4 ms·

it can be done so well that I wouldn't actually know if it ever happened yes, i think you're just seeing what the bad ones do and the good ones never enter you

by there 16y ago

it can be done so well that I wouldn't actually know if it ever happened yes, i think you're just seeing what the bad ones do and the good ones never enter your consciousness. good bank robbers and jewel thieves have never been caught, and i'm sure good virus writers and phishers have probably never even been detected. think of a gmail login phishing attack that, after capturing your information, re-posted it to google's servers so it actually logged you in. by the time you stopped to think about what just happened, your browser is already at mail.google.com with a green everything's-ok address bar.

jheriko 16y ago
i was thinking much cleverer than that... imagine mail.google.com /the real deal/ but there are hooks in the API to catch what you put in the login boxes - the only give away is a miniscule extra bit of local processing - no traceable network usage required. one attack could collect usernames/passwords from a user for every big site they use. the phishing site that plants the stuff could even get away with being massively obvious - so long as people look at it they could be infected. of course finding such exploits is non-trivial... but people are doing it with some regularity. (EDIT: incidentally the only way I log in to Google Mail or anything I log into is by typing in the URL specifically, e.g."mail.google.com", so this is pretty much the only way to hit me up with this sort of attack - if I get "magically" logged out then I might get stung, but it seems doubtful... its just too suspiscious)
- dandelany 16y ago
  Hooks in what API?
  - jheriko 16y ago
    windows would be the best target probably, and hooks might not be the best idea, but you can capture all kinds of input with the apis documented on msdn. http://msdn.microsoft.com/en-us/library/ms997537.aspx http://msdn.microsoft.com/en-us/library/ms997537.aspx http://msdn.microsoft.com/en-us/library/ms646293%28VS.85%29.aspx http://msdn.microsoft.com/en-us/library/ms646293%28VS.85%29.... for example. although i'm not sure how good they are these days... i honestly can't remember exactly which technique i used but i managed to make a keylogger with excel/vba once with apis i randomly looked up on msdn - it was just to prove a point though, i haven't really done anything more elaborate than that. the difficult bit is really getting code to run. that i have no idea about, but i've heard about exploits from time to time, usually when they are fixed :)
- chc 16y ago
  Then that's not phishing — that's installing a keylogger on the user's computer. Also bad for his security, but a completely different form of attack. It's also something that actually does happen.

by there 16y ago

jheriko 16y ago

i was thinking much cleverer than that... imagine mail.google.com /the real deal/ but there are hooks in the API to catch what you put in the login boxes - the only give away is a miniscule extra bit of local processing - no traceable network usage required. one attack could collect usernames/passwords from a user for every big site they use. the phishing site that plants the stuff could even get away with being massively obvious - so long as people look at it they could be infected. of course finding such exploits is non-trivial... but people are doing it with some regularity. (EDIT: incidentally the only way I log in to Google Mail or anything I log into is by typing in the URL specifically, e.g."mail.google.com", so this is pretty much the only way to hit me up with this sort of attack - if I get "magically" logged out then I might get stung, but it seems doubtful... its just too suspiscious)

dandelany 16y ago
Hooks in what API?
- jheriko 16y ago
  windows would be the best target probably, and hooks might not be the best idea, but you can capture all kinds of input with the apis documented on msdn. http://msdn.microsoft.com/en-us/library/ms997537.aspx http://msdn.microsoft.com/en-us/library/ms997537.aspx http://msdn.microsoft.com/en-us/library/ms646293%28VS.85%29.aspx http://msdn.microsoft.com/en-us/library/ms646293%28VS.85%29.... for example. although i'm not sure how good they are these days... i honestly can't remember exactly which technique i used but i managed to make a keylogger with excel/vba once with apis i randomly looked up on msdn - it was just to prove a point though, i haven't really done anything more elaborate than that. the difficult bit is really getting code to run. that i have no idea about, but i've heard about exploits from time to time, usually when they are fixed :)
chc 16y ago
Then that's not phishing — that's installing a keylogger on the user's computer. Also bad for his security, but a completely different form of attack. It's also something that actually does happen.