5 ms·
This is a fascinating story. It's funny though how, with compromised accounts at a highly reputable university and a 0-day exploit in one of the most-used piece
by scotchmi_st 7y ago
This is a fascinating story. It's funny though how, with compromised accounts at a highly reputable university and a 0-day exploit in one of the most-used pieces of software out there, they still managed to make basic grammatical errors in their phishing email. I mean, these people were clearly not messing around. Their attack(s) were highly targeted. And yet they still didn't check their written english!
If it hasn't already been tried, perhaps it's worth building a spam-blocker which checks for bad grammar and increases the spam score for every mistake found.
- djaychela 7y agoI read in the past that this was intentional - it's a filter to ensure that people who are inclined to note detail pass up on the offer, meaning they only get the most likely prospects to be ripped off.
- bonyt 7y agoThat’s likely true for the Nigerian prince scammers, but when they’ve got a browser zero day, they can successfully attack people that aren’t suckers.
- davb 7y agoTrue, but we don't know the next stage of their attack. Perhaps after compromising the target's machine the attackers would have to then engage in some social engineering.
- davb 7y agoI once read a theory that poor grammar, particularly with 419 scams, acts as a sort of gullibility filter where only the most susceptible targets will respond.
- mrfredward 7y agoIn this case though, since the zero day runs without consuming the attacker's time, what is to be gained by filtering out less-gullible people? If it's automated, why not cast as wide a net as possible?
- brain5ide 7y agoFear of retribution/consequences?
- scarejunba 7y agoDanger of discovery, perhaps? Every person who doesn’t end up judging the prize gets suspicious.
- deleted 7y ago[deleted]
- CydeWeys 7y agoI doubt it in this case. It sounds like they had a browser zero-day, and could potentially steal cryptocurrencies from people they were targeting. You don't particularly care how gullible someone is; if you get your zero-day to successfully work on them and steal all their Bitcoin, there's nothing they can do about it. I think the default assumption is the correct one here; the attacker(s) are a solo or small group of anonymous non-native English speakers, and the risk of getting another person in on it who is a native English speaker wasn't worth it. The smaller your criminal conspiracy, the better.
- differentView 7y agoYou may be overestimating the writing ability of native English speakers.
- mrmattyboy 7y agoTo your initial point, I assume that you're immediately thinking of a sloppy-writing person who's first language is English, as opposed to a hacker who learnt English as a second language. With the latter, it wouldn't be surprising that they spent less time learning a foreign language than learning about the technology that they're trying to attack
- antiviral 7y agoCan any of you recommend a way to create a sandbox that can seal off processes within a computer? One option is to use a VPC on a cloud-hosted machine to access whatever emails, links, websites someone sends you, but this can be time-consuming and costs money. This article claims that Docker would also not be a good solution: https://security.stackexchange.com/questions/107850/docker-as-a-sandbox-for-untrusted-code https://security.stackexchange.com/questions/107850/docker-a... "...container solutions do not and never will do guarantee to provide complete isolation, use virtualization instead if you require this." So is there any other way to create a sealed off sandbox on your own machine that would create a type of moat between your machine and your adversary?
- newsoul2019 7y agoThat's what Java applets were supposed to be originally, they were supposed to run in a sandbox....
- hyperpape 7y agoNot all sandboxes are created equal. Modern browsers have much better sandboxes than Java ever has had. OS level virtualization is even better.
- newsoul2019 7y agoIf you read something like this [1], dated 1999, it seems like they had the right ideas. I guess it went wrong in the actual implementations. [1] http://www.securingjava.com/chapter-two/chapter-two-2.html http://www.securingjava.com/chapter-two/chapter-two-2.html
- hyperpape 7y agoBy total coincidence, I was reading about Java sandbox exploits just a few days ago: http://phrack.org/papers/escaping_the_java_sandbox.html http://phrack.org/papers/escaping_the_java_sandbox.html. It feels to me (not a security guy!) like there was something fundamentally too complex here. I wonder if part of the problem is that unlike the browser, there's no natural boundary. JavaScript is was originally built to live in a small self-contained world with specific access to the outside. Java was built with features for writing applications that could touch the filesystem, redefine classes, and everything else. It was also supposed to make everything safe, but that led to complex checks everywhere to try to distinguish privileged from unprivileged code.
- weinzierl 7y agoBesides the possibility that the mistakes were made deliberately, like other comments said, I can totally see how these two mistakes slipped through. > He was also lucky that I didn’t care that he’d missed a “the” in We need your assistance in evaluating several projects for Adam Smith Prize. Slavic languages, like Russian, don't have articles. In my experience the proper use of definite and indefinite articles is the most typical error native Slavic language speakers make. > Apparently I further didn’t care that he’d unnecessarily capitalized the word Organizers in Adam Smith Prize Organizers, or that he didn’t seem to understand that a paragraph can contain more than a single sentence. German capitalizes all nouns and German and English have plenty of nouns that are close enough that it's hard not get confused. Add to that all the exceptions where you do capitalize words in English, this is a hard problem for Germans. My armchair linguists bet is that the mail was written by a German with Slavic roots.
- robrenaud 7y agoDropping 'the' is a common error for Russians writing English. It's part of how the 2016 election meddling was blamed on the Russians.