Hacker News Reader

Comment by justinclift | Hacker News Reader

That's true, but it's not unreasonable to foresee the creators making OSX/Linux versions too if these Windows ones "go ok" from their point of view. :(

What's worrying to me is the wording of the emails themselves. It's much better, and more likely appearing "legit" than the vast multitude of scam/trojan/similar .pdf/.xls/.doc/.lnk/etc emails I've seen. (several a day generally)

View on HN

With the now current curl | sh pattern, one just needs some MTM attack, or even just trick someone to do it, as the majority never look to the contents of the shell script.

It's been demonstrated in the past that server can detect the pipe to shell and modify content - timing attack, if I recall correctly

How does it work? Any sources?

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

Thanks, that's very interesting.

Or serve a different script based on browser headers.

Out just develop a really useful node script that then gets a little extra.

Which is why it could only be done in a vm. VM breakout is still a risk but at the end of the day it's only ever about mitigation not panacea. A startling number of people use this method too what with the plethora of package managers available. The evildoer's best friend laziness - just keeping going longer than someone on average would reasonably expect you to, i.e. not very.

I've been worrying about this for some time, I regularly get customers sending screenshots inside Word documents, a well targeted email could easily get past my defences.

Reply on news.ycombinator.com