Hacker News Reader

Comment by IYasha | Hacker News Reader

I still don't quite understand hackers: doing such high-profile hacking and writing lame texts even wihout much fact checking (about agency divisions in this case). Being written in more professional way, this attack could be way more effective. Also, is it a thing among "hackers" to write with tons of mistakes? A part of culture maybe? Or to scare the bricks out of people? )

View on HN

According to the phishing training I was mandated to take at work if you are stupid enough to overlook the mistakes you are the right target. According to them the misspellings filter out the smart enough people they don’t want talking to. But that could also be nonsense.

Ignoring this specific case where it seems especially unlikely, that's always seemed like someone worked backwards and overthought it to me, "the spelling mistakes, they have to mean something".

I don't think there is a binary smart population and dumb population to optimise around, for every step down, some people who are otherwise convinced become hesitant and waste time, and some of that group become totally unconvinced.

In this podcast episode with the founder of conversational AI, he describes the need to make spelling mistakes (and correct them) in order to help establish that the bot is actually a human.

https://podcasts.apple.com/us/podcast/the-python-podcast-ini...

I think making sublte spelling mistakes is a much clearer sign that someone is human. The imperfection without correction makes it more believable. I still think the hackers could stand to take a creative writing workshop.

The argument is that the hacker’s operational costs are massively dominated by the manual work of social engineering, so they have a huge incentive to filter out people who are less responsive to social engineering.

If you accept that some people are more credulous than others, it becomes the best strategy to optimize for only talking to people who believe you.

Yeah, I buy this theory in general, but I'm not sure that's the highest-leverage way to use this access.

I think higher level ways get dangerous. Contacting the FBI directly to try and get money might make it easier to find you. Trying to sell it or other information to a foreign entity is also risky because you can't be sure they won't turn you over.

Spelling errors like that are how real people write in enterprise, imagine Trump writing email

I’ve worked in government and contracted for Fortune 500 companies. Never have I seen an email that was written like Trump’s Tweets. I’m sure it happens, but I don’t think it’s common.

Or the purpose is to make the FBI look publicly incompetent, not to successfully carry out a secret operation.

For the lulz, I would be happy to see that culture come back, well somewhat

I'm guessing they are either testing their approach or doing it just for fun without a real objective.

>Also, is it a thing among "hackers" to write with tons of mistakes?

Most phishing content isn't made by native English speakers. A lot of it has incorrect grammar/spelling or was just generated by Google Translate.

I'd have guessed that it should be possible to get a reasonable amount of $ for selling access to FBI email servers but maybe the person(s) behind the attack don't care much about money.

Along with the weeding described by others, this could also be a public proof of concept, with a much more sophisticated back-door left for whenever the clean up is done.

I wonder if, similar to automatically choosing alternate synonyms, small spelling errors throw off naive spam detectors while remaining perfectly readable?

The email text to me looks like it was written by some 15-year-old zoomer kid with no clue what they’re really doing.

Reply on news.ycombinator.com