Hacker News Reader

Comment by DangerousPie | Hacker News Reader

I don't understand the point of using compromised Cambridge accounts for this. All they wanted people to do was to just click on a link. They could have easily registered some legitimate sounding domain name and linked to that instead. It wouldn't be unusual at all for an academic organisation to have a separate site.

View on HN

It is a prestigious domain - with a high recognition factor. And, as part of that, it will almost never be blocked by URL / DNS filters.

In this case, it clearly worked. The user saw cam.ac.uk and trusted it.

I wonder if the attackers were also thinking that these users would more likely be using macOS. The exploit they were using only works in Firefox on macOS.

_Any_ other domain, and I'm just going to ignore it. A legitimate *.ac.uk domain, and there's a good chance I will click it to find out what it is, even if I don't believe it. At that point, they've won (it's a 0-day).

Using a recognisable domain lets my guard down just enough ("there's no risk in going to a cam.ac.uk domain") for an attack like this to work.

A compromised Cambridge url gives a lot of credence to their claim though, especially with the paranoid coinbase developer they were targeting.

It also means the e-mail is significantly more likely to make it past a spam filter, even an aggressive one. There was very little in that e-mail any reasonable spam filter could possibly have flagged, unless they're going to start doing API calls to grammarly. But if they check spelling and grammar, filters will start flagging a lot more than spam.

.ac.uk emails get spam filtered pretty harshly.

really? why?

Not sure but some guesses:

Traditionally students got a lot of leeway with running their own stuff maybe there have been a few doing not-good-things?

Lots of academics who don't take security seriously have had more admin access to live servers than they should and then stuff like the article happens?

My Alma Mater, The Norwegian University of Technology and Science in Trondheim, Norway had issues with student E-mails being spamhammered all over the world.

Why? All student accounts were hosted under stud.ntnu.no; presumably authors of spam filters made other associations when they saw the string 'stud' than it being short for 'student'.

Cough. Their practice of automagically generating user names based on parts of your first and last name in my time led to two users having (for a short time!) the addresses hung@stud.ntnu.no and pervo@stud.ntnu.no.

Their practice of automagically generating user names based on parts of your first and last name in my time led to two users having (for a short time!) the addresses hung@stud.ntnu.no and pervo@stud.ntnu.no.

Brenda Utthead feels their pain.

It's the cyber-version of speaking with a British accent.

Reply on news.ycombinator.com