News for hackers. Stuff that matters.
Re:Google AMP – The Newest of Evasive Phishing Tactic by Sander_Marechal on Thursday August 03, 2023 @05:32AM (#36983447)
Phishing sites are often also loaded with malware
Re:Google AMP – The Newest of Evasive Phishing Tactic by veave on Thursday August 03, 2023 @05:34AM (#36983462)
Afraid the site's design could hypnotise you into double clicking the exe and accepting the browser's, MotW and smartscreen warning dialogs?
Re:Google AMP – The Newest of Evasive Phishing Tactic by nkrisc on Thursday August 03, 2023 @06:37AM (#36983914)
More worried about 0-day browser exploits. If you know a site is malicious, why risk it?
Re:Google AMP – The Newest of Evasive Phishing Tactic by NoobPretender on Thursday August 03, 2023 @05:38AM (#36983486)
And the malware magically gets installed on your computer...how?
Re:Google AMP – The Newest of Evasive Phishing Tactic by function_seven on Thursday August 03, 2023 @05:45AM (#36983539)
Here are 3 CVEs I randomly found from just this year. There are a handful of these every year.

https://nvd.nist.gov/vuln/detail/CVE-2023-3079

https://nvd.nist.gov/vuln/detail/CVE-2023-37450

https://nvd.nist.gov/vuln/detail/CVE-2023-32439

Re:Google AMP – The Newest of Evasive Phishing Tactic by iamflimflam1 on Thursday August 03, 2023 @05:46AM (#36983549)
I guess you've never heard of browser exploits?
Re:Google AMP – The Newest of Evasive Phishing Tactic by NoobPretender on Thursday August 03, 2023 @02:23PM (#36989674)
Didn't think about that, good point
Re:Google AMP – The Newest of Evasive Phishing Tactic by NullPrefix on Thursday August 03, 2023 @05:38AM (#36983493)
If you don't run adblocker pretty much any website is loaded with malware. New York Times was infecting people with Bahama botnet some years ago. What's stopping other (non)shady websites from doing just the same?
Re:Google AMP – The Newest of Evasive Phishing Tactic by ikekkdcjkfke on Thursday August 03, 2023 @06:29AM (#36983860)
I want to browse the net with only bitmaps being sent to me. I do not want to execute your javascript or markup or make requests other than what i have initiated. Please god someone make a docker container i can spin up on a throwaway computer that renders pages and sends bitmaps of the site to my main computer

Edit: even better, every tab is a separate container instance, i close tab, it nukes the container

Re:Google AMP – The Newest of Evasive Phishing Tactic by jasomill on Thursday August 03, 2023 @04:16PM (#36991182)
To render pages on a throwaway computer and send only bitmaps, connect to the throwaway computer via VNC and run an ordinary browser.

As for improving on tab isolation over what existing browser sandboxes already offer, lightweight virtualization a la Firecracker seems like a more useful increment than containerization, and, assuming each tab has a similar VNC-like connection to its browser VM, virtualization would also make the whole "throwaway computer" setup less necessary to provide a meaningful security improvement.

Re:Google AMP – The Newest of Evasive Phishing Tactic by IIsi50MHz on Thursday August 03, 2023 @05:39PM (#36992346)
Sounds a bit like WebRenderingProxy.