Linus Tech Tips – My Channel Was Deleted Last Night(youtube.com)
youtube.com
Linus Tech Tips – My Channel Was Deleted Last Night
https://www.youtube.com/watch?v=yGXaAWbzl5A
9 comments
TLDW: employee opens infected PDF from legit-looking email; session token stolen
How is this possible? Can someone point me in the direction of what mechanism is used here.
If I open a pdf in chrome for example am I opening myself up to this kind of attack?
If I open a pdf in chrome for example am I opening myself up to this kind of attack?
I would say first thing is to disable Windows Explorer from hiding the extension of files.
From what I understand, it was an executable inside a zip attachment to an email disguising itself as a partnership proposal from a reputable source.
The file inside the zip probably had a .pdf.exe extension. By default, Windows Explorer would show it as a .pdf, making it easy to run by mistake.
From what I understand, it was an executable inside a zip attachment to an email disguising itself as a partnership proposal from a reputable source.
The file inside the zip probably had a .pdf.exe extension. By default, Windows Explorer would show it as a .pdf, making it easy to run by mistake.
Wait it wasn't an executable pdf that escaped the sandbox, it was a *.pdf.exe?? Why does Windows even still have this vulnerability?
That should be stopped by the smartscreen prompt which is pretty hard to bypass by accident.
[deleted]
PDF can run JavaScript
Couple of questions here on the virus side:
We do enable Impossible Travel in Okta by default for our clients.
Is there a link to the sample on VirusTotal?
Why didn't their email-service's anti-virus pick up on virus?
In the case that it was in a zip, why didn't said anti-virus extract the zip & scan?
In the case of a password-protected zip, why didn't the computer scan the file upon extraction?
In the case of a scan upon extraction, why was it missed? Outdated definitions or zero day?
We do enable Impossible Travel in Okta by default for our clients.
You'd think browsers would come up with a way to invalidate cookies and the like when data doesn't match the system.
Any part of the system can be spoofed; virtual machines exist. In addition, once you have a session token, you don't even need to involve a browser, you can just make requests to the server directly.
From the perspective of a browser, it seems like a better mitigation would be to make it harder to steal these tokens in the first place. Cookies have to be persisted to disk in order to survive browser restarts, but maybe some cookies could be identified as password-equivalents and get stored in the system's keyring.
And of course, from the perspective of a server, they could probably be more credulous when they see a session token trying to make account management actions from a new IP.
From the perspective of a browser, it seems like a better mitigation would be to make it harder to steal these tokens in the first place. Cookies have to be persisted to disk in order to survive browser restarts, but maybe some cookies could be identified as password-equivalents and get stored in the system's keyring.
And of course, from the perspective of a server, they could probably be more credulous when they see a session token trying to make account management actions from a new IP.
I wonder if there could be a new secure cookie/session token standard that makes use of hardware security keys like TPM/Secure Enclave to prevent them from being exfiltrated. They could be domain scoped for access like Passkeys are. Maybe DNSSEC could prevent MITM attacks of it as well.
Is there some kind of a sandboxed pdf viewer, that could prevent infected pdf access to the rest of the computer?
From what he describes, the file disguised itself a PDF but may have been an executable instead, so the PDF viewer was probably never launched.
I blame Windows hiding the extension of known files by default.
`anything.pdf.exe` would show as `anything.pdf`
Can't blame people from thinking it's a PDF.
Otherwise, I use SumatraPDF as a viewer. Small, no frills, probably less of a vulnerability target than Adobe Acrobat.
I blame Windows hiding the extension of known files by default.
`anything.pdf.exe` would show as `anything.pdf`
Can't blame people from thinking it's a PDF.
Otherwise, I use SumatraPDF as a viewer. Small, no frills, probably less of a vulnerability target than Adobe Acrobat.
Still, they should've gotten warning prompts for running an untrusted exe when they opened it, wouldn't they? I mean I know people are pretty well conditioned to ignore those, especially gamer geeks who are used to using dubious tools.
I believe the name the program reports for those prompt can be different than the actual filename, allowing an attacker to use the name of adobe reader or some other popular PDF reader instead. If the malicious script launches the actual PDF reader with a legitimate-looking PDF after executing its payload it could be hard to detect
IMHO Pretty great of dbrand to step in and sponsor a topically sensitive video on short notice as well as provide a pretty big carrot to bring in a flood of traffic. Just ordered a matte black skin for my MBP 14". I have no relation to dbrand other than being an occasional customer.
blippies(1)
blippies(1)
Thanks, bitcoin.