News for hackers. Stuff that matters.

A comment on GitHub Notification Emails Hijacked to Send Malware. Parent comment

Re:GitHub Notification Emails Hijacked to Send Malware by hmottestad on Friday September 20, 2024 @02:12AM (#41599276)
Just clicking on the link might be enough. Maybe you have a slightly outdated browser with a known vulnerability. Maybe you’re holding off on installing an update just to be sure it won’t break anything.

And even if everything is up to date Pwn2Own regularly shows that having a user browse to a website is enough to get root access. Thankfully most people don’t have to worry about this since they are unlikely to attract the attention of someone with that level of resources.

[ Parent | on HN ]
Re:GitHub Notification Emails Hijacked to Send Malware by hmottestad on Friday September 20, 2024 @02:15AM (#41599295)
If I had those kinds of resources I might even put a captcha on the site that asks the user to do something incredibly stupid just to make them think they were in the clear.
[ Parent | on HN ]
Re:GitHub Notification Emails Hijacked to Send Malware by mewpmewp2 on Friday September 20, 2024 @07:02AM (#41600745)
Yeah, I think the barrier to get people to just click on a link (outside of e-mail as well) is very low, so that would be easy to affect anyone.
[ Parent | on HN ]