An Innovative Phishing Style
tehaurum.wordpress.com
tehaurum.wordpress.com
This is a fairly common trick, you just run the debugger method in a setTimeout loop since it's a no-op if the debugger isn't open. It's a common tactic used by quasi-illicit sport streaming websites that are usually filled with ads.
There's a button in Chrome Dev Tools to disable breaking on breakpoints that gets round this.
https://github.com/nneonneo/steam-phishing-analysis
It's fairly simple code, in the end. The phishers copied the legitimate trading site, as well as the Steam Community login page, and then added some JavaScript code to both as well as tweaking the HTML a bit. In total, three snippets of JS were added: the first detects debuggers using https://github.com/sindresorhus/devtools-detect (the bit that the original blog poster found), the second pops open the fake browser chrome and sticks the fake login page inside an iframe, and the third (running in the iframe) harvests credentials off the copied Steam login page.
AFAIK that tool includes a very similar anti-debugging technique.
[1] https://github.com/javascript-obfuscator/javascript-obfuscat...
The output looks a little like the output from your link, but there's a lot of structural differences so I'm not sure it was the same tool.
Some example domains: skinssoul[.]com, skinsnecro[.]com, dotaskins[.]eu etc...
On a slightly off-topic, I think it's safe to say that trading and farming items in popular games, is responsible for cheaters, unfair practices, and in turn developers churning out more of these.
I hope we can return to games, where I pay for a title for its entertainment value, bar of all loopholes and caveats.
I hardly ever login to steam as it's always running and while I have 2FA my password would have been stolen in this attack for sure.
I don't think teenagers and non-techy users would stand a chance against this.
edit: Image in question: https://i.imgur.com/hVTEKfD.png
You used to just have to be moderately tech savvy to avoid scams but I find myself tricked more and more often these days. Recently it was a “click to start download” ad. I sent the page to my friends and they got fooled too.
One should think that malware authors would have already implemented some JS library of sorts for their fake popups that fakes Windows, MacOS and Linux UI styles more convincingly.
Especially since they've applied serious thoughts to other parts of the fake, like the language chooser in the fake Steam popup. It causes a spinner for a short while and then an error popup saying something like "cannot communicate with Steam server". Nice idea to dead-end page components that they didn't want to fake more convincingly.
I would not be surprised if 99% of the audience for this website is using Windows, the vast majority with default themes (and the ones without either won't notice this or think Windows is buggy when a popup shows the default theme).
What? Valve games tend to have pretty good Linux support.
Furthermore modern Windows styling and even Chromes tab strip has been reimplemented in HTML/CSS/JS due to people theming Election apps.
I wouldn't be surprised if this site just cobbled together those existing libraries.
You're not resigned enough to be on an infosec team, and if you're not on an infosec team you probably don't know the true percentage of how many employees are failing over and over (it's a ton, it's always a ton).
I'd go big :)
I mean, other than the attempts to foster a relationship between bank staff and the tech people through things like days of letting tech people hang out and try and be helpful at branches in order to "see what real difference they could make" - and that laegely ending up being a fairly regular educational exercise for everyone involved theres two problems I see:
1. All the phone calls into branches are monitored (you may have noticed so many "we will record this call and it may be monitored" messages - they arent kidding) and if certain key words, or even key tones of voice are picked up someone from a relevant team silently dials onto the call to listen in. 2. The general process for anyone not in it interacting with any IT system is to click a button on their screen which generates a 6 digit pin and if you cant match that pin with the person talking to you and dont confirm success then alerts go out immediately.
And given the hit rate on the "generate pin" api, tellers are definitely using it properly.
So i'd be inclined to go pretty small if I where to bet at all.
Not sure why the assumption that you can social engineer your way onto any half way competent institution still persists,but nowadays, as far as I know, you have to pick the really low hanging fruit for someone to let you in so easily.
At which attackers shift their targets from a bank to a mobile phone provider... :(
tbh, i'm surprised they don't have bank accounts emptied out regularly, but they're sort of small(limited to grocery store employees), so maybe its just nobody has seen it.
That part has always made me curious when talking about these tests, I mean I have a mostly fool proof way (type the url or navigate to it from the main page), but even including "this page is not linked from anywhere else for security, you must click the link) would probably fool people. Especially because I can imagine many orgs would actually include that.
I've never come across a situation where anyone would give their CC number for a free service. That gives a really shady impression.
Or expose myself to that risk.
Wouldn't ever sign up for any of the others though.
And when a free trial requires a cc that kind of implies that you have to read the fine print very carefully and actively cancel before you get "upgraded".
Doesn't exactly inspire trustworthiness, I'd research competitors closely before considering a company that does that.
1. You are actively funding thieves. This is wrong on so many levels it is bizarre.
2. All subscriptions need to be redone.
3. Even in a perfect world it is quite the hassle. And that is not taking into account the added problems if this were to be happening while you were on vacation.
Even risking only one of those is a complete dealbreaker.
In the end we have a deeply unethical and immoral system for the benefit of banks and to the cost of society. I don't subscribe to that.
There is no reason to be careless with your cc even if there is little risk to you personally. Subscribing to a free service that requires a cc is definitely being careless.
Although some are in it for the long game, my GF's son was scammed by a "friend" on Fortnite who spent at least two weeks befriending the guy.
It would also help if Windows had proper contrast between the title bars of active and inactive windows, since then it would be obvious there's a problem from the two simultaneously active top-level windows. The contrast was excellent from at least Windows 3.1 through to Windows XP (colour vs greyscale) but in Windows 7 it dropped dramatically, and it's almost indistinguishable in Windows 10. Microsoft seems to have an endemic problem of redesigning visual styles for the sake of it, even if it makes things worse, presumably to justify the wages of full-time designer staff.
http://kb.mozillazine.org/Browser.link.open_newwindow.restri...
It's incredibly well done, and I was almost fooled by it when I went to the web site. If I hadn't been using Qubes OS where my dispvm's are using red borders, I probably wouldn't have noticed at all.
But that's exactly my point! If you have set your browser to make all popups appear as a tab taking up the whole of your existing window (and adding an entry to your tab list), and then a fake one looks like a separate window, then it will stick out as fake immediately. For me, a browser-like window within the boundary of my actual browser is so foreign that I wouldn't even consider the possibility that it's real.
Currently I'm on a tiling manager, and the "window decoration" is a three-pixel thick blue line, which even if you draw it in the middle of a web page is still wrong, because your supposed new window didn't tile correctly.
On those rare occasions where someone gets through the various NoScript-type protections I tend to run, it's amusing to see a Windows screen pop up. Yes, sir, I'll get right on running Windows Update on my Ubuntu system. (Do I have to install Wine for that, or...?) I've also seen some Windows-styled screens pop up on my Android browser on occasion... yeah... not terribly convincing there guys.
combatting this doesn't require browsers - you can have a passwordless login mechanism (like email links!).
Or, if browsers do indeed want to combat issues such as these, we'd need support for client-side certs (so you can login using a key-pair!), rather than username/password.
Or, rely in a tool like lastpass to consistently enter the credentials (which, presumably, will check the domain first and if it doesn't match, won't let you put the credentials in).
In this case it looks like the 3rd party service required deep integration with Steam so it was probably unavoidable, but many sites use OAuth as a crutch because they don’t want to bother butlding their own sign-in system.
I’ve stopped using services if they don’t provide an option to create a site-specific username and password. Facebook login the only way to sign up for your site? How about no.
I don't recall ever seeing a version that opens a popup to get you to login. This would immediately raise my suspicions on this basis (popup windows can be controlled by the opening website to a large degree!).
There was a time when popups were considered malicious by nearly everyone (my mother would have seen this as suspicious during that time).
Thanks to popup blockers this feeling seems to be fading, and I see no reason whastoever to not cultivate it again.:
"Unless you are already logged in to a website you trust, any popup means that this website cannot be trusted. Contact someone you trust to check it if you really really need to use that site."
Pop-up blockers don't work when the user clicks "login".
It's not suspicious at all and I would say best practice. In any case, you always need to make sure the domain is trusted. That's a lot easier if your browser puts all windows in tabs.
I don't recall ever seeing a version that
opens a popup to get you to login.
[1] https://developer.paypal.com/docs/classic/adaptive-payments/...
> Important: Adaptive Payments is now a limited release product. It is restricted to select partners for approved use cases and should not be used for new integrations without guidance from PayPal.
In other words, popup loading another website is just wrong and should be avoided by both website makers and their users.
Anyway, this is where desktop uniformity hurts. Using i3wm it would be obvious to me what's happening, since window decorations would be different and new browser windows open in a stack, and not on top of other windows.
This reminds me the "Phishing Alert Toolbars" section from Ross Anderson's "Security Engineering" book on what he calls a "picture-in-picture website" [0]