13 ms·
The fake browser update scam gets a makeover
- radium3d 3y agoThis week I cleaned 3 WordPress websites that were exploited with this scam replacing the content on the sites.
- keane 3y agoThe quality of full screen takeover pages seems to have dramatically risen recently. My family members, who don’t know the Escape key exists, accidentally click one from a banner ad every week now taking them to a page like examplefoobar38561.cloudfront.net and the use of elements that imitate browser or OS chrome (generally imitating Windows Defender or similar) has reached near perfection. All browsers should have a setting to permanently block full screen mode for all sites (not “ask”).
- TeMPOraL 3y agoMaybe one of these days scammers will release their UI elements as web components or React whatever, so we'll finally get some high-quality JS versions of native UI elements; maybe we could get Electron app developers to use them.
- anon25783 3y agointroducing the new native-feel component library for cross-platform development, Crimes.js
- gjsman-1000 3y ago> All browsers should have a setting to permanently block full screen mode for all sites (not “ask”). Never going to happen, because that's breaking YouTube.
- BHSPitMonkey 3y agoGoogle probably prefers when you don't fullscreen the video; More ways to have your eyes drawn to ads, recommendations, and comments in the periphery. Maybe this is why they added the different "bigger but still not fullscreen" modes a few years back.
- nilsherzig 3y agoDon't they already whitelist YouTube for Autoplay with sound or something like that
- jowea 3y agoMake it a permission like with audio recording etc and maybe add a whitelist for known sites.
- nathancahill 3y agoFull screen still requires a direct user action. So there should still be a step/click between the banner ad and the takeover. But wow.
- jowea 3y agoCan't it be clicking the ad?
- nathancahill 3y agoIf the page is running arbitrary JS served by ads, the site itself is compromised.
- jen729w 3y agoAfter seeing Krebs' post the other day, we now have a call scheduled with my partner's parents who still own a Windows laptop. I'm going to tell them that they should no longer use it for any sort of financial work. No banks, no shares, nothing. Ever, for any reason. This stuff is too good now. Most of us -- and I include the tech-literate, because we all slip eventually -- are basically helpless at this point. Solution? iOS apps, or, I'm sorry, use a Mac. I know it's not immune to malware but for all practical purposes it might as well be.
- i5-2520M 3y agoChromeOS?
- hospadar 3y agoObv the solution is to just pick a really wacky desktop ui theme that the h4x0rs won’t guess to imitate :p /s
- sysadm1n 3y agoSeriously considering running a JIT-less JavaScript free browser should be the standard for surfing these days, and only whitelisting sites you trust (like your online banking site or Amazon for example). Disabling JS wipes out entire classes of attacks. I know developers assume the user has JS enabled and codes their site to that end, but a small minority disables JS to get rid of various annoyances and for accessibility reasons, and, malware issues in the browser. This attack can still be pulled off without JS though: using plain old CSS & HTML. It seems these attacks are targeted to the non tech savvy, but even I (tech savvy) get duped by persuasive messages in my browser. This is why I advocate for a Phishing/Malware 101 course which is mandatory for all types of tech-related courses and learning.
- sublinear 3y agoThis isn't that complicated. Like everything else in life it's a matter of trust and awareness, not really that technical. I'll never understand why the default stance on HN is always javascript bad.
- everdrive 3y agoIt's simple; the web becomes a much nicer place when you block javascript by default. Some things don't work, but they never compromise you, or bog down your computer, and throw huge ads and banners in your face. I could go on. I obviously see that JS can be used for good things, but it seems like people can't constrain themselves to that.
- simion314 3y ago>I'll never understand why the default stance on HN is always javascript bad. I am a web dev, and I agree that JS on the web is bad for pages that should be just documents like a news webpage or wiki page. JS makes sense for applications like a video game, video/audio/level/text editor, or some internal app that your company trust, but for random untrusted document pages JavaScript is a detriment, even if we only consider UX.
- andybak 3y ago
- tempodox 3y agoYet again the crypto crap has proven its utility for doing shady shit.
- DrThunder 3y agoYep, and you can bet the government will continue using that as an excuse to bludgeon it with more regulation.
- HaZeust 3y agoGood. It's bigger now than it ever should have been, and it'll reap what it has sown for it. It should have been a technology on the down-low, it should have been a technology that purposely purported not to attract attention, it should have been a technology that volatility shouldn't have been its primary feature. Cryptocurrency would have been good, as a technology, if its infrastructure didn't purposely embrace grifters and skepticism.
- DrThunder 3y agoGovern me harder daddy.
- Unfrozen0688 3y agoWill ublock origin or Brave shield block this? Another reason to use ublock origin for private use and also deploy it in company use with GPO, Intune or other RMM.
- pwg 3y ago> Will ublock origin Since the attack is likely JavaScript based, provided one configures Ublock Origin to by default deny all JavaScript (this is not Ublock's default mode, you have to turn on "I am an advanced user" mode and then block all JS by default using the advanced user UI controls) then the answer is very likely: yes, it will. Because if it is JS based - if no JS runs, no exploit happens.
- paulpauper 3y agoGood ol' Krebs and Schneier ..either way too late to a scam, or ignoring other scams, or ineffectual regardless. What about those fake "download here" Adword buttons that have been a scourge of the web for the past decade or longer infecting untold millions of computers with malware. When will anyone bring that up.
- ceejayoz 3y agoPeople have been bringing that up for like a decade?
- jabroni_salad 3y agoA good takeaway from this is that 1) the simplest methods can stick around the longest. His skimmer page is 13 years old and it's still relevant, for example. Similarly, we will not be rid of fake download buttons or compromised wordpress sites in our lifetimes. 2) If you write about the simple stuff, your articles will be evergreen. You don't have to time the market when your product never falls out of demand.
- paulpauper 3y agoGoogle can simply decline to run any ad which has the words "download here" as an image. how hard is that? I guess people do not come forward and less media coverage, unlike crypto losses and scams.
- krebsonsecurity 3y agoNot sure if it's exactly the same thing as what you just mentioned, but I did write recently about criminals using paid Google ads to get their links for popular software downloads show up before even the first organic search result. And it includes the right icons and branding, and people click and are brought to a site that looks an awful lot like a site Microsoft might use to let you download Teams, and you get an information stealer program instead. Tl;dr, there are multiple ransomware groups that are using this method to find new infostealer victims. https://krebsonsecurity.com/2023/09/snatch-ransom-group-exposes-visitor-ip-addresses/ https://krebsonsecurity.com/2023/09/snatch-ransom-group-expo...
- josteink 3y agoI guess someone finally found a real world use for blockchain. Too bad it was malware.
- yardstick 3y agoIronic that even this blockchain still had some centralised aspects: “In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts.” I thought one of the big drivers for people using blockchain is the decentralised nature- resistance to censorship etc. Seems like this one isn’t a great long-term choice for malware as it’s not censorship resistant (as evidenced by the blacklist).
- lawlessone 3y agoI think this is like a block explorer type url. They can refuse requests to view those blocks. I don't think they can stop the creation of those blocks. The malware guys can probably still find another 3rd party block viewer . But it is hassle for them.
- Arch485 3y agoIIRC blacklisting in this manner is basically just a suggestion - it's saying, "hey, in the opinion of Binance, these adresses are bad. Don't do business with them". If the majority of nodes in the network comply with the blacklist, then it works. But at any point, someone who runs a node (or nodes) can choose to ignore the blacklist. It's only centralized if the majority of people running BNB Smart Chain decide to trust Binance.
- jowea 3y agoI'm no blockchain expert but I don't think you need a majority. The majority relates with the financial incentives of following the longest chain, but ultimately you can configure your node to "disbelieve" any block breaking the blacklist and carry on with like-minded nodes in a fork.
- jkaptur 3y agoSo the attack goes: 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload. And the reason for this two-step architecture is to make it convenient to change the real payload. And the problem is where to host the real payload. The first idea was Cloudflare, but Cloudflare keeps taking that sort of thing down. So now they host it "on the blockchain" which means it "can’t be blocked". What I don't understand is who is actually serving the HTTP call that effectively proxies the data from the blockchain. It seems like they (like Cloudflare, or a regular hosting service) are opening themselves up to all sorts of risks by serving arbitrary content.
- ComodoHacker 3y agoI think one more important reason for hosting payload on the blockchain is to avoid automatic detection by scanning and auditing tools.
- warkdarrior 3y agoAccording to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform: https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16 https://labs.guard.io/etherhiding-hiding-web2-malicious-code... This diagram show the full flow of the attack: https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4S5wz1jVZrx_gQYQZKyA.png https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4... Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BSC), this is effectively free storage/hosting for the attacker. The malicious code is served by BSC web API. According to the Krebs article, BSC "is aware of the malware abusing its blockchain, and is actively addressing the issue." I am not clear if they are taking this situation Very Seriously(TM), but I assume they are.
- gumby 3y agoSounds like we should poison this vector (and IPFS) by uploading copyrighted movie torrents to this free storage system. For a change we’d be doing good.
- andybak 3y agoI'm just happy to finally see a practical use case for Blockchain technology.
- quickthrower2 3y agoLol you don’t need blockchain, you need a host that doesn’t take down malware payloads. A floppy disk is sufficient technology if cached behind a CDN
- yieldcrv 3y agoin 2023 blockchains are ubiquitous and floppy disks are not
- d11z 3y agoIt’s been great for gambling, cybercrime, and enabling the drug trade practically since its inception.
- 7moritz7 3y agoI really think Monero in particular deserves way more criticism for their practice. Bitcoin is one thing, Monero is created for and marketed towards cybercriminals, you don't need to be a communications expert to get that premise. I haven't seen it used once for any legitimate purpose. Atleast with Bitcoin and Ethereum you can get buy some legitimate things like VPNs or NFTs https://arstechnica.com/information-technology/2021/06/monero-emerges-as-crypto-of-choice-for-cybercriminals https://arstechnica.com/information-technology/2021/06/moner...
- IG_Semmelweiss 3y agoToday you are on the right side of the fence. You buy things that are permitted so its all good. I wonder if you would keep the same opinion, once that changes. But lets hope for our sake, we never get there.
- DoodahMan 3y ago
- 7moritz7 3y ago> New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from being taken down by security experts or law enforcement: By hosting the malicious files on a decentralized, anonymous cryptocurrency blockchain Finally a practical use for web3
- r00fus 3y ago[flagged]
- taway1237 3y agoI'm surprised Krebs says something like this, because it's not novel at all. I'm in the industry, and malware used public blockchains at least as far back as 2017 (probably way before, but that's when I first analysed a sample that does that).
- deleted 3y ago[deleted]
- pyrolistical 3y agoThey could also use ipfs as there are many http proxies for it including cloudflare. All proxies would individually need to blacklist the address. In general it is going to be impossible to block content. We need to charge for bytes or something like that. But that produces other problems which could be worse
- brazzy 3y ago> We need to charge for bytes or something like that. I read that 25 year ago as a suggested solution to email spam, and it's many times less feasible today than it was back then.
- flowless 3y agoI’ve recently received a scam email with ‘Incoming mail delayed’ subject saying that my mailbox is almost full. It contained IPFS url with a login form sending data to some hacked site so this is already a standard practice. It is also a bit amusing when you host your own mailserver for years.
- theamk 3y agopretty sure that the final solution is going to be the same as email: a bunch of centralized blocklists, like Spamhaus but for IPFS. There will be occasional false positives and some people would complain, but most IPFS gateway operators would just choose the top blocklist for simplicity.
- jdjxhwvsh 3y ago> The company said all addresses associated with the spread of the malware have been blacklisted. I thought web3 was supposed to be uncensored so we could serve and download all the malware we wanted?
- taway1237 3y agoThe company here is the centralised service that josts the API, "real" data is still there.
- berkes 3y agoI get that the angle of BNC here generates views (and outrage and haha blockchain bad). But the real story is "WordPress websites still hacked in masses". WordPress, somehow, cannot manage to turn themselves into a secure and tough system. It remains a prime target, it's installations get hacked by the thousands and it's causing real harm at that. (Yeah, yeah, I know the users, admins, plugins, themes and hosted are to blame. And I know it's possible to truly harden a WP- I've built a WP hosting company that did exactly this. But it's saddening how poor the wider community handles it's security)
- kro 3y agoBeing one of the biggest publishing softwares naturally attracts all of that: more publicity/cases, uninformed users, incentive and a probing/persistence ecosystem for hackers,. I have to host a few dozen WordPress sites for customers and the ones that got hacked were all backtracked to: enumerating usernames, and some had their password equal that. You could blame WordPress for not being more strict rejecting those per default.
- berkes 3y agoBeing one of the biggest publishing softwares gives a giant responsibility to prevent this. I am convinced this responsibility isn't taken up by the community or by organisations behind it, seriously enough. Simply because the current status continues to be abysmal. I have many practical ideas how many issues could be solved, most are put forward and put down almost monthly in the community. The current status is resignment: "well, we are big and this is how things are". No! Things could be better, more secure etc. But for that, things do have to change.
- dwheeler 3y agoTo be fair, WordPress core has gotten better. The bigger problem is that there are many WordPress plugins, and many of the plugins can't even pretend to be related to being secure. Until developers are widely taught how to develop secure software, the problem will just keep moving around. We can't make software development environments where it's impossible to create a vulnerability, and we will never convince users to stop wanting new capabilities. Making things secure in the first place needs to be part of the solution.
- thedaly 3y ago> More than a decade ago, this site published Krebs’s Three Rules for Online Safety, of which Rule #1 was, “If you didn’t go looking for it, don’t install it.” It’s nice to know that this technology-agnostic approach to online safety remains just as relevant today. Still a very good practice today.
- DrThunder 3y agoEasier to just remove local admin from end-users than hope they'll act intelligently.
- SturgeonsLaw 3y agoA lot of stuff the user cares about (documents, pictures, browser profiles) are readwritable from the user context
- deleted 3y ago[deleted]
- bigyikes 3y ago> The company said all addresses associated with the spread of the malware have been blacklisted How does this work? Can a single entity really just blacklist certain addresses? How is this decentralized?
- theamk 3y agoBrowsers cannot talk to blockchain directly, they need to go through some HTTPS server... And that server can block any request. I am kinda surprised you haven't heard about this already. This has been used in the past to take down NFTs [0] and to make Bitcoins unspendable [1] It's the famous "on chain only" caveat: all the decentralized systems are only decentralized in the ideal world, if nothing except the chain exists. Once practical reality comes in, there are plenty of levers for centralized control. [0] https://news.ycombinator.com/item?id=29227119 https://news.ycombinator.com/item?id=29227119 [1] https://news.ycombinator.com/item?id=30224637 https://news.ycombinator.com/item?id=30224637
- Tokumei-no-hito 3y agoto be clear the caveat has a caveat - the centralized control you're talking about is through public (privately hosted) APIs. anyone running a node on the chain can still send and receive whatever they want. unless the majority of the chain chooses to black list addresses, then you have a hard fork because the nodes don't have a consensus on the protocol (open vs black listing).
- theamk 3y agoI don't see how this changes my point? Yes, on the chain you can send and receive any data you want. But if all you want to do is to exchange meaningless data, you don't need a blockchain for that. An in practice, there was no hard fork, and yet Moxie's NFT was "removed" from opensea and from the metamask wallet. Sure, someone with a full client can still see the NFT and _techinically_ all the data is there.. and yet the data is value-less. Would you pay any amount of money for NFT you cannot show off to anyone nor use with any online service? The same goes with bitcoin - sure, the chain will happily process your bitcoin transactions from the mixer and accept your gas fees. So if you are only looking on the chain, it is all fine and decentralized. But if you are actually trying to withdraw the money, then your accounts get blocked. So in practice, this may not be 100% useless, but this is still significantly less useful than "clean" bitcoin. And no hard fork or even community consensus required.
- theogravity 3y agoEvery time I read about the Binance Chain, it involves a scam. Is there anything created on it that isn't that sees "wide" use in the crypto space?
- crtified 3y agoI don't mean this as a particular defence of Binance chain per se - and I realise I'm not directly answering your question either - but pedestrian everyday usage of no special note would, by its very nature, go entirely unremarked, certainly by any 'news' source. It's only ever the dramatic heists, the hackings, thefts, etc, that drive reported media. Therefore, the fact that "every time [you] read about" it, it involves some dramatic exceptional circumstance, is somewhat par-for-the-course. By the same standard, the only things that I - as a non-enthusiast - ever read about the art world, is the extreme valuations, the thefts, the rude vandalisms. The only things I ever read about banks are the record profits, the manipulations of finance, the robberies. The only thing I ever read about the Middle East, is war. The fact that it's mostly filled with decent ordinary people just trying to live their lives, is the boring, the unremarked yet dominant landscape, which somehow gets lost in the loud buzz of persistent drama.
- theogravity 3y agoI get what you're saying. Media bias towards certain headlines. I was extremely active in the crypto scene for many years (participating in Polkadot auctions, ETH domain names, NFT card games, DAI repo auctions, de-fi apps etc) and have never seen a legitimate use-case come out of BSC at all (they were always scam coins) and was wondering if anyone else has felt the same or had any evidence proving otherwise.
- 6510 3y agoI one time naively downloaded wordpress thinking I could read some of it. Turns out it has 5000 files. My blog has only 1 small php file. If I had more time it would be smaller.
- userbinator 3y agoAny site that asks me to change my configuration in any way to view their content gets a swift click of the Back button. No, I will not "update" my browser nor enable JavaScript just to read your text and images. Everyone seems to have discovered that "security" is a great excuse to coerce people into doing things. "The only thing we have to fear, is fear itself."
- naikrovek 3y agogotta love that blockchain, man. has anyone ever used it at scale for anything legitimate? sheesh.
- alexvitkov 3y agoJust add a cors header, no? If it's a debugging API for devs, why are you making it accessible to any browser from any origin?