4 ms·
They don't need luck, you just downloaded the attacker's payload onto your machine! Phishing is more than the old "click my link, enter your password". Often th
by openasocket 9y ago
They don't need luck, you just downloaded the attacker's payload onto your machine! Phishing is more than the old "click my link, enter your password". Often they use malware so all you have to do is download the attachment or click the link.
- dmitrygr 9y ago"chromebook" see above no default downloading, cannot execute anything downloaded
- openasocket 9y ago1. Chromebooks can have vulnerabilities too. A buffer overflow in the parsing code for the spreadsheet viewer and you've got arbitrary code execution. 2. What if you just click on a link? Browser exploits are a thing too
- dmitrygr 9y agoparser is in javascript (google docs), in a sandboxed browser (chrome), in a system whose root partition is read-only, and hash-verified each boot and whose bootloader is in a physically-write-protected SPI chip. good luck :)
- openasocket 9y agoOh, you're right, no one's ever been able to exploit javascript in chrome ;) And you don't need to persist anything to disk, just get a key logger going in memory. Or scrape the data from your other processes. Once you get arbitrary code execution on the machine it's game over. Seriously, I deal with this kind of stuff for a living. No one is immune to these kinds of attacks; not you, not me, not anyone.
- dmitrygr 9y agogoogle has a bug bounty ;) https://www.google.com/about/appsecurity/chrome-rewards/index.html https://www.google.com/about/appsecurity/chrome-rewards/inde... Feel free to submit your function exploits that you say are so easy to make
- openasocket 9y agoNever said browser exploits are easy to make. I just pointed out that many times phishing is about just clicking on the link, not getting people to actually type in their passwords.