banking and if I don't see the SiteKey or really if there is any error at all during the signon process then I leave and immediately start Googling for Bank of America security breeches in the news. If I don't find anything, then I try to login again the next day.

Re: If malware authors ever learn how to spell we're all screwed

#89

Post by hexagonc »

politician wrote: post #64
jlgreco wrote: post #63

Earlier quoted context omitted.

Can you explain how that fixes the problem? I'm not sure I understand.

It doesn't -- at all -- the obvious workaround is to extend the middleman game a little longer and pass the user's answer to the site.

It mitigates a little. It should make you a little suspicious if the site suddenly starts complaining that you're accessing it from an unrecognized computer if you really haven't. I'd close the tab in that case.

Re: If malware authors ever learn how to spell we're all screwed

#90

Post by yuliyp »

politician wrote: post #64
jlgreco wrote: post #63

Earlier quoted context omitted.

Can you explain how that fixes the problem? I'm not sure I understand.

It doesn't -- at all -- the obvious workaround is to extend the middleman game a little longer and pass the user's answer to the site.

It does in that if the real site properly stores a cookie that records that you've logged in from there before, the number of times that the user is asked for such questions goes down, increasing suspicion when the user actually IS asked for them.

Security is never about 100% guarantees. It's about reducing the exploitability and impact of weaknesses.

Post reply on HN