Hacker News Reader

Comment by zulln | Hacker News Reader

> Clicking a hyperlink is certainly bad.

HN must be a boring place if you are not prepared to click on external links.

There’s a fundamental difference between HN links and links in targeted emails. I cannot start phishing GitLab employees using HN posts, the threat model is just different.

I’m not so sure about that. With enough dedication and time I think you could target a specific company from HN. Start writing a few good blog posts that would appeal to your audience, only run attack when some attribute is true to that company (i.e. their Corp IP addresses).

You could even combine the two. Post the blog to hacker news, then send phishing email pointing to HN post. That is a trusted link. Then the user will likely click the source link in HN.

Obviously, a lot harder and lower chance of success, but not impossible.

> [...] only run attack when some attribute is true to that company (i.e. their Corp IP addresses). [...] Obviously, a lot harder and lower chance of success, but not impossible.

In general maybe, in this particular case it's gonna be challenging however, as gitlab is a remote company so most employees will logon from residential ips

I would imagine they would be using some sort of company vpn to access the files they need to use.

Most companies I’ve encountered have moved towards split-tunneled VPNs so an employee clicking on a phish page would traverse the employees gateway, not corporates.

My experience is the opposite: Part of the justification for moving away from standards-based VPNs is to prevent split-tunneling.

My present employer's VPN client goes a step further and mangles the routing table to deny access to my own LAN while connected.

interesting, i heard that some employers did set the default route to go through their vpn, havent had that experience myself either though.

it was always only the 10.0.0.0/8 and some /24 ranges from 192.168.0.0/16 at my current job

liberty mutual, the largest insurance provider, is in the process of moving from default route on the vpn to no vpn at all and zero trust networks for their apps.

I can’t decide if I hate that more or less than what I’ve seen: client-side blocking of DNS resolution and driving all queries through Cisco Umbrella or friends.

I guess they both suck pretty hard.

It's not impossible to determine which of your visitors has login cookies to other sites, such as internal.gitlab.com, and provide different content to them.

Or just buy ads with suitable targeting.

cannot start phishing GitLab employees using HN posts

You definitely could perform a watering hole attack if you compromised a site that always gets on the front page of HN. If I were an evil hacker and I wanted to compromise HN I would instead attack a site like rachelbythebay.com or some other popular blogger then just wait for HN’ers to click the link.

Go for medium.com

Just make a post about rust. Everyone clicks on them. Everyone.

(Myself included)

Reflections on trusting rust.

http://manishearth.github.io/blog/2016/12/02/reflections-on-...

Not a phishing attempt, I swear!

Especially if it has a controversial title,

"Why rust is not a real programming language"

"It's a complete waste of time to learn C++ in 2020"

"Rust is 2x as fast as C++"

Emotion - the perfect bait.

“Rust is a complete waste of time”

And then just point to an article about Rust the game.

Jokes aside, I love the name, the pun is nice, but man it makes searching a pain. I’ve ended up too many times in pages related to the game or to actual rust (as in iron).

The point is to recognise the email/situation as phishing or otherwise malicious before deciding to click the link. The chance of clicking a malicious link on HN is pretty low if you stick to the front page.

Ok, so you close a tiny window, while leaving the entire web open as a giant door by its side.

And you do by a really invasive means that will make sure that everybody that knows what they are doing but are curious to safely inspect it further will be marked as clueless. Leading to false positive and negative errors larger than the signal, but you still expect to get useful data from it.

Usually I mouseover and see where the link would take me. If it's something like micr0soft.co, it raises some red flags. For something like a targeted phishing email, it's even more reasonable to be concerned about things like browser 0 days

Eh; I'm 95% here for the comments.

Emails and HN are different.

Then someone will point out watering hole attacks, where adversaries find where targets hang out socially, and attack that.

And then I'll point out that the inherent risk in HN links vs. unfamiliar emails are very different.

Some people never do ;)

Reply on news.ycombinator.com