4 ms·

i was thinking much cleverer than that... imagine mail.google.com /the real deal/ but there are hooks in the API to catch what you put in the login boxes - the

by jheriko 16y ago

i was thinking much cleverer than that... imagine mail.google.com /the real deal/ but there are hooks in the API to catch what you put in the login boxes - the only give away is a miniscule extra bit of local processing - no traceable network usage required. one attack could collect usernames/passwords from a user for every big site they use. the phishing site that plants the stuff could even get away with being massively obvious - so long as people look at it they could be infected. of course finding such exploits is non-trivial... but people are doing it with some regularity. (EDIT: incidentally the only way I log in to Google Mail or anything I log into is by typing in the URL specifically, e.g."mail.google.com", so this is pretty much the only way to hit me up with this sort of attack - if I get "magically" logged out then I might get stung, but it seems doubtful... its just too suspiscious)

dandelany 16y ago
Hooks in what API?
- jheriko 16y ago
  windows would be the best target probably, and hooks might not be the best idea, but you can capture all kinds of input with the apis documented on msdn. http://msdn.microsoft.com/en-us/library/ms997537.aspx http://msdn.microsoft.com/en-us/library/ms997537.aspx http://msdn.microsoft.com/en-us/library/ms646293%28VS.85%29.aspx http://msdn.microsoft.com/en-us/library/ms646293%28VS.85%29.... for example. although i'm not sure how good they are these days... i honestly can't remember exactly which technique i used but i managed to make a keylogger with excel/vba once with apis i randomly looked up on msdn - it was just to prove a point though, i haven't really done anything more elaborate than that. the difficult bit is really getting code to run. that i have no idea about, but i've heard about exploits from time to time, usually when they are fixed :)
chc 16y ago
Then that's not phishing — that's installing a keylogger on the user's computer. Also bad for his security, but a completely different form of attack. It's also something that actually does happen.

by jheriko 16y ago

dandelany 16y ago

Hooks in what API?

jheriko 16y ago
windows would be the best target probably, and hooks might not be the best idea, but you can capture all kinds of input with the apis documented on msdn. http://msdn.microsoft.com/en-us/library/ms997537.aspx http://msdn.microsoft.com/en-us/library/ms997537.aspx http://msdn.microsoft.com/en-us/library/ms646293%28VS.85%29.aspx http://msdn.microsoft.com/en-us/library/ms646293%28VS.85%29.... for example. although i'm not sure how good they are these days... i honestly can't remember exactly which technique i used but i managed to make a keylogger with excel/vba once with apis i randomly looked up on msdn - it was just to prove a point though, i haven't really done anything more elaborate than that. the difficult bit is really getting code to run. that i have no idea about, but i've heard about exploits from time to time, usually when they are fixed :)

chc 16y ago

Then that's not phishing — that's installing a keylogger on the user's computer. Also bad for his security, but a completely different form of attack. It's also something that actually does happen.