3 ms·

If you're behind a NAT and have an evergreen browser, say FF with UBO, avoid email attachments, etc... it's not very risky.

esseph 1y ago
Did you know a website can scan your lan through a browser now? https://developer.chrome.com/blog/local-network-access https://developer.chrome.com/blog/local-network-access Did you know that a lot of current home router NAT implementations are currently broken, in particular for UDP traffic handling, and you can therefore spoof your way into the network? https://www.armis.com/research/nat-slipstreaming-v2-0/ https://www.armis.com/research/nat-slipstreaming-v2-0/ A lot of router vulnerabilities floating around out there. Ever hear of UPnP/UPnP2? Did you know that applications can trigger your router to open inbound ports for you? There have also been some 0 click exploits lately, those are fun. You don't have to do anything at all! https://github.com/Defense-Intelligence-Agency/Zero-Click-Exploit-Deployment-Framework https://github.com/Defense-Intelligence-Agency/Zero-Click-Ex... Yeah, you're still at risk, and moreso because you're not aware of how open you are.
- mixmastamyk 1y ago
  You're talking to a Slashdot refugee. Haven't ever had UPnP available. I don't use Chrome and do use OpenWRT with AdGuard, you insensitive clod. ;-)
  - esseph 1y ago
    I had a 5 or 6 digit ID which was pretty good for a kid not from the Bay Area, but I never got into slashdot flame wars. I still reflexively check it many times a day.
    - mixmastamyk 1y ago
      I have a five but I didn’t make an account for a long time.
- agoodusername63 1y ago
  Do you think that the average HN commenter has the same phishing risk as your grandpa? They're fine.
  - esseph 1y ago
    Everybody says that until it happens to them. Every time.
    - bigstrat2003 1y ago
      Considering I'm going 40 years strong of not once falling for a phishing scam, I feel pretty confident in my assessment that I won't do so in the future. It has to be an exceptionally good phish to get anyone moderately technical to even take a second look. And even then, generally one can tell upon a second look. It's not hard to not get phished.
      - esseph 1y ago
        It can be visually identical to the real domain. https://www.kicksecure.com/wiki/Unicode https://www.kicksecure.com/wiki/Unicode It's also happened with code pushes on GitHub, which didn't get caught in code review, and has compromised build processes by introducing a malicious domain that is visually identical. Sounds like a HN-type problem. https://www.knostic.ai/blog/zero-width-unicode-characters-risks https://www.knostic.ai/blog/zero-width-unicode-characters-ri...
      - shmeeed 1y ago
        I felt the same until my company's IT department got me with a (thankfully simulated) well-made phish on some bleary-eyed morning after a birthday party when I was only half awake. Everybody feels confident until a slip happens. It's really just a function of probability and time acting against you as well as anybody, just like companies shouldn't ask themselves whether they'll be hacked, but when. It also seems to me that phishing has become vastly more sophisticated in recent years, IMHO mainly due to 3 issues: 1. A growing number of huge data leaks that enable scammers to profile and target possible victims to an unprecedented degree and attack them using unexpected vectors. I remember my feelings sinking the day I received the first phish that contained basically all my personal data to address me. Once it's out there and traded, there ain't no getting back. As a consequence, spear phishing has become much more automated and widespread. 2. Proliferation of 2FA, often via email, as a supposed remedy-for-all which leads to a false sense of security. 3. The sheer ignorance of some actors that continue to undermine all the best awareness efforts and normalize insecure practices. For god's sake, I've received unsolicited emails from my bank as well as from globally acting online retailers telling me to click on a link and log in to solve some issue. To my great astonishment, both turned out to be legit. What the hell were they thinking? Really, I wish all of us good luck. But I don't feel so confident anymore, rather like an unwilling participant in a lopsided arms race, where the adversaries have great resources at their disposal, and I have nothing more to rely on than my wits. ... Actually, put this way, it sounds like a classic cyberpunk tale. There's some appeal to it, I admit, but still.

esseph 1y ago

Did you know a website can scan your lan through a browser now? https://developer.chrome.com/blog/local-network-access https://developer.chrome.com/blog/local-network-access Did you know that a lot of current home router NAT implementations are currently broken, in particular for UDP traffic handling, and you can therefore spoof your way into the network? https://www.armis.com/research/nat-slipstreaming-v2-0/ https://www.armis.com/research/nat-slipstreaming-v2-0/ A lot of router vulnerabilities floating around out there. Ever hear of UPnP/UPnP2? Did you know that applications can trigger your router to open inbound ports for you? There have also been some 0 click exploits lately, those are fun. You don't have to do anything at all! https://github.com/Defense-Intelligence-Agency/Zero-Click-Exploit-Deployment-Framework https://github.com/Defense-Intelligence-Agency/Zero-Click-Ex... Yeah, you're still at risk, and moreso because you're not aware of how open you are.

mixmastamyk 1y ago
You're talking to a Slashdot refugee. Haven't ever had UPnP available. I don't use Chrome and do use OpenWRT with AdGuard, you insensitive clod. ;-)
- esseph 1y ago
  I had a 5 or 6 digit ID which was pretty good for a kid not from the Bay Area, but I never got into slashdot flame wars. I still reflexively check it many times a day.
  - mixmastamyk 1y ago
    I have a five but I didn’t make an account for a long time.
agoodusername63 1y ago
Do you think that the average HN commenter has the same phishing risk as your grandpa? They're fine.
- esseph 1y ago
  Everybody says that until it happens to them. Every time.
  - bigstrat2003 1y ago
    Considering I'm going 40 years strong of not once falling for a phishing scam, I feel pretty confident in my assessment that I won't do so in the future. It has to be an exceptionally good phish to get anyone moderately technical to even take a second look. And even then, generally one can tell upon a second look. It's not hard to not get phished.
    - esseph 1y ago
      It can be visually identical to the real domain. https://www.kicksecure.com/wiki/Unicode https://www.kicksecure.com/wiki/Unicode It's also happened with code pushes on GitHub, which didn't get caught in code review, and has compromised build processes by introducing a malicious domain that is visually identical. Sounds like a HN-type problem. https://www.knostic.ai/blog/zero-width-unicode-characters-risks https://www.knostic.ai/blog/zero-width-unicode-characters-ri...
    - shmeeed 1y ago
      I felt the same until my company's IT department got me with a (thankfully simulated) well-made phish on some bleary-eyed morning after a birthday party when I was only half awake. Everybody feels confident until a slip happens. It's really just a function of probability and time acting against you as well as anybody, just like companies shouldn't ask themselves whether they'll be hacked, but when. It also seems to me that phishing has become vastly more sophisticated in recent years, IMHO mainly due to 3 issues: 1. A growing number of huge data leaks that enable scammers to profile and target possible victims to an unprecedented degree and attack them using unexpected vectors. I remember my feelings sinking the day I received the first phish that contained basically all my personal data to address me. Once it's out there and traded, there ain't no getting back. As a consequence, spear phishing has become much more automated and widespread. 2. Proliferation of 2FA, often via email, as a supposed remedy-for-all which leads to a false sense of security. 3. The sheer ignorance of some actors that continue to undermine all the best awareness efforts and normalize insecure practices. For god's sake, I've received unsolicited emails from my bank as well as from globally acting online retailers telling me to click on a link and log in to solve some issue. To my great astonishment, both turned out to be legit. What the hell were they thinking? Really, I wish all of us good luck. But I don't feel so confident anymore, rather like an unwilling participant in a lopsided arms race, where the adversaries have great resources at their disposal, and I have nothing more to rely on than my wits. ... Actually, put this way, it sounds like a classic cyberpunk tale. There's some appeal to it, I admit, but still.