6 ms·

U.N., Unicef, Red Cross Under Ongoing Mobile Attack

167 points by danso 7y ago

vikingcaffiene 7y ago
> They noted that mobile web browsers also unintentionally help obfuscate phishing URLs by truncating them, making it harder for the victims to vet the legitimacy of the pages. JFC... I never understood why that "improvement" was necessary in the first place. Now its causing real harm out in the world. Kind of infuriating.
- perspective1 7y ago
  Chrome iOS shows just the domain and subdomain-- which may help fight fishing attacks by focusing users on just that (but annoying to just about everyone else). Safari and Firefox show the whole URL, truncated on the right by the lack of space.
  - user982 7y ago
    > Safari and Firefox show the whole URL, truncated on the right by the lack of space. Safari doesn't.
    - savoytruffle 7y ago
      It's a preference under "Advanced" for "Smart Search Field:" to "Show full website address". Not as hidden as some Safari settings, but it is at the end of the Preferences window.
      - user982 7y ago
        This thread is about mobile. Mobile Safari doesn't.
- appleiigs 7y ago
  It’s the same with email and email phishing. They should show the full email address. I think it’s MS Outlook that only shows the name in email chain when forwarding. So once the first person tricked forwards the email, info is lost and prevents future readers noticing the phishing email address
  - unholythree 7y ago
    I really don't understand this either. I feel like once upon a time email clients used to go so far as to show you the full header by default; but UI trends made it important to hide anything too technical from the end user. It seems like a total dismissal of function for the sake of form. Especially since the uninterested just scroll a little to get past the techno-babble. I think having the header right there was good, it reminded people that email wasn't magic, there was understandable technology at work, and you could easily see what was going on if you cared to look.
    - Mirioron 7y ago
      I think having the header visible would also slowly teach people patterns of what looks legit and what doesn't.
  - joecool1029 7y ago
    >I think it’s MS Outlook that only shows the name in email chain when forwarding. I complained to support about Outlook iOS doing this, not just for forwarding... but all received emails display only the name. I receive AppleID phishing attacks constantly to my old hotmail account, Microsoft helpfully sends all them to my inbox and Outlook shows them as from 'Apple' unless I click the sender name and then it shows something like totallynotlegit@paypalappleidscams.tk. Their link scanner is effective around 50% of the time. It's not good enough. Microsoft does not consider this a bug or a threat in any way. I have been active about this on social media and have had my screenshots and complaints picked up by largish accounts like @swiftonsecurity. At this point Microsoft is complicit with the phishers. Oh well, not the first time an entire industry thrived off their lack of security.
- Thorrez 7y ago
  >JFC... I never understood why that "improvement" was necessary in the first place. What improvement are you talking about? Mobile phones truncate the URL bar because phone screens are physically narrow.
- chatmasta 7y ago
  Desensitization to the URL bar is just one of many, many problems with AMP. Google is training users to ignore it, because sometimes it says google.com when they’re somewhere else.
JohnJamesRambo 7y ago
What kind of dirtbag would choose those organizations to attack? That’s the lowest of the low.
- dmix 7y ago
  They've always been intelligence targets. Any organization closely tied to regional conflicts, and therefore intelligence agencies and the military, is going to be a target. Red Cross and Unicef show up everywhere there's a serious conflict. Often the very first western organizations there. The job of most intel agencies is to keep their governments up to date on those conflicts. Especially one involved in plenty of global conflicts like Russia. I'm sure the US embeds agents with them all the time.
  - dmurray 7y ago
    Also good for outrage, the main ingredient of modern media. Once the enemy fires on a Red Cross branded outpost, they must be the bad guys, no matter how many of the doctors were actually intelligence operatives. Using NGOs like this should be as unacceptable as using outright human shields, but as always, it's different when the perfidious foreigners do it.
    - tveita 7y ago
      > Once the enemy fires on a Red Cross branded outpost, they must be the bad guys, no matter how many of the doctors were actually intelligence operatives. I mean, yes? At what number of intelligence operatives would firing at Red Cross workers be a good thing? > Using NGOs like this should be as unacceptable as using outright human shields Yes. But, like human shields, firing on them with disregard will indeed make people think you're the bad guys.
  - ComodoHacker 7y ago
    >They've always been intelligence targets ...and intelligence cover.
- morpheuskafka 7y ago
dmix 7y ago
> The unusual aspect of the campaign is that it identifies mobile devices; once detected, it then logs keystrokes in real-time as the user enters them into the phishing page. You don't even have to hit submit, hopefully not autofilled.
- robbya 7y ago
  I think most of the good password fillers will check the full domain, so they would not fill any password in for these sites. That's also a good indication that your not on the expected site.
- MiroF 7y ago
  autofiller wouldn't trigger on a phishing site
- joveian 7y ago
  Auto password fillers don't fill on the wrong site; they are actually a great defense against this kind of thing if you get it right the first time and then are very suspicious if it ever doesn't auto fill. IMO, browsers should have site bookmarks to replace EV certificates, where you can bookmark a site and give it a name and the name appears where the EV company name used to.
dmix 7y ago
The original source has more information and wider list of targets (UC San Diego, Heritage Foundation, United States Institute of Peace): https://blog.lookout.com/lookout-phishing-ai-discovers-phishing-attack-targeting-humanitarian-organizations https://blog.lookout.com/lookout-phishing-ai-discovers-phish...
WarOnPrivacy 7y ago
> There are two domains that are hosting the phishing content, live since March 2019. The associated IP network block and Autonomous System Number (ASN) are known to have hosted malware At which point the article fails to include the one actionable piece information - the IP blocks and ASNs. It's so like the tech press to write a comprehensive article that omits the only info that could actually help.
- dependenttypes 7y ago
  It feels like you are supposed to blindly believe them, and if you are left with questions, well, you are just a nerd so they don't care.
IfOnlyYouKnew 7y ago
If anybody has doubts how bad this could end for aid workers, here's an article about their current situation in Syria[0]. Summary: they are somewhat certain to die when Assad's army takes over northern Syria and manages to identify them as aid workers, even remotely connected to anything we would consider "good". The agencies are trying to burn all their local paperwork to protect their employees' identities. [0]: https://www.theatlantic.com/international/archive/2019/10/america-policy-syria-deadly-end/600682/ https://www.theatlantic.com/international/archive/2019/10/am...
- jammygit 7y ago
  > Throughout eight years of civil war, Syrians who tied their fortunes to the changing whims of American policy have been systematically arrested, killed, and driven from the country. > First it was protesters chanting for democracy—many took encouragement from Barack Obama’s statement in the summer of 2011 that the country’s dictator, Bashar al-Assad, should step down. But the U.S. government looked on as protesters were killed or disappeared into the regime’s teeming prisons. It’s as though the US government is on a mission to prove they should not be trusted. I hope most can get out of there somehow, this is very unfortunate
  - jacquesm 7y ago
    > It’s as though the US government is on a mission to prove they should not be trusted. I would consider that mission solidly accomplished at this point.
    - tuesdayrain 7y ago
      I can't imagine why I would place a lot of trust in any government. It takes a special kind of cunning, controlling person to even want to be a politician. Let alone become successful enough to attain a high position in a government. So I don't trust any government really. All I can do is guess which politician's incentives could be the most aligned with mine.
    - irrational 7y ago
rkagerer 7y ago
They noted that mobile web browsers also unintentionally help obfuscate phishing URLs by truncating them, making it harder for the victims to vet the legitimacy of the pages. I hate when my phone / browser truncates or hides URL's.
jakobdabo 7y ago
Why is this article so focused on TLS/SSL (8 mentions) certificates? They present it as like having a certificate is something hard or unique.
- ahje 7y ago
  You know how we've spent four years training users to expect https, by deprecating http in the major browsers? That's resulted in many, many people believing the padlock icon means the site is "safe". I expect that applies to the person who wrote the article as well.

167 points by danso 7y ago

> They noted that mobile web browsers also unintentionally help obfuscate phishing URLs by truncating them, making it harder for the victims to vet the legitimacy of the pages. JFC... I never understood why that "improvement" was necessary in the first place. Now its causing real harm out in the world. Kind of infuriating.

perspective1 7y ago
Chrome iOS shows just the domain and subdomain-- which may help fight fishing attacks by focusing users on just that (but annoying to just about everyone else). Safari and Firefox show the whole URL, truncated on the right by the lack of space.
- user982 7y ago
  > Safari and Firefox show the whole URL, truncated on the right by the lack of space. Safari doesn't.
  - savoytruffle 7y ago
    It's a preference under "Advanced" for "Smart Search Field:" to "Show full website address". Not as hidden as some Safari settings, but it is at the end of the Preferences window.
    - user982 7y ago
      This thread is about mobile. Mobile Safari doesn't.
appleiigs 7y ago
It’s the same with email and email phishing. They should show the full email address. I think it’s MS Outlook that only shows the name in email chain when forwarding. So once the first person tricked forwards the email, info is lost and prevents future readers noticing the phishing email address
- unholythree 7y ago
  I really don't understand this either. I feel like once upon a time email clients used to go so far as to show you the full header by default; but UI trends made it important to hide anything too technical from the end user. It seems like a total dismissal of function for the sake of form. Especially since the uninterested just scroll a little to get past the techno-babble. I think having the header right there was good, it reminded people that email wasn't magic, there was understandable technology at work, and you could easily see what was going on if you cared to look.
  - Mirioron 7y ago
    I think having the header visible would also slowly teach people patterns of what looks legit and what doesn't.
- joecool1029 7y ago
  >I think it’s MS Outlook that only shows the name in email chain when forwarding. I complained to support about Outlook iOS doing this, not just for forwarding... but all received emails display only the name. I receive AppleID phishing attacks constantly to my old hotmail account, Microsoft helpfully sends all them to my inbox and Outlook shows them as from 'Apple' unless I click the sender name and then it shows something like totallynotlegit@paypalappleidscams.tk. Their link scanner is effective around 50% of the time. It's not good enough. Microsoft does not consider this a bug or a threat in any way. I have been active about this on social media and have had my screenshots and complaints picked up by largish accounts like @swiftonsecurity. At this point Microsoft is complicit with the phishers. Oh well, not the first time an entire industry thrived off their lack of security.
Thorrez 7y ago
>JFC... I never understood why that "improvement" was necessary in the first place. What improvement are you talking about? Mobile phones truncate the URL bar because phone screens are physically narrow.
chatmasta 7y ago
Desensitization to the URL bar is just one of many, many problems with AMP. Google is training users to ignore it, because sometimes it says google.com when they’re somewhere else.

JohnJamesRambo 7y ago

What kind of dirtbag would choose those organizations to attack? That’s the lowest of the low.

dmix 7y ago
They've always been intelligence targets. Any organization closely tied to regional conflicts, and therefore intelligence agencies and the military, is going to be a target. Red Cross and Unicef show up everywhere there's a serious conflict. Often the very first western organizations there. The job of most intel agencies is to keep their governments up to date on those conflicts. Especially one involved in plenty of global conflicts like Russia. I'm sure the US embeds agents with them all the time.
- dmurray 7y ago
  Also good for outrage, the main ingredient of modern media. Once the enemy fires on a Red Cross branded outpost, they must be the bad guys, no matter how many of the doctors were actually intelligence operatives. Using NGOs like this should be as unacceptable as using outright human shields, but as always, it's different when the perfidious foreigners do it.
  - tveita 7y ago
    > Once the enemy fires on a Red Cross branded outpost, they must be the bad guys, no matter how many of the doctors were actually intelligence operatives. I mean, yes? At what number of intelligence operatives would firing at Red Cross workers be a good thing? > Using NGOs like this should be as unacceptable as using outright human shields Yes. But, like human shields, firing on them with disregard will indeed make people think you're the bad guys.
- ComodoHacker 7y ago
  >They've always been intelligence targets ...and intelligence cover.
morpheuskafka 7y ago

dmix 7y ago

> The unusual aspect of the campaign is that it identifies mobile devices; once detected, it then logs keystrokes in real-time as the user enters them into the phishing page. You don't even have to hit submit, hopefully not autofilled.

robbya 7y ago
I think most of the good password fillers will check the full domain, so they would not fill any password in for these sites. That's also a good indication that your not on the expected site.
MiroF 7y ago
autofiller wouldn't trigger on a phishing site
joveian 7y ago
Auto password fillers don't fill on the wrong site; they are actually a great defense against this kind of thing if you get it right the first time and then are very suspicious if it ever doesn't auto fill. IMO, browsers should have site bookmarks to replace EV certificates, where you can bookmark a site and give it a name and the name appears where the EV company name used to.

dmix 7y ago

The original source has more information and wider list of targets (UC San Diego, Heritage Foundation, United States Institute of Peace): https://blog.lookout.com/lookout-phishing-ai-discovers-phishing-attack-targeting-humanitarian-organizations https://blog.lookout.com/lookout-phishing-ai-discovers-phish...

WarOnPrivacy 7y ago

> There are two domains that are hosting the phishing content, live since March 2019. The associated IP network block and Autonomous System Number (ASN) are known to have hosted malware At which point the article fails to include the one actionable piece information - the IP blocks and ASNs. It's so like the tech press to write a comprehensive article that omits the only info that could actually help.

dependenttypes 7y ago
It feels like you are supposed to blindly believe them, and if you are left with questions, well, you are just a nerd so they don't care.

IfOnlyYouKnew 7y ago

If anybody has doubts how bad this could end for aid workers, here's an article about their current situation in Syria[0]. Summary: they are somewhat certain to die when Assad's army takes over northern Syria and manages to identify them as aid workers, even remotely connected to anything we would consider "good". The agencies are trying to burn all their local paperwork to protect their employees' identities. [0]: https://www.theatlantic.com/international/archive/2019/10/america-policy-syria-deadly-end/600682/ https://www.theatlantic.com/international/archive/2019/10/am...

jammygit 7y ago
> Throughout eight years of civil war, Syrians who tied their fortunes to the changing whims of American policy have been systematically arrested, killed, and driven from the country. > First it was protesters chanting for democracy—many took encouragement from Barack Obama’s statement in the summer of 2011 that the country’s dictator, Bashar al-Assad, should step down. But the U.S. government looked on as protesters were killed or disappeared into the regime’s teeming prisons. It’s as though the US government is on a mission to prove they should not be trusted. I hope most can get out of there somehow, this is very unfortunate
- jacquesm 7y ago
  > It’s as though the US government is on a mission to prove they should not be trusted. I would consider that mission solidly accomplished at this point.
  - tuesdayrain 7y ago
    I can't imagine why I would place a lot of trust in any government. It takes a special kind of cunning, controlling person to even want to be a politician. Let alone become successful enough to attain a high position in a government. So I don't trust any government really. All I can do is guess which politician's incentives could be the most aligned with mine.
  - irrational 7y ago

rkagerer 7y ago

They noted that mobile web browsers also unintentionally help obfuscate phishing URLs by truncating them, making it harder for the victims to vet the legitimacy of the pages. I hate when my phone / browser truncates or hides URL's.

jakobdabo 7y ago

Why is this article so focused on TLS/SSL (8 mentions) certificates? They present it as like having a certificate is something hard or unique.

ahje 7y ago
You know how we've spent four years training users to expect https, by deprecating http in the major browsers? That's resulted in many, many people believing the padlock icon means the site is "safe". I expect that applies to the person who wrote the article as well.