8 ms·

On Getting Hacked

85 points by ahmetomer 9mo ago

makach 8mo ago
It is an humbling experience the moment when you accept that getting hacked is something that can happen to anyone, including the best of us. No one is too good not to be hacked.
- resonious 8mo ago
  I work in payments and yet I once gave my card (and 3DS auth!) to a phisher. Thankfully I realized what had happened pretty quickly and immediately deactivated the card. But the fact that I went through the whole process before realizing was pretty harrowing. For all I know, that might not have been the first time.
  - calgoo 8mo ago
    All it takes is an "off day" or being stressed etc. and our guard is down.
mc3301 8mo ago
What was the Chrome extension?
- ahmetomer 8mo ago
  Unfortunately, I haven't been able to pinpoint which one it was. It certainly was a dark reader extension, that I can tell.
akersten 8mo ago
> open their password manager which also might need you to authenticate, type in their master password, search for the name of the said website, copy the password, paste it in This is one way to guarantee you'll eventually fall for a phishing attack. Are we really running URL-unaware password managers in the year 2026?
- buckle8017 8mo ago
  Lots of people are afraid of attacks on the browser extension. There have been exploits for them in the past, it's a legitimate concern. Deciding between the two setups is a tradeoff between one security issue and another.
  - akimbostrawman 8mo ago
    >afraid of attacks on the browser extension Which is a legitimate concern since they are a gaping hole in security and isolation. Visiting website should be treated like phone calls from the bank. If you get called/mailed you don't follow the information there but call back / visit the site yourself e.g. from bookmarks or copy url from pw manager.
  - asimovDev 8mo ago
    I am now wondering if Safari's integration with the system-wide password manager is similar to having a 1Password browser extension installed in a chromium browser
    - buckle8017 8mo ago
      It's probably slightly more secure than the extension. Legitimately the only reason to us the built in password managers is this tradeoff.
- Y-bar 8mo ago
  It’s also an issue that extensions like 1Password are _too_ URL-aware, until recently it tried to use heuristics and ignore subdomains for matching credentials. This meant that we used to get a list of almost a hundred options when logging into our AWS infrastructure. No matter which actual domain used. Someone could have used this vulnerability as part of a phishing campaign.
  - pjerem 8mo ago
    Haha and Bitwarden is url aware but not enough. I work in a company where I have two okta accounts (because hey, why not) on two .okta.com subdomains. Bitwarden _randomly_ messes up the two subdomains and most of the times (but not always, which seems strange actually), it fills the form with the wrong password. I don’t know why. I know that there is an option to make it stricter on domain matching but you can’t configure it on per item basis, only for the whole vault.
morgan814 8mo ago
Not all too long ago I had someone port out my VOIP number. They had it for a few hours. This was after I had spent extensive effort attempting to secure my digital life. VOIP was SIM-swap resistant sure, but I totally missed that port out requests default to failing open. Thankfully the VOIP operator alerted me and pulled the number back. Then I set a port out code. Who knows how many other holes I have. I lost my sense of smugness that day.
- sneak 8mo ago
  Using SMS 2FA has been explicitly deprecated for years. It’s insecure for this and a million other reasons. TOTP is also trivially phishable. I still have my sense of smugness because I use SOTA 2fa.
  - embedding-shape 8mo ago
    I wish banks would get this memo. Not only is one of my banks enforcing a maximum password length of 6 NUMBERS (no letters/special characters allowed), but also that high-value transfers are only confirmed via SMS 2FA, even though their own banking app also have a separate 2FA thing that doesn't go through SMS, but it's only used for "low-value" actions...
    - ahmetomer 8mo ago
      This. My Turkish bank (Garanti BBVA) only works with SMS codes for new logins & payment confirmations, and the app password is 6 digits only, which it also wants (forces) you to change it every now and then because apparently that's a good security measure.
    - pards 8mo ago
      Name and shame Tangerine (formally ING Direct) in Canada only has 6-digit PINs and SMS 2FA TD Canada Trust only supports SMS 2FA PC Financial only supports SMS 2FA
  - Thorrez 8mo ago
    TOTP is not SOTA 2FA. WebAuthn is SOTA 2FA. TOTP can be phished. WebAuthn cannot.
JosephusAMiller 8mo ago
In the moment, it doesn't feel off, that's the most disconcerting aspect. It's the things that don't seem so critical or important that get you as well. Registration on a random site, and for a temporary reason was what got me once. In this case the browser extension seemed almost like an afterthought at the time for the author.
pamcake 8mo ago
Had a close call: Apparently it's possible to bypass 2FA and do a password reset of a Google account without email access, if the account owner doesn't abort it within 30 days. I confirmed that it works by "pwning myself" afterwards. So keep an eye on your old Gmail inbox if it matters.
- rand89 8mo ago
  what how does this work
- throwa356262 8mo ago
  Never heard of this before, and I think the mail Google sends you specifically says it is safe to ignore it if it didn't come from you. Has this recently changed?
- omnifischer 8mo ago
  Apparently? i.e -> fake news.
  - pamcake 8mo ago
    No. First-hand account.
3abiton 8mo ago
> At this point, I am the old lady who is driving to a Target to buy gift cards and give them to Jared, who is the Amazon Customer Support specialist with a suspiciously heavy Indian accent, waiting on the phone. It happens to all of us. I always tend to make sure any extension has the sources available (unless requested by work/client), but nowadays with open source supply chain attack, it's just another breakable wall. Even on linux, some long time ago, I caught a trojan (luckily to the extent of my knowledge, it didn't affect anything besides running a crypto mining on my m3 laptop)., disguised as systemd, that was spreading through kodi extensions.
- cwel 8mo ago
  Running Asahi? or otherwise, How did a trojan slip through disguised as an init system which does not exist on darwin. (this is all assuming by "my m3 laptop" you are referring to apple silicon.. so i could be way off base)
  - 3abiton 8mo ago
    I see the confusion. My fault. Before the Mac M3, intel briefly used to have the intel core m3 cpu lineup. Fanless, and very energy efficient for the time (~2017).
    - cwel 8mo ago
      Ah, yeah I should have figured when you referred to the event happening a long time ago that it wasn't the Applearm. nonetheless, i agree with the sentiment.. browser extension ecosystem is rife with questionablesoft
SeanAnderson 8mo ago
I got hacked late last year. It sucked. Do not recommend. I'm not going to blog about it, but will at least share how I messed up. Maybe it'll help someone else. I was phished through Discord. A CEO that I was friends with was phished prior to me and I let my guard down when someone I put on a pedestal reached out to me. The hacker asked me to review a video game prototype they'd been tinkering with in their spare time (the CEO worked in the video game industry) and they came to me because they knew I'd give them "honest feedback." The game's website looked legit enough with AI generated screenshots and boilerplate text. They also messaged me right around dinner. I had like ten minutes of downtime when the message came in and I immediately shifted to, "Yeah I can bang this request out real quick for a person important to me before dinner arrives." rather than keeping my guard up. Additionally, I have (or had) two Google accounts. My primary email address is much older and wasn't very business-professional. Over 15 years ago I created a secondary email, that was just my name at gmail, configured it to forward all emails to my first account, and then never logged in to that account again. Naturally, that meant that my primary account had 2FA, but my secondary account did not. I signed up for Discord using my secondary Google account. So, when I got phished, the hacker assumed that was my primary account and compromised it first. The way they compromised the account was very quick and efficient. They immediately set parental controls on the account, listed an email address they controlled as the parent, and then changed the accounts age to under 13. Those actions 100% lock an account because all account recovery options must be approved by the parent for children under 13. Surprisingly, I did get a security notification saying that a suspicion session had been started on my primary email account even through 2FA. I (thankfully) managed to kick the hacker out before they were able to do the same to me. I'm not sure how they got access to the second account. Laughably, the hacker tried to extort me for only $400 and, when they didn't get it, they pivoted to sending threatening texts then moved on to trying to phish others for quick cash. Thankfully, I didn't lose much. I lost access to my Discord account and to my Google account, but all my Google data was replicated. I lost a full nights sleep resetting all my passwords everywhere. And I still feel a bit violated and think I always will. It was really interesting being motivated to interface with the security processes of several hundred companies. Shout out to Kraken and Etsy for having the best security procedures. Anyway. Just wanted to highlight a scenario which happened. I'm in engineering leadership. I've worked on a computer every day for over 20 years. I use KeePass to store my passwords and generally have fine security hygiene. I do my KnowBe4 training modules, lol.
keysersoze33 8mo ago
Sadly the blogpost fails to mention which browser extension was the macilious one that compromised his session tokens. While quite technical users (a la. this community and devs in general) would be able to inspect the source code of browser extensions to do an audit, most of us don't have time for this, and we just have to rely on the browser add-on number of downloads & reviews as a poor indicator. It would be really useful to know how this particular extension was rated
- omnifischer 8mo ago
  Totally. This would have been vital.
- ahmetomer 8mo ago
  Hi, OP here: Unfortunately, with a brisk urge to clean it all up, I hadn't paid attention to which extension it was that got my browser compromised; I had immediately removed all extensions, cleared browser data, stopped the sync, and uninstalled it altogether (for fear of getting further compromised). What I can say is that I have tried a number of extensions for the purpose of making a website in dark theme, for ease of reading, which weren't as popular (in terms of rating & installs), and highly likely that those were malware. That being said, I now hesitate to even install extensions that are selected by the Google Chrome editor team. I vibe-coded a simple extension myself to use as a "dark reader", and will probably avoid installing anything anymore. I got my fair share of damage.
  - wt__ 8mo ago
    Firstly, I really liked the way you wrote your blog post. FWIW, I experimented with dark theme extensions (paid and free) and gave up on them after a while: it just all felt a bit too clunky and unreliable, the flashes of unstyled pages were annoying too. I've now standardised (this is in Firefox) on a combination of: - Reader mode - a very simple extension that allows per-domain custom CSS… - …and another that lets you disable Javascript completely per site (which adds a bit of security, generally improves the experience, including the side effect of removing cookie popups.)
close04 8mo ago
> but on a universal level, we're missing a cohesive master plan, in which a user, a human, need not undertake endless and repeated manual fend-off of the devil This is a very good way of stating the problem in terms anyone can relate to. > I had one brow raised, a little suspicious, but not very much to initiate a full-scale defense This on the other hand seems overly superficial. You get your eMarketplace account hacked, then your Twitter account, and you're just "a little suspicious"? My eyebrows would raise all the way to the back of my head after this. Not sure I'd know where to start but I'd be very concerned. > A few days later, the same thing happened with my TikTok and Reddit accounts. I repeated the previous steps now that I had gotten used to them. This time I raised two of my brows with a little more suspicion. Still not quite there, though. I mean... This is an incredibly high threshold for getting concerned. The kind that lowers the bar to getting hacked.
- ahmetomer 8mo ago
  Totally on point. I should've taken it more seriously in the first incident. That way, I could've kept my TikTok and X accounts. But the damage is done, and it has been a good lesson to me. Hopefully my post could be as much of a "lesson" to those reading, without getting compromised as I was.
barbs 8mo ago
Anyone else seeing the blog post briefly before flicking to a 404 page? Safari on iOS 15 here.
Havoc 8mo ago
Hmm. Maybe I need to install a second browser for sensitive stuff. Or maybe stick that in a vm somehow
4ggr0 8mo ago
my younger brother called me once, which was unusual, so i immediately answered. he was crying, which was new to me as well, and told me that our mom's laptop he had been using to game on was hacked, and that he was now being extorted live in a discord call. asked him to shutdown the laptop immediately and add me to the call, to which he replied, "they sent me our postal code and told me if i told anyone or turned the laptop off, they're going to send someone to hurt me." that's when i realized why he was panicking so much, to me who was 10 years older that was an obvious scare-tactic, he was a young, naive teenager so he was legitimately scared for his life. was able to calm him down, he added me to the call, and turned the laptop off. i was surprised that the hackers in question were 3-4 french teenagers, incredibly rude and aggressive. they didn't care that they weren't able to ruffle my feathers, they just constantly asked for bitcoins, said they'd hurt our mom etc. when i refused and just didn't engage they started posting our mom's tax returns and other files from her laptop, that's when i realized that they did indeed exfiltrate data. immediately packed my bags and took the next train to meet mom and brother. we spent the afternoon rotating e-banking passwords etc. while doing this, the hackers did try to login to her paypal and they actually got into my netflix account. turned the wifi off at home to boot the laptop back up, wanted to try to retrace their steps. i did find out what kind of stealer they used and was able to sleaze my way into a secret discord server they used to organize, but it was temporary and they had already left. so i just wiped the laptop and reinstalled windows. apparently these guys had promised my brother to optimize his PC so that Fortnite would run better, he let them connect via AnyConnect or TeamViewer, don't exactly remember. they did some legit debloating stuff etc., but also let a stealer run in the background. apparently these guys had spent some weeks in the discord server my brother was in to establish trust. to this day i haven't felt as much rage again. seeing my young brother in such a distressed state, realizing that all of my mom's data, childhood pictures etc. were stolen made me angry to a point i've never felt, i legitimately wanted to find out who these guys were and hurt them as much as i could. of course we all calmed down again and realized there's nothing we could do other than rotate PWs and observe logins. police said there's nothing they could do (didn't expect it anyways, but worth a try), discord ignored me when i reported the hacker's accounts. typing this out again makes me angry again, interestingly enough. it's been two years, almost forgot that this ever happened.
_zagj 8mo ago
> TikTok deemed I should not have access to my account ever again, and X (formerly Twitter) is delaying a response to my appeal to the suspension, but I have not much hope; I reckon it's gone for good. I may have lost all the personal contacts and content from there, but on the bright side, that has taught and made me see some other things, besides the importance of being a little smarter to not blindly install extensions like my life depended on it. Well, losing access to both TikTok and X could be considered a bright side as well. But more seriously, isn't it tragic that you can't just blindly assume any piece of OSS isn't malware, anymore?
- esseph 8mo ago
  Not sure why OSS is mentioned here, should just say "software". And it's always been like this (be careful).
  - _zagj 8mo ago
    > And it's always been like this Not, it hasn't. The open source community was much smaller, and much more tightly knit 20 years ago, and it was intrinsically much higher-trust.
    - esseph 8mo ago
      Maybe out of ignorance, but that didn't span every internet subculture. The whitehats/grayhats have always been super paranoid.
      - _zagj 8mo ago
        Were you active on SF or Savannah 20+ years ago? Everyone knew everyone else, and it was a much higher-trust society (think Minneapolis before Somalis). > The whitehats/grayhats have always been super paranoid. Yeah, they were always "super paranoid," but it was about something that could, and admittedly eventually did happen--but not for many years later. I remember in the Perl community, there was a big scandal where some module was "phoning home" on install (for the sake of telemetry), which the author fixed in response to the outcry. I remember a hapless Debian contributor who, in an attempt to silence Valgrind warnings, inadvertently reduced the entropy used for keygen (after some miscommunication with OpenSSL upstream), and was unfairly accused by some of intentionally backrdooring it. That was the extent of OSS malware back then. Then along comes Github, and lets anyone upload anything, doesn't do even the minimal vetting of forcing you to explain what your project is and why it should be on GH, doesn't make you explicitly select an OSI-approved license, lets your freely fork other people's projects and even duplicate the project's name (making it difficult to identify canonical repos). It fosters a culture of just forking whatever you want, pulling in whatever you want, uploading any codeslop, ecourages MIT over copyleft, and has gamified crap like star rankings and activity graphs.
cagz 8mo ago
Great article on reminding the risks of browser extensions. They literally have access to everything within the browser window, from usernames and passwords to bank account details. Funnily I always tempted by extensions that offer dark more for webpages but never dared to install one. I do use extensions, but only if they are from well known, respected organisations. The author was lucky that it was only few compromised social media accounts. It could easily be an empty bank account or stolen identity instead.
- ahmetomer 8mo ago
  I'm relatively happy that I got away with a couple of suspended social media accounts and a lesson that I can share, which will improve my awareness. Would've been a totally different story had it reached more serious services like a bank account or iCloud.
deleted 8mo ago
[deleted]
ctg122234578 8mo ago
i hacked my computer
esseph 8mo ago
The first time I got "hacked" was around 1995. Someone I trusted at the time sent me a modified Legend of The Red Dragon bbs door game expansion/mod that del C:\ Learned a lot that day.
branon 8mo ago
Very well-written, thanks for sharing. Stories like this are important! > I went on looking for one of those browser extensions that made it easier to read. [...] I had to find the perfect one, with the cleanest user interface, the best features, the most convenient, across all cases and needs. Examining the supply chain of those extensions and whether they were open-source and reputable should have been part of the evaluation process! Also surely there is no reason to install any "dark reader" extension aside from the canonical Dark Reader...? https://github.com/darkreader/darkreader https://github.com/darkreader/darkreader I thought this one was very well-known. I still wouldn't recommend _using_ it, you remain at risk of upstream's supply chain being compromised, but it's at least not malicious by default. Firefox has dark mode built into its reader view feature which works on most websites, I'd imagine Chrome can do something similar. I greatly prefer and recommend this over installing an extension.
__turbobrew__ 8mo ago
even installing ublock origin gives me the heebie jeebies when chrome asks me if I want to give the extension access to my full browser data. uBO is the only extension I trust.
Hacker_Yogi 8mo ago
This is why having 2 browsers is part of good security practice - keep one for important work and the other for regular browsing.
cowboy7q 8mo ago
[dead]

85 points by ahmetomer 9mo ago

It is an humbling experience the moment when you accept that getting hacked is something that can happen to anyone, including the best of us. No one is too good not to be hacked.

resonious 8mo ago
I work in payments and yet I once gave my card (and 3DS auth!) to a phisher. Thankfully I realized what had happened pretty quickly and immediately deactivated the card. But the fact that I went through the whole process before realizing was pretty harrowing. For all I know, that might not have been the first time.
- calgoo 8mo ago
  All it takes is an "off day" or being stressed etc. and our guard is down.

mc3301 8mo ago

What was the Chrome extension?

ahmetomer 8mo ago
Unfortunately, I haven't been able to pinpoint which one it was. It certainly was a dark reader extension, that I can tell.

akersten 8mo ago

> open their password manager which also might need you to authenticate, type in their master password, search for the name of the said website, copy the password, paste it in This is one way to guarantee you'll eventually fall for a phishing attack. Are we really running URL-unaware password managers in the year 2026?

buckle8017 8mo ago
Lots of people are afraid of attacks on the browser extension. There have been exploits for them in the past, it's a legitimate concern. Deciding between the two setups is a tradeoff between one security issue and another.
- akimbostrawman 8mo ago
  >afraid of attacks on the browser extension Which is a legitimate concern since they are a gaping hole in security and isolation. Visiting website should be treated like phone calls from the bank. If you get called/mailed you don't follow the information there but call back / visit the site yourself e.g. from bookmarks or copy url from pw manager.
- asimovDev 8mo ago
  I am now wondering if Safari's integration with the system-wide password manager is similar to having a 1Password browser extension installed in a chromium browser
  - buckle8017 8mo ago
    It's probably slightly more secure than the extension. Legitimately the only reason to us the built in password managers is this tradeoff.
Y-bar 8mo ago
It’s also an issue that extensions like 1Password are _too_ URL-aware, until recently it tried to use heuristics and ignore subdomains for matching credentials. This meant that we used to get a list of almost a hundred options when logging into our AWS infrastructure. No matter which actual domain used. Someone could have used this vulnerability as part of a phishing campaign.
- pjerem 8mo ago
  Haha and Bitwarden is url aware but not enough. I work in a company where I have two okta accounts (because hey, why not) on two .okta.com subdomains. Bitwarden _randomly_ messes up the two subdomains and most of the times (but not always, which seems strange actually), it fills the form with the wrong password. I don’t know why. I know that there is an option to make it stricter on domain matching but you can’t configure it on per item basis, only for the whole vault.

morgan814 8mo ago

Not all too long ago I had someone port out my VOIP number. They had it for a few hours. This was after I had spent extensive effort attempting to secure my digital life. VOIP was SIM-swap resistant sure, but I totally missed that port out requests default to failing open. Thankfully the VOIP operator alerted me and pulled the number back. Then I set a port out code. Who knows how many other holes I have. I lost my sense of smugness that day.

sneak 8mo ago
Using SMS 2FA has been explicitly deprecated for years. It’s insecure for this and a million other reasons. TOTP is also trivially phishable. I still have my sense of smugness because I use SOTA 2fa.
- embedding-shape 8mo ago
  I wish banks would get this memo. Not only is one of my banks enforcing a maximum password length of 6 NUMBERS (no letters/special characters allowed), but also that high-value transfers are only confirmed via SMS 2FA, even though their own banking app also have a separate 2FA thing that doesn't go through SMS, but it's only used for "low-value" actions...
  - ahmetomer 8mo ago
    This. My Turkish bank (Garanti BBVA) only works with SMS codes for new logins & payment confirmations, and the app password is 6 digits only, which it also wants (forces) you to change it every now and then because apparently that's a good security measure.
  - pards 8mo ago
    Name and shame Tangerine (formally ING Direct) in Canada only has 6-digit PINs and SMS 2FA TD Canada Trust only supports SMS 2FA PC Financial only supports SMS 2FA
- Thorrez 8mo ago
  TOTP is not SOTA 2FA. WebAuthn is SOTA 2FA. TOTP can be phished. WebAuthn cannot.

JosephusAMiller 8mo ago

In the moment, it doesn't feel off, that's the most disconcerting aspect. It's the things that don't seem so critical or important that get you as well. Registration on a random site, and for a temporary reason was what got me once. In this case the browser extension seemed almost like an afterthought at the time for the author.

pamcake 8mo ago

Had a close call: Apparently it's possible to bypass 2FA and do a password reset of a Google account without email access, if the account owner doesn't abort it within 30 days. I confirmed that it works by "pwning myself" afterwards. So keep an eye on your old Gmail inbox if it matters.

rand89 8mo ago
what how does this work
throwa356262 8mo ago
Never heard of this before, and I think the mail Google sends you specifically says it is safe to ignore it if it didn't come from you. Has this recently changed?
omnifischer 8mo ago
Apparently? i.e -> fake news.
- pamcake 8mo ago
  No. First-hand account.

3abiton 8mo ago

> At this point, I am the old lady who is driving to a Target to buy gift cards and give them to Jared, who is the Amazon Customer Support specialist with a suspiciously heavy Indian accent, waiting on the phone. It happens to all of us. I always tend to make sure any extension has the sources available (unless requested by work/client), but nowadays with open source supply chain attack, it's just another breakable wall. Even on linux, some long time ago, I caught a trojan (luckily to the extent of my knowledge, it didn't affect anything besides running a crypto mining on my m3 laptop)., disguised as systemd, that was spreading through kodi extensions.

cwel 8mo ago
Running Asahi? or otherwise, How did a trojan slip through disguised as an init system which does not exist on darwin. (this is all assuming by "my m3 laptop" you are referring to apple silicon.. so i could be way off base)
- 3abiton 8mo ago
  I see the confusion. My fault. Before the Mac M3, intel briefly used to have the intel core m3 cpu lineup. Fanless, and very energy efficient for the time (~2017).
  - cwel 8mo ago
    Ah, yeah I should have figured when you referred to the event happening a long time ago that it wasn't the Applearm. nonetheless, i agree with the sentiment.. browser extension ecosystem is rife with questionablesoft

SeanAnderson 8mo ago

I got hacked late last year. It sucked. Do not recommend. I'm not going to blog about it, but will at least share how I messed up. Maybe it'll help someone else. I was phished through Discord. A CEO that I was friends with was phished prior to me and I let my guard down when someone I put on a pedestal reached out to me. The hacker asked me to review a video game prototype they'd been tinkering with in their spare time (the CEO worked in the video game industry) and they came to me because they knew I'd give them "honest feedback." The game's website looked legit enough with AI generated screenshots and boilerplate text. They also messaged me right around dinner. I had like ten minutes of downtime when the message came in and I immediately shifted to, "Yeah I can bang this request out real quick for a person important to me before dinner arrives." rather than keeping my guard up. Additionally, I have (or had) two Google accounts. My primary email address is much older and wasn't very business-professional. Over 15 years ago I created a secondary email, that was just my name at gmail, configured it to forward all emails to my first account, and then never logged in to that account again. Naturally, that meant that my primary account had 2FA, but my secondary account did not. I signed up for Discord using my secondary Google account. So, when I got phished, the hacker assumed that was my primary account and compromised it first. The way they compromised the account was very quick and efficient. They immediately set parental controls on the account, listed an email address they controlled as the parent, and then changed the accounts age to under 13. Those actions 100% lock an account because all account recovery options must be approved by the parent for children under 13. Surprisingly, I did get a security notification saying that a suspicion session had been started on my primary email account even through 2FA. I (thankfully) managed to kick the hacker out before they were able to do the same to me. I'm not sure how they got access to the second account. Laughably, the hacker tried to extort me for only $400 and, when they didn't get it, they pivoted to sending threatening texts then moved on to trying to phish others for quick cash. Thankfully, I didn't lose much. I lost access to my Discord account and to my Google account, but all my Google data was replicated. I lost a full nights sleep resetting all my passwords everywhere. And I still feel a bit violated and think I always will. It was really interesting being motivated to interface with the security processes of several hundred companies. Shout out to Kraken and Etsy for having the best security procedures. Anyway. Just wanted to highlight a scenario which happened. I'm in engineering leadership. I've worked on a computer every day for over 20 years. I use KeePass to store my passwords and generally have fine security hygiene. I do my KnowBe4 training modules, lol.

keysersoze33 8mo ago

Sadly the blogpost fails to mention which browser extension was the macilious one that compromised his session tokens. While quite technical users (a la. this community and devs in general) would be able to inspect the source code of browser extensions to do an audit, most of us don't have time for this, and we just have to rely on the browser add-on number of downloads & reviews as a poor indicator. It would be really useful to know how this particular extension was rated

omnifischer 8mo ago
Totally. This would have been vital.
ahmetomer 8mo ago
Hi, OP here: Unfortunately, with a brisk urge to clean it all up, I hadn't paid attention to which extension it was that got my browser compromised; I had immediately removed all extensions, cleared browser data, stopped the sync, and uninstalled it altogether (for fear of getting further compromised). What I can say is that I have tried a number of extensions for the purpose of making a website in dark theme, for ease of reading, which weren't as popular (in terms of rating & installs), and highly likely that those were malware. That being said, I now hesitate to even install extensions that are selected by the Google Chrome editor team. I vibe-coded a simple extension myself to use as a "dark reader", and will probably avoid installing anything anymore. I got my fair share of damage.
- wt__ 8mo ago
  Firstly, I really liked the way you wrote your blog post. FWIW, I experimented with dark theme extensions (paid and free) and gave up on them after a while: it just all felt a bit too clunky and unreliable, the flashes of unstyled pages were annoying too. I've now standardised (this is in Firefox) on a combination of: - Reader mode - a very simple extension that allows per-domain custom CSS… - …and another that lets you disable Javascript completely per site (which adds a bit of security, generally improves the experience, including the side effect of removing cookie popups.)

close04 8mo ago

> but on a universal level, we're missing a cohesive master plan, in which a user, a human, need not undertake endless and repeated manual fend-off of the devil This is a very good way of stating the problem in terms anyone can relate to. > I had one brow raised, a little suspicious, but not very much to initiate a full-scale defense This on the other hand seems overly superficial. You get your eMarketplace account hacked, then your Twitter account, and you're just "a little suspicious"? My eyebrows would raise all the way to the back of my head after this. Not sure I'd know where to start but I'd be very concerned. > A few days later, the same thing happened with my TikTok and Reddit accounts. I repeated the previous steps now that I had gotten used to them. This time I raised two of my brows with a little more suspicion. Still not quite there, though. I mean... This is an incredibly high threshold for getting concerned. The kind that lowers the bar to getting hacked.

ahmetomer 8mo ago
Totally on point. I should've taken it more seriously in the first incident. That way, I could've kept my TikTok and X accounts. But the damage is done, and it has been a good lesson to me. Hopefully my post could be as much of a "lesson" to those reading, without getting compromised as I was.

barbs 8mo ago

Anyone else seeing the blog post briefly before flicking to a 404 page? Safari on iOS 15 here.

Havoc 8mo ago

Hmm. Maybe I need to install a second browser for sensitive stuff. Or maybe stick that in a vm somehow

4ggr0 8mo ago

my younger brother called me once, which was unusual, so i immediately answered. he was crying, which was new to me as well, and told me that our mom's laptop he had been using to game on was hacked, and that he was now being extorted live in a discord call. asked him to shutdown the laptop immediately and add me to the call, to which he replied, "they sent me our postal code and told me if i told anyone or turned the laptop off, they're going to send someone to hurt me." that's when i realized why he was panicking so much, to me who was 10 years older that was an obvious scare-tactic, he was a young, naive teenager so he was legitimately scared for his life. was able to calm him down, he added me to the call, and turned the laptop off. i was surprised that the hackers in question were 3-4 french teenagers, incredibly rude and aggressive. they didn't care that they weren't able to ruffle my feathers, they just constantly asked for bitcoins, said they'd hurt our mom etc. when i refused and just didn't engage they started posting our mom's tax returns and other files from her laptop, that's when i realized that they did indeed exfiltrate data. immediately packed my bags and took the next train to meet mom and brother. we spent the afternoon rotating e-banking passwords etc. while doing this, the hackers did try to login to her paypal and they actually got into my netflix account. turned the wifi off at home to boot the laptop back up, wanted to try to retrace their steps. i did find out what kind of stealer they used and was able to sleaze my way into a secret discord server they used to organize, but it was temporary and they had already left. so i just wiped the laptop and reinstalled windows. apparently these guys had promised my brother to optimize his PC so that Fortnite would run better, he let them connect via AnyConnect or TeamViewer, don't exactly remember. they did some legit debloating stuff etc., but also let a stealer run in the background. apparently these guys had spent some weeks in the discord server my brother was in to establish trust. to this day i haven't felt as much rage again. seeing my young brother in such a distressed state, realizing that all of my mom's data, childhood pictures etc. were stolen made me angry to a point i've never felt, i legitimately wanted to find out who these guys were and hurt them as much as i could. of course we all calmed down again and realized there's nothing we could do other than rotate PWs and observe logins. police said there's nothing they could do (didn't expect it anyways, but worth a try), discord ignored me when i reported the hacker's accounts. typing this out again makes me angry again, interestingly enough. it's been two years, almost forgot that this ever happened.

_zagj 8mo ago

> TikTok deemed I should not have access to my account ever again, and X (formerly Twitter) is delaying a response to my appeal to the suspension, but I have not much hope; I reckon it's gone for good. I may have lost all the personal contacts and content from there, but on the bright side, that has taught and made me see some other things, besides the importance of being a little smarter to not blindly install extensions like my life depended on it. Well, losing access to both TikTok and X could be considered a bright side as well. But more seriously, isn't it tragic that you can't just blindly assume any piece of OSS isn't malware, anymore?

esseph 8mo ago
Not sure why OSS is mentioned here, should just say "software". And it's always been like this (be careful).
- _zagj 8mo ago
  > And it's always been like this Not, it hasn't. The open source community was much smaller, and much more tightly knit 20 years ago, and it was intrinsically much higher-trust.
  - esseph 8mo ago
    Maybe out of ignorance, but that didn't span every internet subculture. The whitehats/grayhats have always been super paranoid.
    - _zagj 8mo ago
      Were you active on SF or Savannah 20+ years ago? Everyone knew everyone else, and it was a much higher-trust society (think Minneapolis before Somalis). > The whitehats/grayhats have always been super paranoid. Yeah, they were always "super paranoid," but it was about something that could, and admittedly eventually did happen--but not for many years later. I remember in the Perl community, there was a big scandal where some module was "phoning home" on install (for the sake of telemetry), which the author fixed in response to the outcry. I remember a hapless Debian contributor who, in an attempt to silence Valgrind warnings, inadvertently reduced the entropy used for keygen (after some miscommunication with OpenSSL upstream), and was unfairly accused by some of intentionally backrdooring it. That was the extent of OSS malware back then. Then along comes Github, and lets anyone upload anything, doesn't do even the minimal vetting of forcing you to explain what your project is and why it should be on GH, doesn't make you explicitly select an OSI-approved license, lets your freely fork other people's projects and even duplicate the project's name (making it difficult to identify canonical repos). It fosters a culture of just forking whatever you want, pulling in whatever you want, uploading any codeslop, ecourages MIT over copyleft, and has gamified crap like star rankings and activity graphs.

cagz 8mo ago

Great article on reminding the risks of browser extensions. They literally have access to everything within the browser window, from usernames and passwords to bank account details. Funnily I always tempted by extensions that offer dark more for webpages but never dared to install one. I do use extensions, but only if they are from well known, respected organisations. The author was lucky that it was only few compromised social media accounts. It could easily be an empty bank account or stolen identity instead.

ahmetomer 8mo ago
I'm relatively happy that I got away with a couple of suspended social media accounts and a lesson that I can share, which will improve my awareness. Would've been a totally different story had it reached more serious services like a bank account or iCloud.

deleted 8mo ago

[deleted]

ctg122234578 8mo ago

i hacked my computer

esseph 8mo ago

The first time I got "hacked" was around 1995. Someone I trusted at the time sent me a modified Legend of The Red Dragon bbs door game expansion/mod that del C:\ Learned a lot that day.

branon 8mo ago

Very well-written, thanks for sharing. Stories like this are important! > I went on looking for one of those browser extensions that made it easier to read. [...] I had to find the perfect one, with the cleanest user interface, the best features, the most convenient, across all cases and needs. Examining the supply chain of those extensions and whether they were open-source and reputable should have been part of the evaluation process! Also surely there is no reason to install any "dark reader" extension aside from the canonical Dark Reader...? https://github.com/darkreader/darkreader https://github.com/darkreader/darkreader I thought this one was very well-known. I still wouldn't recommend _using_ it, you remain at risk of upstream's supply chain being compromised, but it's at least not malicious by default. Firefox has dark mode built into its reader view feature which works on most websites, I'd imagine Chrome can do something similar. I greatly prefer and recommend this over installing an extension.

__turbobrew__ 8mo ago

even installing ublock origin gives me the heebie jeebies when chrome asks me if I want to give the extension access to my full browser data. uBO is the only extension I trust.

Hacker_Yogi 8mo ago

This is why having 2 browsers is part of good security practice - keep one for important work and the other for regular browsing.

cowboy7q 8mo ago

[dead]