5 ms·
Phishing isn't always a link to a bank website with poor formatting/grammar, and there's nothing inherently unsophisticated about it. Sure it doesn't involve nu
by drewrv 9y ago
Phishing isn't always a link to a bank website with poor formatting/grammar, and there's nothing inherently unsophisticated about it. Sure it doesn't involve number theory or anything like that, but researching the hundreds of associates someone like Macron knows and crafting convincing, personalized messages for each of them is a large undertaking and really hard to defend against.
Imagine you get an email that appears at first glance to be from your spouse, it mentions your kids by name, and it also mentions that the spouse ran the numbers on your upcoming refinance and can you check the math in the spreadsheet she just attached. Assuming the attacker did their homework (i.e., names were right, you actually are going through a refinance, etc) there's a good chance even savvy users will open that excel file.
- dmitrygr 9y agoYeah, I'd open it on my chromebook. And if i see a login screen on the way to open said spreadsheet, i'd immediately start worrying and recheck things. Good luck.
- openasocket 9y agoThey don't need luck, you just downloaded the attacker's payload onto your machine! Phishing is more than the old "click my link, enter your password". Often they use malware so all you have to do is download the attachment or click the link.
- dmitrygr 9y ago"chromebook" see above no default downloading, cannot execute anything downloaded
- openasocket 9y ago1. Chromebooks can have vulnerabilities too. A buffer overflow in the parsing code for the spreadsheet viewer and you've got arbitrary code execution. 2. What if you just click on a link? Browser exploits are a thing too
- dmitrygr 9y agoparser is in javascript (google docs), in a sandboxed browser (chrome), in a system whose root partition is read-only, and hash-verified each boot and whose bootloader is in a physically-write-protected SPI chip. good luck :)
- openasocket 9y agoOh, you're right, no one's ever been able to exploit javascript in chrome ;) And you don't need to persist anything to disk, just get a key logger going in memory. Or scrape the data from your other processes. Once you get arbitrary code execution on the machine it's game over. Seriously, I deal with this kind of stuff for a living. No one is immune to these kinds of attacks; not you, not me, not anyone.
- dmitrygr 9y agogoogle has a bug bounty ;) https://www.google.com/about/appsecurity/chrome-rewards/index.html https://www.google.com/about/appsecurity/chrome-rewards/inde... Feel free to submit your function exploits that you say are so easy to make
- openasocket 9y agoNever said browser exploits are easy to make. I just pointed out that many times phishing is about just clicking on the link, not getting people to actually type in their passwords.