- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
- A jetlagged Troy Hunt accidentally clicked a link and logged into an account only to realise he had been phished.
- Despite reacting quickly, attackers were able to export a mailing list for Hunt’s personal blog.
- Hunt has detailed the attack and warned his subscribers in a timely fashion.
You must log in or register to comment.
He must have been really tired, he even stated all the warning signs he ignored.
If anything it should just be a warning that literally anyone can make a mistake due to stress/fatigue/whatever
Thats why we have RSS feeds. Thats how I follow Troy
TIL: Nobody is perfect
glares in the general direction of the White House
…did you think there were perfect people in the White House before this? Or at any point in your life? Haha
(Maybe as a child would that make sense…)
Teddy Roosevelt was pretty chill. He’s surely not perfect, but he’s pretty okay in my book.
I’m a Jimmy Carter man, myself.
Pobody’s Nerfect
I’ve clicked an obvious phishing link once in an isolated environment with a hardened browser on purpose. It had a tracking link and all and the URL was just ever so slightly off. Nothing happened on the target page though. No attempted script execution, no iframes, no cross site shenanigans, no weird popups or a fake login UI urging me to enter my credentials asap.
Someone from my company’s security department called me shortly, telling me how I’ve failed the obvious phishing exercise and I had to undergo a half hour long mandatory awareness training. Wasn’t getting out of that one.
Is there anything bad that can happen if you just click a link without logging in or anything? How is it different from opening up a random search result?
Not all phishing links are related to credential theft or trying to get you to download something malicious. Zero-day vulnerabilities in web browsers are revealed constantly. A malicious website (or malicious content embedded into an otherwise benign website) can leverage these or other unpatched vulnerabilities when visited.
You should never follow a known or suspected phishing link unless it’s your job and you are using the appropriate tools and techniques. Just report it to the security department or delete it and move on with your day.
Does that also mean I should not browse any websites I don’t already know? That’s very limiting.
I never said that. I said do not follow known or suspected phishing links. It takes practice and skill, and it is not always simple. But if you know if it is a risk, you should consider avoiding the risk.
“This looks like it might be phishing. Let me check it out and see what’s on the other side.” <— That’s what I am suggesting to avoid.
Security is an onion: layered. Patched software. Good, unique passwords. MFA. Various security defense tools. But technology can have gaps, flaws, or be circumvented. It’s important to keep in mind that us as individuals are also a security layer, and are often the first or last line of defense.
If you look at the headers, you can tell which ones are fake phishing and real phishing.
Please explain
Most companies add an email header like “X-PHISHTEST” to the phishing tests (and a corresponding spam filter rule) to ensure they don’t get caught by spam filters. If you look at the headers of a spam email, the company test emails will have that header.
Solving the “being human” part of security will probably never happen, which is why you’re encouraged to do stuff like use 2FA, different passwords, service isolation and stuff like that.
Anyone and everyone can be fooled at some point, best to try and limit the damage.
I just never click links in email.
If you use a password manager it won’t fill credentials because it will be the wrong domain
Unfortunately the article said he just put in his credentials anyway, even though his password manager wouldn’t autofill for him. Pretty stupid, but at least he acknowledges it
I’m not just the owner, I’m also a member!
AT this point it is safe to assume you will fall for scams like this in your life. They are too like the real thing. We need the laws and police to catch up to investigating this thus making crime not pay (most of this is from countries that don’t work with police - so probably some major international efforts required as well).
I almost fell for a bank scam a couple years back. Basically, I had just gotten a new phone w/ GrapheneOS, which doesn’t have Google’s scam number protection (I was well aware, that’s not the issue) and I hadn’t yet transferred my contacts, and I received a call about a fraud alert on a card. This has happened a few times, and usually it’s a pretty straightforward call where they verify my identity before asking me about certain transactions. As a bit of background, I was on vacation at the time and I got the call while waiting in the parking lot while my SO ordered something at a food truck.
Anyway, the call progressed like this:
- Mentioned <card type>, which I have
- Asked to verify my identity with a code to my phone - standard
- Went over a couple suspicious transactions, which I confirmed wasn’t me
- Asked to verify my identity again, and that’s where I got suspicious, so I didn’t provide it
I immediately called my bank and sorted things out, and we figured out nothing was stolen because I didn’t provide the second code (that was to link an external account to suck my money out). Because I was in an unfamiliar setting and honestly pretty tired (we drove all day the day before), I just skimmed the text in step 2 w/o reading that it was a user-initiated code (i.e. for a password reset) instead of a bank initiated code (i.e. verify identity).
I consider myself a pretty security-conscious person. I use a password manager, MFA everywhere I can (preferring TOTP), I’m a lead backend SW engineer who has caught multiple security issues, etc. However, I fell for the scam and missed the safeguard that should have protected me. Fortunately it all worked out, but I did have to change all of my account numbers and login, which wasn’t particularly fun while on vacation. That bank is fortunately one of the few that supports TOTP in my country, though I had avoided setting it up because it required a special app (Symantec VIP) and calling in (no self-service). I now have it set up and feel much better about my account security.
Happens to the best.
Don’t password managers verify the domain name before offering credentials?
Does that mean he doesn’t use a password manager?
Edit: RIP, now that’s a proper phishing. I understand where he’s coming from
He mentioned that he does and the password manager didn’t prompt to autocomplete the password automatically, so he had to force it.
The thing that should have saved my bacon was the credentials not auto-filling from 1Password, so why didn’t I stop there? Because that’s not unusual. There are so many services where you’ve registered on one domain (and that address is stored in 1Password), then you legitimately log on to a different domain.
Then add multiple URLs for that entry. You can even have it match on the base domain, so it works on any subdomain, or restrict it to a subdomain.
I assume that works on 1Password, it works on Bitwarden at least.
That said, I could see myself making this mistake. I’ve had to manually find entries before for one reason or another (e.g. usually use the app, but access the website this one time).
It does work there. The unfortunate thing is that so many sites change their login structure often enough that it no unusual to discover that a site just changed again and you need to update the list.
