11 ms·
Phishing Has Gotten Very Good
- fnordfnordfnord 14y agoThis is not new. Government officials and corporate executives have always been targets of espionage. That spies would disguise their attempts as common spam/phishing is unremarkable; as is the notion that some ordinary hackers might also preferentially target this class of people.
- yalue 14y agoExactly. The term the article should be using for it is "social engineering." It would only take a minimal amount of research to create a legitimate-looking email to a Coca-Cola executive or whoever. Emails claiming to contain coupons for free sexual performance enhancers won't exactly work for most people, so a little research isn't a stretch at all.
- tripzilch 14y agoSpear phishing and social engineering are pretty close. Maybe even the same thing, but arrived from a different angle.
- Jabbles 14y agoA well-worded email claiming to contain a PDF CV of an ambitious graduate could easily be opened by a CTO. Or "Check out my blog... (I specialise in Javascript so please turn NoScript off.)" The possibilities of social engineering are scary.
- runejuhl 14y agoYou might want to put a link to your blog somewhere.. :)
- corresation 14y agoThat's all very world weary, but this most certainly is new, and attack vectors have changed.
- baudehlo 14y agoIt most certainly is NOT new. We were writing about it at MessageLabs (now part of Symantec) years ago (in 2007 or earlier IIRC). What's surprising is that I gave a talk twice for Schneier's company Counterpane on tour with him in Texas, to a small room of people, including Bruce, covering exactly this topic, around that time. Disclaimer: I no longer work there but I created their anti-spam software.
- arkitaip 14y agoSo how do you protect yourself from these highly-targeted attacks? How about running the browser in a sandbox that resets all changes on exit? I've actually set up Firefox (hardened) + Sandboxie on Win7 but exactly how good is this setup?
- jgrahamc 14y agoUse a browser that's not on your machine. See, for example, https://www.authentic8.com https://www.authentic8.com
- Luc 14y agoInteresting, but despite some searching I couldn't find a price for this service. Has anyone tried it?
- wslh 14y agoIt's running on their servers! I prefer to have a VM on my side. In terms of security I don't trust third parties. Or saying it in a different way: can I look at their server configurations before acquiring their services?
- superbaconman 14y agoDoes this really solve the problem though? If a file that contains the attack appears legitimate, it could potentially be shared. If the file is saved to google docs or dropbox everyone who tracks that folder is compromised also.
- sltkr 14y agoSo to avoid leaking any private data to third parties, I should send all my private data to a third party using a proprietary protocol?
- newman314 14y agoI know not everyone can do this but fire up a VM for browsing and reset after every session.
- 14y ago
- deleted 14y ago[deleted]
- trotsky 14y agoWhile hill staffers and other washington movers and shakers were being carpet bombed two years ago during budget negotiations, it was really eye opening how much individual effort was put forth. They were exploiting a flash 0-day that was embedded in various .xlsx .docx and .pdfs - pretty slick as it got them around noscript policies and outside any sandboxes. The turn around time was crazy - on at least two occasions the workflow went: recent victim gets first/early copy of policy paper written that day --> document is taken, translated to a different format and has 0 day inserted --> emails with exploit are sent to no more than 10-15 people the victim frequently discusses the topics covered in the paper with. --> Many include personalized notes that include observations the victim had sent to the author --> Time from initial email receipt to exploits all mailed: around 3 hours Now that's how you get a 95% open rate. related: http://contagiodump.blogspot.com/search/label/CVE-2011-0611 http://contagiodump.blogspot.com/search/label/CVE-2011-0611
- mshron 14y agoCitation needed? If true, that's a pretty crazy story.
- modeless 14y agoYeah, what? Who is sponsoring 0-day exploit attacks against Hill staffers? Do the parties go that far to get an edge against each other in negotiations? That seems like it would be front page NYTimes material.
- snowwrestler 14y agoChina.
- codemac 14y ago> Who is sponsoring 0-day exploit attacks Anyone who could profit is our starting set. And the budget for the federal government funds massive amounts of private entities that have a vested interest in finding out ahead of time what their and their competitors funding will be. Notably, hedging their bets on an exchange. And, maybe obviously, some of these private entities are the very entities that are consulted for the federal government's email and computer security policy.
- anonymousDan 14y agoAnyone come across Bromium before ( http://www.bromium.com/ http://www.bromium.com/ )? I think some of the 'micro-virtualization' ideas they describe sound really interesting. I believe it was founded by some of the people behind Xen.
- lake_rogue 14y agoDon't you all know what this means? Someone gone and caught the big phish. Bruce's site is hacked. Clever self-referential hackers. We're all done for.
- cromwellian 14y agoI wonder how many of these exploits are simply the result of the following five factors: o Windows o Internet Explorer o Java o Flash o Office People can whine all they want about Chromebooks not running non-cloud stuff, but IMHO, diplomats, executives, et al should be required to use locked down machines for communications, and training to educate people about opening email links should be widespread. I get emails all the time from my bank and credit card companies, but even if I visually inspect the link targets, I don't trust them, I always type in the location myself if it is a site that I know I'm going to enter important credentials into.
- jiggy2011 14y agoYou can get them all to stop using Java/flash/office etc but then the attackers will just start to target whatever they switch to.
- eslaught 14y agoIf "whatever they switch to" is ChromeOS + web apps, then it's going to be much more expensive to get past a Chrome sandbox than any of the current exploitation favorites. Sure, it's not impossible, but at least making exploitation more expensive will put the little guys out of business. And Google has sufficient money to throw at Chrome security that it will become more expensive over time, not less.
- camus 14y agoweb apps are on servers that can be hacked. if facebook or twitter can be hacked so can b google docs or any SAAS.
- eslaught 14y agoOf course. But that's very different from hacking the user's own machine, which effectively provides the hacker with access to everything the user does. Hacking a single service means that you merely get access to that one service, plus anything else where the user used the same password. And we already have technologies which would make it so that hacking a service would only give access to that one service, e.g. Mozilla Persona[1]. [1]: https://www.mozilla.org/en-US/persona/ https://www.mozilla.org/en-US/persona/
- andreyf 14y agoIt's 2013, and clicking on an evil link can still compromise your machine? I'd say the failure is much larger than just the anti-virus industry.
- btipling 14y agoA lot can happen when you click a link. You download content like images, run plugins, open up third party apps (like iTunes or a chat client). You render images, you can start the hardware accelerated canvas stuff. You're downloading all of this content onto your computer and then your computer processes it. It's not like you're using a remote viewer to view something not on your computer. Going to a website is downloading files.
- stephengillie 14y agoA lot of things that I don't want to happen occur when I click on a link. Cookies are sent to foreign servers without my knowledge or consent. Advertisements are displayed. Audio can be played without my consent. Powerful flash and javascript plugins can run without my consent that can hijack my browser and deny me the use of my computer until I restart it. When I click on a link, I want a remote text and image viewer. Sometimes I'll allow certain sites like youtube to run flash, even automatically. This computer is my tool, not someone else's, and in 2013 clicking on a link shouldn't be a wildly uncontrolled and dangerous experience.
- badgar 14y agoI'm sorry that the web isn't what you want it to be. Unfortunately for you, the web never was what you want it to be. Maybe switch to gopher?
- stephengillie 14y agoThe web is what it is. In theory, my processors would only run the code I want them to -- not the selection of code, scripting, and plugins that any random website may have. I work very hard to make that theory into reality.
- malandrew 14y agoThis is one of the reasons I'm pretty happy about the new execution model being discussed by the W3C's System Applications Working Group. The move of sensitive information from the desktop to the browser is leading to a "sandbox" everything approach, which may not be safer, but should at least mitigate the damage done. Nowadays if you compromise the machine of an individual, you own everything they use and everything they do. With some sort of sandboxing between tabs and between privileged user resources (contacts, messages, email, calendaring), the amount of resources an attacker can control is reduced. The problem on the desktop is that the default M.O. has always been to trust the user entirely with respect to everything, but machine administrative (root) actions. With sandboxing and new security models around the user's own data, the M.O. now becomes only trust the user within one area of their life, but not between areas of their life (so a PDF document can't affect their email without explicit user action) Sandbox all the things.
- hollerith 14y ago>This is one of the reasons I'm pretty happy about the new execution model being discussed by the W3C's System Applications Working Group. What would make me even happier is a way for me to read the writings of my favorite authors without relying on many millions of lines of source code (i.e., a "modern" browser) and the inevitable security holes in those millions of lines.
- surfaceTensi0n 14y agoThat's not a problem that will be solved completely, realistically. For better or worse the Internet is where most of your favorite authors are putting their writings for now. There are work arounds, though. Using a non-browser based RSS reader should help.
- malandrew 14y agoWell, Mozilla is starting afresh with its Servo browser engine based on its Rust language. Given the design choices for Rust and Servo, I imagine that it's going to be a lot more secure and stable than the current crop of browser engines (Webkit, Gecko, Trident, etc.)
- rwmj 14y agoI think many of these attacks could be prevented if we controlled outbound connections more carefully.
- enraged_camel 14y agoI love how everyone here is extremely focused on the security of different technologies (Chromebook, Office, Java, etc.), when really the point of the article is that regardless of what technology is used, the weakest link in any system will always be people. Schneier stated this explicitly: "Amateurs target systems, professionals target people." It doesn't matter if your money is behind a five-foot-thick reinforced-concrete safe if the banker can be convinced to open it for an attacker.
- markdown 14y ago> It doesn't matter if your money is behind a five-foot-thick reinforced-concrete safe if the banker can be convinced to open it for an attacker. So we should use thinner walls or none at all? Don't be obtuse. We talk about the walls, because stronger walls reduce the chances of a break-in.
- enraged_camel 14y ago>>So we should use thinner walls or none at all? This is the textbook definition of a strawman. What I am pointing out is that nobody is discussing how to train/educate humans to be more resistant to social engineering attacks. Instead there seems to be an echo chamber of "X system is so much secure than Y system!" which is really banal.
- tripzilch 14y agoIn all fairness, I wouldn't call the people that target systems "Amateurs". Just operating in a different business (botnets, spam, cc fraud, etc).
- danial 14y agoWhile this is interesting it shouldn't really be surprising. Whatever happens in the real world is inevitable in the cyber (ugh, dislike that word) world. Government and commercial espionage is fairly common and employs the use of sophisticated infiltration, sabotage and subversion techniques; this is just its parallel on the Internet.