Hacker News Reader

Comment by everdrive | Hacker News Reader

This is called a "ClickFix" attack. There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.

The attack is basically getting someone to accidentally run malicious code.

- ctrl + R brings up the Windows "run" dialogue.

- the code executes a powershell command that reaches out to a remote server

- if successful, the remote server answers and you have installed a dropper or something.

Really, you should never do _anything_ like this for any website. You don't need to protect yourself. This is sort of equivalent (in the strict metaphorical sense) of getting a call from your bank and they ask you for your banking password: you just never do it, no matter what. Same thing here. You don't ever execute code via the run dialogue to solve a CAPTHCA. Never.

https://www.sentinelone.com/blog/how-clickfix-is-weaponizing...

View on HN

> There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.

I think the concern is the user not knowing they're executing code on their machine.

And as a counterexample: some captchas require you to compute something expensive to prove you're not a llm scraper or whatever. It's normal for captchas to require you to execute code on your machine, it's just usually done within the browser's sandbox.

And anyway, these things are completely incomprehensible to non-technical users.

>And as a counterexample: some captchas require you to compute something expensive to prove you're not a llm scraper or whatever.

I've never run into one of these. What do they ask you to compute?

For example: https://anubis.techaro.lol/

Wikipedia has a good explanation: https://en.wikipedia.org/wiki/Anubis_(software)#Design

If one user makes the mistake, it would be fair to blame them.

Because thousands of users make the same mistake, blame needs to be directed at Windows UX.

MS could fix this easily by 1) moving Run to optional features and 2) removing online features from Start to make performance comparable.

The other "run" interfaces (terminal, conhost, Powershell) are sufficiently menacing to scare away non-devs already.

but people pipes a shell script from a URL to bash all the time. with enough practices, it becames second nature.

True enough... but even then, you can download and review the script before running. Usually it just detects your OS/Distro and then downloads and runs the appropriate installer. You can also do this by hand.

For that matter, there's always a risk of downloading/installing anything from anywhere. There have been successful compromises of many application supply chains at this point in official release paths. You will accept some risk regardless of your approach.

I don't think so, the risk level is different. Pipe an unreviewed bash script from a URL is red flag, downloading an app from Apple App Store is safer. There are many other examples, I just want to tell: the risky level is not the same, each person has different take.

$dayjob just sent out a corporate wide email saying the same thing... I guess it's starting to go around... it's been a while since I've seen a fake website telling people to eg. disable UAC.

I make it a rule never to give confidential information to an incoming call. I had a primary doctor whose office would send notification calls immediately asking for part of my social security number, I always hung up.... I figured out it was for the doctor later, and commented that it was ridiculous and I wouldn't ever receive any such notifications.

Just that simple practice has kept me reasonably safe, even from an AI scam once.

I've seen sites with similar fake captchas posted twice in the last month by old time regular users. My guess is that the sites were infected after they saw and decide to post it here.

As a workaround, is it possible to disable Ctr+R to add some friction in case I am distracted?

> There is really _never_ a time when a CAPTCHA will require you to execute code on your machine.

Oh yeah? What about Google saying “install the reCAPTCHA app in the App Store” <https://reclaimthenet.org/google-broke-recaptcha-for-de-goog...>?

It’s absurd, but these nominally-security tools frequently genuinely train users to become susceptible to attacks.

Reply on news.ycombinator.com