5 ms·
Cool trick - they're using HTTP auth URLs[1] so that the @ sign is doing a lot of the heavy lifting (plus some clever unicode slashes). It's an old school phish
by yathern 3y ago
Cool trick - they're using HTTP auth URLs[1] so that the @ sign is doing a lot of the heavy lifting (plus some clever unicode slashes). It's an old school phishing trick, with the additional layer of looking like a genuine zip file.
Not sure if this trick would be too effective in real life, Firefox and likely others will give you warnings when logging into a site like this, as this form of HTTP auth is way deprecated. However, this is the strongest example against .zip I've seen yet though, from someone who didn't buy into the initial panic.
Side note - I'm using .zip for something legitimate! https://HN.zip https://HN.zip is a little weekend project for an offline-caching read-only Hacker News (I lose reception in the Subway a lot so it makes it easier to navigate). It's not done yet though - still pretty rough around the edges. Maybe in a week or two I'll do a Show HN and see if anyone cares.
[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#access_using_credentials_in_the_url https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentica...
- lhoff 3y agoI think the dangerous is not phishing for credentials but malware. The example is a Github Link to a release. You click on the link expecting to download the legitimate kubernetes relase zip file. But instead you end up with a patched version with an e.g. included monero miner. A less tech-savy or distracted user would also fall for a .exe file that downloads and just click on it since he just expects a zip file from github.
- gravypod 3y agoIs the code for hn.zip available? I'd love to archive this into a pdf so that it's easy to read on a remarkable.
- Akashic101 3y agoAn offline reader does sound pretty nice. I have to travel for work quite a lot in the Berlin Metro and often loose connection there, so a way to cache stories before would be great
- GloomyBoots 3y agoI haven’t seen this combination of Unicode forward slashes and http auth before. I would have fallen for it. Does anyone maintain a kind of “phishing URL menagerie” of interesting cases like this?
- Arnt 3y agoSort of. The browser vendors work hard to keep deceptive links and sites from fooling users. In this case, the browsers I use don't fall for it. Hovering over the link shows the real domain. The browser I use on my work iphone also does something sensible, but I can't remember what. Obviously I can't hover on that device.
- fragmede 3y agoclick and hold brings up a user-initiated popup that shows the full url, though it may not sufficiently deobfuscate it.
- fragmede 3y agoSide note: someone's using http://yourmom.zip http://yourmom.zip for hilariously nerdy purpose
- devsegal 3y agoThis is the type of website I would want to show up in marginalia
- fragmede 3y agoOkay I was hoping someone else was going to chime in but even with the influx of Reddit users, the rest of HN isn't that juvenile so I'll do it. https://selfesteem.zip https://selfesteem.zip 410 - https://yourdad.zip https://yourdad.zip 411 - https://yourpenis.zip https://yourpenis.zip 413 - https://mypenis.zip https://mypenis.zip 413 - https://yourmom.zip https://yourmom.zip Formally https://yourmother.zip https://yourmother.zip https://yourmum.zip https://yourmum.zip for the British and also http://yomama.zip http://yomama.zip 417 - https://yourlife.zip https://yourlife.zip 418 - https://yourcoffee.zip https://yourcoffee.zip https://yourdick.zip https://yourdick.zip https://yourwife.zip https://yourwife.zip https://yoursister.zip/ https://yoursister.zip/ https://chatgpt3.zip/ https://chatgpt3.zip/ mirrored from: https://www.reddit.com/r/ProgrammerHumor/comments/13pzxea/httpsyourmomzip/jmh7me9/ https://www.reddit.com/r/ProgrammerHumor/comments/13pzxea/ht... because who knows if that'll be around in a couple of months.
- nullindividual 3y agoiMessage thinks this URL is a zip file.