If malware authors ever learn how to spell we're all screwed

http://www.hanselman.com/blog/IfMalwareAuthorsEverLearnHowToSpellWereAllScrewedTheComingHTML5MalwareApocalypse.aspx

by bdfh42 • 14 years ago

175 102 14 years ago

robert_nsu• 14 years ago

He's right. Most of the time, the things that tip me off are the misspelled words and poor grammar; also, the conflicting information. For example, getting an email message from Chase Bank with a signature from a Wells Fargo employee. A lot of people are one well versed phisher from losing a lot of time and money.

TazeTSchnitzel• 14 years ago

I've always thought about how easy it would be to make properly done scareware. Shame (sort of) that nobody's done it.

danielweber• 14 years ago

Once I got a letter from Bank Of America that they had noticed weird activity on my home equity line of credit, with a weird phone number to call to talk. No one answered that number, and I don't have an equity line.

It turns out the letter really did come from BoA.

EDIT: and once Chase sent me a letter telling me to reply by September 31. http://danweber.blogspot.com/2009/08/chase-does-it-again.htm...

CWuestefeld2• 14 years ago

Back when "Verified by Visa" first came out, and I first saw such a page, I called my credit card company to see what was up.

The customer service people at the card had no clue what was going on. They'd never heard of it either. They told me they'd escalate the question to a manager and call my back, but they never did.

CamperBob2• 14 years ago

There was a story on HN not too long ago where a stereotypical 419 scammer explained why the schemes haven't gotten more sophisticated. Basically, it's a waste of time and resources targeting people who aren't either senile, naive, highly religious, or just plain morons. Using proper grammar and a well-thought-out background story will just bring your scam to the attention of people who might have the ability to investigate or otherwise interfere with it.

Put another way, if you want to steal a million dollars, do it by stealing $100 from 10,000 people. Much safer than stealing $100,000 from 10 people.

mseebach• 14 years ago

Probably an instance of this?

[T]he obvious giveaways are used as a pre-qualifier, to ensure with the least possible effort that the ONLY people who respond to the scammers' initial mass mailings (and therefore have to be brought along individually during the later stages) are the absolutely most gullible, ignorant, susceptible, suckers they can find.

http://www.quora.com/Scams/Why-are-email-scams-written-in-br...

eridius2• 14 years ago

I thought that too, but it doesn't apply. This is malware. It doesn't need someone to be gullible beyond the click of the button. Scams, on the other hand, require actually convincing the mark to send money, which is why they need to be sure they have a gullible person on the hook.

txo• 14 years ago

But they do, most of these malware scams involve the user going to their website and buying their special malware removal tool.

simonbrown6• 14 years ago

It's their button, why would they need the user to click it? I guess it could be clickjacking, but there must be an easier way to do that.

DavidChouinard• 14 years ago

Related: "Why do Nigerian Scammers Say They are from Nigeria?", http://research.microsoft.com/pubs/167719/WhyFromNigeria.pdf

CWuestefeld2• 14 years ago

Scott's right, of course.

But to the advantage of the good guys, anybody with the brains and discipline to do a better job of this kind of thing, is much more likely to be able to make a better living honestly, than through fraud and deception.

kylebrown• 14 years ago

I don't think the business of selling "single mom makes $700/day online" business plans is an honest living, but judging from the amount of ads and comment spam at least a few people are making a living at it (and google of course takes a nice cut as well). From what I've read, even though it converts better than online pharmacies and rogue anti-virus, you can get more traffic to the latter two.

drzaiusapelord• 14 years ago

The problem is that the people who click on these also have lousy grammar and don't notice, don't care, or won't actually read all of the text.

There's only so much we can do if the end user refuses to think. I suspect a lot of these people will be migrating to locked down/walled garden devices soon anyway.

jetti• 14 years ago

"The problem is that the people who click on these also have lousy grammar and don't notice, don't care, or won't actually read all of the text."

Considering that polished pieces of software ship with typos as well, it isn't an indicator of a virus or malware.

mattmanser• 14 years ago

One of the programs I inherited once had been written by a programmer who loved alert boxes of the form 'Are you sure you want to Delete X'.

I was watching a user a month or so afterwards to notice they just pressed enter every time an alert box popped up, immediately, without reading and without thought.

Alerts on computers aren't there to be read any more. They're confusing annoyances that you just click yes to. They're usually badly written in that they tell a normal person nothing, they're without context and usually ultimately exist because a programmer was prevaricating on making a decision.

We nagged our users too much as programmers, to turn around and blame them for not thinking is a sublime irony given that we were the ones not thinking and constantly asking for reassurance that it was us not making a mistake.

Osmose• 14 years ago

Instead of using alert boxes to confirm that a user wants to perform a destructive operation, you should support undoing the change after it's done, perhaps for a limited time.

jaylevitt3• 14 years ago

This was known 20 years ago; see e.g. the seminal UI book "About Face".

superasn• 14 years ago

This is a rather sophisticated scam indeed. Unfortunately you don't need such kind of sophistication level when it comes to non-tech users or as the OP puts it his "Mom".. because for them even a banner ads which say "you have one message waiting" or the ever popular "emoji in email" just works equally well.

andybak• 14 years ago

In moments of distraction I've had a couple of near-misses where I nearly clicked on malware.

But when I'm trying to explain to my dad how to know what to trust and what not to trust I realise it's completely hopeless. You can fake almost everything that a non-techie would know to check.

its_so_on• 14 years ago

Ever think to link to a file (e.g. excel spreadsheet) for a forum, like you can for an image with imgur?

other than Dropbox public url's the services that exiist have so many images with the word "Download" in the resulting link, all of which look exactly like a UX element, that you have to click about half of them or play Sherlock Holmes to uncover the real download link. It's like a scratch-off lottery.

simonbrown6• 14 years ago

You could get a hosting account (e.g. NearlyFreeSpeech or S3) and hotlink to them. I guess people don't often intentionally click ads when downloading files, unlike viewing images, so setting up a free file host isn't profitable.

gerts3• 14 years ago

Or install AdBlock guiltfree because the website is obviously hostile beyond forgiveness.

merraksh• 14 years ago

There's no option other than "Clean computer." No ignore, repair, quarantine.

Note to malware coders: add ignore, repair, quarantine buttons that run the same code.

sp332• 14 years ago

Also note that Symantec doesn't have an "ignore" option anymore!

tjoff• 14 years ago

Instead of trying to create a fake image, why not print screen the real thing?

arriu2• 14 years ago

One day these things won't be "selectable" to prove to us that they are HTML

Selection is probably not the best way to check whether something is browser content...

  -webkit-touch-callout: none;
  -webkit-user-select: none;
  -khtml-user-select: none;
  -moz-user-select: none;
  -ms-user-select: none;
  user-select: none;

tterrace• 14 years ago

Yup, also you can use a css background-image rather than an html img tag.

gergles2• 14 years ago

Why does this parameter exist? What possible legitimate use could you have for disabling selection?

simonbrown6• 14 years ago

Any time you need the user to drag their mouse or double-click and don't want selections getting in the way. e.g. drag and drop

nixterrimus• 14 years ago

I've thought about this quite a bit. As HTML applications continue to evolve we should make them feel "appish". Things like selectable buttons take the user away from experience the app. Also graph labels shouldn't be selectable.

One of the big ideas of the web is selectable content. However UI elements shouldn't be included in this set.

I've written a little more about this (with some screenshots to illustrate my thinking) here: http://blog.dcxn.com/2012/02/29/selectable-elements-are-driv...

arriu2• 14 years ago

If you are making a WebGL game, you do not want UI elements to select each time you try to rotate the camera.

I have used this property quite a few times for perfectly legitimate reasons. Any time that the user needs to click and drag to accomplish an action other than selecting text, you would want to use this.

deno• 14 years ago

You could do this for a long time by calling Event::preventDefault method on MOUSEDOWN event. This is just the same using CSS.

Obviously, this is useful for a lot of things, disabling selection being only one.

tomjen3• 14 years ago

Games.

You don't want the user to accidentally drag your images all over the screen when he is trying to click on them (happens daily when I test the games I work on).

simonbrown6• 14 years ago

But it definitely proves the positive.

zvrba• 14 years ago

That's what happens when programmability (JavaScript, Java, Flash, plugins...) is added to a presentation format (HTML). Maybe this is the right time to revive Gopher and give Usenet a fresh breath of life.

hxa7241• 14 years ago

Never respond. Always take the initiative.

If something asks you about update/downloading/etc., reject it. You decide what to do and when, and you type the URL into the browser, or go to the normal menu/dialog/tool for updating.

(This is partly why Chrome browser is right and the normal approach is wrong: if/when it needs update, it just does it.)

fromhet• 14 years ago

That may work for people who think in terms of computer security, but not for the average user who are interested in just using the webapps.

Deestan2• 14 years ago

I think you're really on to something here. A root problem of this is that a lot of legitimate software communicate via random popups out of the blue - training users to just "do what the computer says".

People are used to the computer being in charge and commanding them. This is bad from a UX point of view, but now I see it also affects security.

Yet another reason popups of all kinds should be forbidden.

When all application-initiated communication come from the OS notification area, this kind of dialog will make people wary. Which is a win.

tlrobinson• 14 years ago

I forget what the term for it is, but there's a principle that any dialog that's asking the user for credentials or authorization must be clearly delineated from the rest of the UI and thus "unspoofable".

The example I recall was a "ribbon" in the OS that slide out to reveal the dialog. If a dialog presented itself but the ribbon remained along the edge you could immediately tell it was spoofed. Of course this requires the OS not allow untrusted code to reposition/hide the ribbon or present a full screen display without prompting the user.

Another example is iOS grays out the background (including status bar at the top) when presenting a modal password prompt. However this could easily be spoofed by a full screen native app. The only way to solve that is to require authorization to enter full screen mode.

Browsers are improving. At least Chrome shows the URL at the top of all popup windows. Entering full screen mode requires user authorization.

That of course doesn't solve the OP's problem of spoofing a floating window purely inside a webpage, but that really needs to be solved at the OS level.

juhanima3• 14 years ago

The term would be trusted path.

http://en.wikipedia.org/wiki/Trusted_path

EDIT: Also: spot on! I thought browser induced popups would have a clear signature of where they came from. Obviously this is not the case any more.

recoiledsnake• 14 years ago

You mean like the Vista and Win 7 UAC screen?

http://www.micro-isv.asia/img/win7uac.png

FreeFull• 14 years ago

What would prevent someone from spoofing this? (other than there being no apparent reason to spoof it)

rhengles• 14 years ago

This is the reason why I hated the move of the notification bar in Internet Explorer 9 from the top to the bottom of the window. And the UI is too simple to be spoofed.

jaylevitt3• 14 years ago

This assumes that users are computer-savvy enough to (a) expect an unspoofable dialog at all, and (b) know which parts are unspoofable and how they should look.

We tried this with "AOL Certified Mail", which had an unspoofable official chrome, and I don't remember any serious drop in phishing.

stcredzero• 14 years ago

> Should we digitally sign HTML5 apps?

Yes. That's better than nothing.

simonbrown6• 14 years ago

Well, you can already do that through extended validation. I'm not sure requiring it would be desirable, and doing this would need a better reason than it being better than nothing.

The philosophy of HTML5 seems to be allowing applicants to do a lot of things which don't require much trust to be placed in them (and most applications don't need much), rather than security through asking the user's permission (e.g. most desktop OSs), when they are unlikely to have much idea which developers they should trust, or through accountability/review (e.g. iOS), which adds barriers to entry.

wildtype• 14 years ago

Must be more shocking for unix-like os user if the "malware window" displayed as plain x11 window, with error message there.

Karunamon2• 14 years ago

Looks like trying to move the "popup" is a great way to defeat this kind of thing for now.

Me: Okay mom, if you ever get a popup that you were not expecting, try to move it outside of the browser before clicking on it. If you can't, it's fake.

Fairly simple, for now.

shanselman• 14 years ago

Unless the entire image is a clickable hotspot that starts the next step in the process of their evil. ;)

Karunamon2• 14 years ago

Can you do that? I.e. launch events on mouse down but not a full "click"?

phleet• 14 years ago

Reminds me of this: http://www.azarask.in/blog/post/a-new-type-of-phishing-attac... (the demo of it is a bit outdated)

RedwoodCity• 14 years ago

malware is a numbers game. All you need is a few thousand older people that don't know any better and you can have your password sniffer / bot net , up and running in no time.

While poorly written english is a red flag to some of us. Not all computer users are native speakers of english even in english speaking countries. They are much less likely to notice usage and spelling errors.

alister• 14 years ago

The OP's point is that displayed content can be made to be indistinguishable from visual elements of the browser even for technically sophisticated users in the near future.

This reminds me of login spoofing of yesteryear. How do you know if the login prompt on a shared computer or terminal is really from the OS or is a user-level program trying to steal passwords?

The usual solution was to hit a special attention key--like the "break" key under UNIX or Ctrl/Alt/Del for Windows--that user-level programs could not intercept.

Could we use the same idea here? Holding the "break" key will highlight genuine messages from the browser or the OS.

slug• 14 years ago

Long time ago I wrote a small program that would mimic the entry point of a DEC terminal server, slow baud rates screen refresh and all, and with the permission of the computer lab manager I installed it in a few PCs, next to the original dec VT terminals that were actually connected to the server.

It didn't save any passwords or such, just display some random funny non-sense message to the user after s/he inserted login and password and then loop back again to the login prompt with a failed error message.

Even with this obvious message that would warn an alert user for the suspicious terminal, we (my friends and the lab manager) got a few laughs when people coming to the lab and finding all the VT terminals taken would use the PCs to login and tried several (many!) times until giving up, at which point we would tell them the truth. Mind you, these were people comfortable with VT terminals and unix cli and somewhat computer savvy!

csmeder3• 14 years ago

Easy solution. Logging in takes two passwords. After you enter your first password (first 8 chars of your 16 char password) you are presented with an image of a Tiger. You now trust the system. (The picture of a tiger was your secret image). You now enter your second password (the remaining 8 chars of your 16 digit password).

See site key: http://en.wikipedia.org/wiki/SiteKey

slavak• 14 years ago

Great, you've now effectively reduced your password complexity to a measly 8 characters, while forcing the user to remember a 16-character long password.

pyre• 14 years ago

If the user selects their 'secret image' from a known pool of images (as would probably be the case if this is at the OS-level), then the attacker just has to select one of those images (preferably a cute one) and then they know that at least some of the users they snag will have that as their security image.

gerts3• 14 years ago

SiteKey is completely susceptible to Man-in-the-middle (unless the user is a scrupulous cookie-manager and refuses to re-authenticate a computer more than once), so adds minimal value over regular SSL.

fghh45sdfhr3• 14 years ago

Nah, you're already screwed. If you get to the point of the pop-up it is already too late.

unimpressive• 14 years ago

Don't see why this was downvoted. Once your opponent is executing arbitrary JavaScript on your browser, there's no real reason for them to try tricking you into clicking a link when they can just use one of the outstanding security vulnerabilities for your browser to install malware.

csmeder3• 14 years ago

Simple solution for tech savvy users. All system prompts should include a photo of a user selected image. If the incorrect image is displayed you know its a scam.

For example when I install Windows 8 or Mountain lion one of the first prompts I must address is:

   "Please choose an image to help you identify 
   valid system prompts"

The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,000 images.

   "The user decides to use an image of a tiger"

Next time a user gets a system prompt if the system prompt doesn't have the picture of a tiger they know its a fake prompt.

See site key: http://en.wikipedia.org/wiki/SiteKey

kht786• 14 years ago

Enough users will end up using certain images such as the tiger making it worthwhile to fake a prompt.

csmeder3• 14 years ago

   "The user is then presented 10 images (a tiger, 
   a house, a moose, etc) from a library of 10,000 images."

I should have made this more clear. The ten images are chosen randomly from the group of 10,000

The question is: are there 10,000 images that are different enough people won't be fooled. Say my picture is a green house. And a prompt has a picture of a red house, will I accidentally think its the right site key?

The good news is most people won't even have a picture of a house as their site key so it will protect a large percent.

astral303• 14 years ago

Tech savvy users are not the main problem in malware.

The whole SiteKey/tiger image solution only gives you an illusion of the solution. What happens when the system displays "System error, unable to display the image?" How will a convincingly-written error message prevent your average gullible or below-average competence computer user from logging in to a phishing site?

Think of how many things can go wrong on a computer. Think of every time when someone asked you why something works one way in this situation, but another way in another situation, and you had to use a technical explanation (excuse, really) for that inconsistency. Computing is full of that. Until we get to a place where people can actually TRUST and expect consistent behavior in their computing devices, the SiteKey/tiger will be well circumventable.

As far as I'm concerned, SiteKey is a brilliant business idea for selling to satisfy the regulatory two-factor requirement, but a terrible idea in practice.

avocet• 14 years ago

Take a cue from banks, and add a "confidence word". The user enters a special phrase such as "myspecialword". If "myspecialword" does not appear in the corner of the dialog box, they will know it's fake. I doubt there would be many technical issues that would prevent a simple phrase like that from displaying in the corner of the box.

hexagonc2• 14 years ago

I use (unfortunately) Bank of America online banking and if I don't see the SiteKey or really if there is any error at all during the signon process then I leave and immediately start Googling for Bank of America security breeches in the news. If I don't find anything, then I try to login again the next day.

johnhess• 14 years ago

My bank used to do this, and I never quite understood why. An attacker could easily mimic the site's behavior.

1. Attacker prompts me (or my grandmother) for login name. 2. Attacker gives login name to bank. 3. Bank serves proper image to attacker. Attacker stores image. 4. Profit.

yuliyp2• 14 years ago

The mitigation for that is asking you for a security question before showing you the login image and asking for password.

aptwebapps• 14 years ago

Yes, that type of security image is vulnerable to man-in-the-middle attacks but that is not what was proposed.

The parent poster suggested that all system messages have the security message. The user is not prompted for some sort of id first, they're already using the computer and are presumed to be logged in.

This is the right way to use security images, IMO, although they're still not perfect as others in the thread have pointed out. The way you describe, which I believe BoA uses (just hearsay), is bad security.

huhtenberg2• 14 years ago

Oh, common.

  Username: ____
  Password: ____

  Please note that as of June 7th 2012 the system prompt
  image identification system has been deprecated and
  being replaced with new security measures.

  If you have any questions or require assistance, contact
  technical support at support@bank.com

How many tech savvy persons would not be even a bit surprised by their bank legitimately doing something as retarded as this?

Deestan2• 14 years ago

I wouldn't be surprised.

Some fairly large banks here in Norway have at times ran with a not-completely-valid SSL certificate - making the bank login indistinguishable from a man-in-the-middle.

Answer from their phone support? "Oh yeah whenever you see that warning, just click 'allow' or 'ignore'."

politician2• 14 years ago

A suggestion to browser vendors: add a key combo that will turn all of the screen real estate managed by your browser into yellow diagonal stripes.

Then we just have to educate users to press this panic button whenever something that looks like a popup is on screen. If it's a real popup, it'll do the modal flash thing; otherwise the browser -- and everything in it -- turns yellow.

simonbrown6• 14 years ago

Or just tell them to switch tabs. Another sign is that if a dialog was actually showing, the browser window wouldn't look focussed.

e.g. on Windows the browser looks like this:

http://i.imgur.com/nbn9K.png

instead of this:

http://i.imgur.com/7F3FD.png

gerts3• 14 years ago

This is why you don't run your computer using the default UI theme on the most popular OS.

ams61102• 14 years ago

Yeah exactly. I always set my theme to the most minimal, "classic", non-effects, whatever options I can turn off. That way this kind of stuff really stands out.

mgkimsal• 14 years ago

I've suggested for years now that someone could make a killing selling copywriting services to spammers. Poor spelling, bad fonts, random crap, etc - these are all the hallmarks of spam which makes it easy to classify as spam. Well-written, intelligent-sounding, professionally-produced spam would likely get past more filters, and be harder for people to dismiss out of hand, and likely get more sales.

dhughes• 14 years ago

Here on HN or maybe it was Reddit I read the misspellings in spam/phishing were intentional to weed out anyone smart enough to detect it was a scam.

bbrtyth• 14 years ago

Malware authors have learned to spell -- many apps I install under the mistaken assumption that they will not run background services or send information back to the company, in fact do.

I also note that Dell's laptop division has a number of malware authors hard at work.

taejo• 14 years ago

The spelling heuristic doesn't work very well in much of the world. I live in a country where English is the primary language of commerce, government, etc. but only very few people (I think less than 5%) speak it at home. So the people writing the genuine banking websites, etc. are almost as likely to make mistakes as the phishers.

If malware authors ever learn how to spell we're all screwed

Related Stories