Hacker News Reader

Comment by scotchmi_st | Hacker News Reader

This is a fascinating story. It's funny though how, with compromised accounts at a highly reputable university and a 0-day exploit in one of the most-used pieces of software out there, they still managed to make basic grammatical errors in their phishing email. I mean, these people were clearly not messing around. Their attack(s) were highly targeted. And yet they still didn't check their written english!

If it hasn't already been tried, perhaps it's worth building a spam-blocker which checks for bad grammar and increases the spam score for every mistake found.

View on HN

Besides the possibility that the mistakes were made deliberately, like other comments said, I can totally see how these two mistakes slipped through.

> He was also lucky that I didn’t care that he’d missed a “the” in We need your assistance in evaluating several projects for Adam Smith Prize.

Slavic languages, like Russian, don't have articles. In my experience the proper use of definite and indefinite articles is the most typical error native Slavic language speakers make.

> Apparently I further didn’t care that he’d unnecessarily capitalized the word Organizers in Adam Smith Prize Organizers, or that he didn’t seem to understand that a paragraph can contain more than a single sentence.

German capitalizes all nouns and German and English have plenty of nouns that are close enough that it's hard not get confused. Add to that all the exceptions where you do capitalize words in English, this is a hard problem for Germans.

My armchair linguists bet is that the mail was written by a German with Slavic roots.

I once read a theory that poor grammar, particularly with 419 scams, acts as a sort of gullibility filter where only the most susceptible targets will respond.

In this case though, since the zero day runs without consuming the attacker's time, what is to be gained by filtering out less-gullible people? If it's automated, why not cast as wide a net as possible?

Fear of retribution/consequences?

Danger of discovery, perhaps? Every person who doesn’t end up judging the prize gets suspicious.

I doubt it in this case. It sounds like they had a browser zero-day, and could potentially steal cryptocurrencies from people they were targeting. You don't particularly care how gullible someone is; if you get your zero-day to successfully work on them and steal all their Bitcoin, there's nothing they can do about it.

I think the default assumption is the correct one here; the attacker(s) are a solo or small group of anonymous non-native English speakers, and the risk of getting another person in on it who is a native English speaker wasn't worth it. The smaller your criminal conspiracy, the better.

You may be overestimating the writing ability of native English speakers.

The kind of mistakes a non-native English speaker makes tend to be different than ones an uneducated native speaker does.

I think that lack of an article 'the' is typical of native speakers of Slavic languages?

It is. It took my father ~20 years of working in an English-speaking country to be consistent with his usage of that article.

Slavs aren't the only ones though! Romance languages, while not completely lacking articles like Slavic ones, have slightly different requirements for articles. (They tend to use them more for abstract concepts, eg. "the reality" when we would say "reality", or "the <noun>(s)" for describing general behavior/attributes of that noun -- this difference may make speakers over-correct by using articles less in English)

Certain nouns are "inherently definite" -- names of people or places, for example, or abstractions or things which are inherently unique. Languages which mark definiteness often differ as to whether these inherently definite nouns, or which ones of them, should be marked as such. English generally treats them like proper names -- no article, definite or indefinite. Romance languages more often require the definite article. These are just two different ways of indicating the same underlying category.

Agreed. The best example of this for me is nextdoor. The spelling and grammar for most of the posts are terrible and the posters are predominantly white and over 50.

You're right that most native English speakers don't have anywhere near immaculate grammar. However, the grammar errors that native speakers make are generally quite different from those that non-native speakers make.

If you're going to involve someone specifically for the purpose of writing English, then obviously you'd pick someone who's good at it. It's not a native/non-native distinction so much as it is "good at writing in English" vs not.

Yup, it was a Microsoft Research paper IIRC. That's more applicable to scams that cast a wide net to avoid investing resources on savvier targets in the second, more labor-intensive phase. I don't think it would be too relevant to spear-phishing like this case where the resources are already invested in step 1.

https://www.microsoft.com/en-us/research/publication/why-do-...

Here is the paper

Thank you!

When you're trying to trick people into sending money orders over seas that makes sense but not really when you're trying to get people to click a link that exploits a zero day to install malware.

I read in the past that this was intentional - it's a filter to ensure that people who are inclined to note detail pass up on the offer, meaning they only get the most likely prospects to be ripped off.

That’s likely true for the Nigerian prince scammers, but when they’ve got a browser zero day, they can successfully attack people that aren’t suckers.

True, but we don't know the next stage of their attack. Perhaps after compromising the target's machine the attackers would have to then engage in some social engineering.

They're targetting Coinbase employees and users, the logical next step is just to find the wallet file on the machine and steal the coin.

Once you drop a trojan on someone's machine, why do you need social engineering?

To your initial point, I assume that you're immediately thinking of a sloppy-writing person who's first language is English, as opposed to a hacker who learnt English as a second language. With the latter, it wouldn't be surprising that they spent less time learning a foreign language than learning about the technology that they're trying to attack

Can any of you recommend a way to create a sandbox that can seal off processes within a computer?

One option is to use a VPC on a cloud-hosted machine to access whatever emails, links, websites someone sends you, but this can be time-consuming and costs money.

This article claims that Docker would also not be a good solution:

https://security.stackexchange.com/questions/107850/docker-a...

"...container solutions do not and never will do guarantee to provide complete isolation, use virtualization instead if you require this."

So is there any other way to create a sealed off sandbox on your own machine that would create a type of moat between your machine and your adversary?

That's what Java applets were supposed to be originally, they were supposed to run in a sandbox....

Not all sandboxes are created equal. Modern browsers have much better sandboxes than Java ever has had. OS level virtualization is even better.

If you read something like this [1], dated 1999, it seems like they had the right ideas. I guess it went wrong in the actual implementations.

[1] http://www.securingjava.com/chapter-two/chapter-two-2.html

By total coincidence, I was reading about Java sandbox exploits just a few days ago: http://phrack.org/papers/escaping_the_java_sandbox.html.

It feels to me (not a security guy!) like there was something fundamentally too complex here. I wonder if part of the problem is that unlike the browser, there's no natural boundary. JavaScript is was originally built to live in a small self-contained world with specific access to the outside. Java was built with features for writing applications that could touch the filesystem, redefine classes, and everything else. It was also supposed to make everything safe, but that led to complex checks everywhere to try to distinguish privileged from unprivileged code.

If you are interested you should check out Qubes OS: https://www.qubes-os.org/

It uses xen hypervisor to then launch separate VMs for your different applications. Not an OS for everyone but I have been running it for some time and have had a good experience with it.

I believe this is the idea behind Qubes OS. Any virtualization system (virtualbox or whatnot) should give you some protection, at the cost of some convenience.

Running with javascript disabled except on a small set of sites will also help protect against many attacks.

I had written a jail for Windows a long long time ago - it was inspired by Unix's jail.

For an app you could configure what filesystem and registry access was allowed and you could redirect FS access.

Implemented it as a kernel driver that hooked into the relevant system calls. It was easier to do kernel dev back then (we are talking mid 2000's) - i havent touched windows kernel coding in years.

I wonder if Microsoft has implemented a jail for processes in recent versions of windows. Running browsers in a VM can be cumbersome.

Agreed about VMs in everyday use, and I'm wondering if the new Windows 10 Pro/Enterprise sandboxes would be a sufficiently safe alternative in these scenarios. After skimming this white paper it seems like they would, but I'm no expert in this area:

https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...

On Linux-based systems, Firejail [1] is designed specifically for that (originally for Firefox?). However, it's had quite a few CVEs of its own, and I don't know how effective it is in practice protecting against 0-day-type problems.

Dropping 'the' is a common error for Russians writing English. It's part of how the 2016 election meddling was blamed on the Russians.

Reply on news.ycombinator.com