4 ms·
I don't understand the point of using compromised Cambridge accounts for this. All they wanted people to do was to just click on a link. They could have easily
by DangerousPie 7y ago
I don't understand the point of using compromised Cambridge accounts for this. All they wanted people to do was to just click on a link. They could have easily registered some legitimate sounding domain name and linked to that instead. It wouldn't be unusual at all for an academic organisation to have a separate site.
- edent 7y agoIt is a prestigious domain - with a high recognition factor. And, as part of that, it will almost never be blocked by URL / DNS filters. In this case, it clearly worked. The user saw cam.ac.uk and trusted it.
- adam12 7y agoI wonder if the attackers were also thinking that these users would more likely be using macOS. The exploit they were using only works in Firefox on macOS.
- karlp 7y agoA compromised Cambridge url gives a lot of credence to their claim though, especially with the paranoid coinbase developer they were targeting.
- bin0 7y agoIt also means the e-mail is significantly more likely to make it past a spam filter, even an aggressive one. There was very little in that e-mail any reasonable spam filter could possibly have flagged, unless they're going to start doing API calls to grammarly. But if they check spelling and grammar, filters will start flagging a lot more than spam.
- gdfasfklshg4 7y ago.ac.uk emails get spam filtered pretty harshly.
- gruez 7y agoreally? why?
- gdfasfklshg4 7y agoNot sure but some guesses: Traditionally students got a lot of leeway with running their own stuff maybe there have been a few doing not-good-things? Lots of academics who don't take security seriously have had more admin access to live servers than they should and then stuff like the article happens?
- lb1lf 7y agoMy Alma Mater, The Norwegian University of Technology and Science in Trondheim, Norway had issues with student E-mails being spamhammered all over the world. Why? All student accounts were hosted under stud.ntnu.no; presumably authors of spam filters made other associations when they saw the string 'stud' than it being short for 'student'. Cough. Their practice of automagically generating user names based on parts of your first and last name in my time led to two users having (for a short time!) the addresses hung@stud.ntnu.no and pervo@stud.ntnu.no.
- fencepost 7y agoTheir practice of automagically generating user names based on parts of your first and last name in my time led to two users having (for a short time!) the addresses hung@stud.ntnu.no and pervo@stud.ntnu.no. Brenda Utthead feels their pain.
- itronitron 7y agoIt's the cyber-version of speaking with a British accent.
- stordoff 7y ago_Any_ other domain, and I'm just going to ignore it. A legitimate *.ac.uk domain, and there's a good chance I will click it to find out what it is, even if I don't believe it. At that point, they've won (it's a 0-day). Using a recognisable domain lets my guard down just enough ("there's no risk in going to a cam.ac.uk domain") for an attack like this to work.