5 ms·
Were people entering login details on non-encrypted dummy sites?
by jjbinx007 2y ago
Were people entering login details on non-encrypted dummy sites?
- cqqxo4zV46cp 2y agoYes? This is unsurprising and doesn’t represent gross incompetence on the part of the victim. Computers are inscrutably hard to understand. Anyone that’s lost sight of that is in an echo chamber.
- jjbinx007 2y agoI'm not blaming the victims, but at the same time they will have seen several warnings from their browser indicating that the sites are unencrypted and not to send sensitive information.
- alamortsubite 2y agoThe guy's evil-twin sites may have been encrypted. Nothing in the article suggests otherwise.
- lbourdages 2y agoThey may be self-signed but if he rolls out his own self-signed certificate the browser will also put a big warning to not go forward.
- saagarjha 2y agoWhy would they be self-signed
- lbourdages 2y agoWell you can't have a real amazon.com cert ¯\_(ツ)_/¯. If you use a random domain sure it works, but it's also fishy. I guess most people won't notice...
- kube-system 2y agoMake the domain login-to-[airline]-wifi.com, get a real cert, and return a form with <h1>Login with Facebook</h1> and you won't ring alarm bells for the average user
- alamortsubite 2y agoWhat's the imagined obstacle in obtaining a real cert?
- netsharc 2y agoLetsEncrypt cert? The domain could be something like amazon.freeewifi.com, it can have a username/password field and a text above it that says "enter your Google/Facebook/Amazon login", and the majority of users won't realize that this is a 3rd-party site. Experts like us might notice "That's not how 3rd party auth is supposed to work!", but the majority really won't know. A few years ago I read a statistics that most (90%+) computer users just do things based on rote memorization of sequences of actions, not understanding what happens in the background. I wonder how it is nowadays. Maybe AI that can "smell" if you're on a scammy site (e.g. prompts to enter your Google/FB/Amazon password) would be useful, but then again the implementation might end up being like MS's "let us record your screen, for AI!" horseshit..
- lbourdages 2y agoI was imagining them trying to spoof an amazon.com domain using an evil dns server or something of that nature. That would be much harder to detect, but the cert is an issue. I guess it's overcomplicating things, though. Most people will just not notice that whatever domain they use is not legit.
- netsharc 2y agoYeah, just like "I'm a prince who needs your help to move money" scams are riddled with poor grammar, it's easier to keep it dumb, to attract the unsuspecting. But on the flip-side, if there's an expert on the flight, they'd notice it's a spoof site and chances are higher they'll report it to the crew. I can imagine the trick is to show a page that says "For free WiFi, follow our Instagram account, click here for our account", and the click will fail because there's no connection (if we're on the plane), but the click can trigger some Javascript to say "If you couldn't follow our Instagram, login using your Google/Amazon account: Username: ____ Password: ____". Or a more sophisticated trick would be to show a DIV that looks like Instagram and the "follow" button, which will then show the fake login... The privacy-wary IT expert will look at the "Follow our Instagram" and think "Fuck off, I'm not doing that!" and might miss the spoofed login prompt...
- QuadmasterXLII 2y ago
- sunaookami 2y agoHTTPS is not and never was a sign for trustworthyness.
- kube-system 2y agoI wouldn't say "never was". EV certs were an attempt to do exactly that for a time period of about 10 years. And many users were explicitly trained to trust EV certs as indicating that the site was independently validated as trustworthy, during that time period.
- goldpizza44 2y agosounds like he was simulating openid-connect flows by saying "login with Google" or "login with Facebook" and then storing the credentials entered which would be cleartext. I always suspicious of these flows for specifically this reason. The flows are secure as long as you know you are talking to the correct identity provider, but I think most laymen would not understand that concept.
- kevincox 2y agoThis is why using a password manager with browser integration is critical. If the password doesn't auto-fill something is wrong.
- tomr75 2y agoor use a passkey
- WolfeReader 2y agoGotta be careful with that too. If your password manager offers to auto-fill on the base domain - for example, *.google.com, it would be fooled by any phishing site hosted on google sites or google forms.
- marshmellman 2y agoWow, that seems like a huge security risk for Google that people can create phishing sites on their auth domain. I don’t think Google Forms allows login forms, but I’m surprised Google Sites would offer hosting on the primary Google domain.
- ianschmitz 2y agoHSTS is a great mechanism to help protect against this. Although it assumes the user has visited the site previously within the HSTS expiration period. There’s also the HSTS preload list: https://hstspreload.org/ https://hstspreload.org/
- beachy 2y agoHow does this help if the evil portal is an entirely new destination for the victim?
- goldpizza44 2y agoInteresting site on hsts. I don't think HSTS will help if he is running his own WWW site on his laptop with a proper CA signed cert. If I understand correctly his laptop was presenting a proper WWW login page presumably over HTTPS after victims connected to his WIFI. What he was probably faking was the redirect to the Identity Provider (IDP) by staying on his own properly credentialed HTTPS site which would pass all HSTS checks. He may have also been faking DNS responses to keep users where he wants them.
- omegabravo 2y agoHow would they have got a proper CA signed cert for a domain they don't own? HSTS will only make a HTTPS connection. Without the valid certificate, they should get a warning. The only way this "works" is if a captive portal pops up a browser to a site that looks the same like amaz0n.com. Password manager wouldn't popup, but many people don't use them. Faking DNS also won't help with the TLS warning, they won't have the certificate. Basically, this shouldn't be possible with HSTS.
- rahimnathwani 2y ago> How would they have got a proper CA signed cert for a domain they don't own? No need. People probably don't look closely at the domain name.
- willhackett 2y ago
- erikaww 2y agoPretty sure they can glean some info just by looking at dns requests. Maybe could infer who is who by MAC address. Though, I think you need to act like a router. I think could just listen to all of this on public Wi-Fi though
- nunez 2y agoProbably fake login portals