bradleyjkemp

I'd like to see some examples of before/after code samples which have the same hash.

I can see this will be tolerant of simple renames, but seems unlikely this hash will survive any real refactor of code

I believe this is another case of abusing GitHub for visibility, not actually doing anything meaningful open source

The code in the repo just seems to be connection code ("provides a way for anybody to test our Redis synchronization service on demand") rather than the sync service itself

Oh some of them definitely use a real reCAPTCHA, hCAPTCHA, or Turnstile widget. It actually useful sometimes to track the same API key being used across multiple different domains

But yeah, I wouldn't even know where to report those API keys for abuse

It's really common now for phishing kits to use interstitial pages that require solving a captcha before the actual phishing content is shown

Victims just click through the captcha without thinking, but it makes automatic verdicting by security scanners a pain because they just see a captcha page: can't tell the brand being impersonated, or even if it's a phishing site

I wrote a post about a number of these which actually pretend to be Cloudflare! https://phish.report/blog/fake-cloudflare-interstitials

A typo I think, should be BM25F. From Wikipedia:

> BM25F (or the BM25 model with Extension to Multiple Weighted Fields) is a modification of BM25 in which the document is considered to be composed from several fields (such as headlines, main text, anchor text) https://en.wikipedia.org/wiki/Okapi_BM25

Some papers are linked in the references

Cool! Have you run this against a corpus of known ransomware samples to see how well it performs?

Appears the blogpost text is from a LinkedIn post (where the hashtags are clickable): https://www.linkedin.com/posts/zayarni_qdrant-summer-of-code...

Nothing more interesting than copy-paste I'm afraid

If you've got a load balancer (like Caddy) in front of your pods you can configure it to hold requests while the new pod comes up: https://twitter.com/bradleyjkemp/status/1486756361845329927

It's not perfect but it means rather than getting connection errors, browsers will just spin for a couple seconds.

The same technique is used by https://mrsk.dev/

May want to double check that: domain data shows it was only registered today about an hour ago: https://client.rdap.org/?type=domain&object=doctree.dev

It was definitely available to purchase when I commented

And it's not just DNS issues. The domain doesn't even seem to be registered: it's available for purchase...

edit: No longer! Hopefully someone benevolent picked it up

Ah neat, yeah that's exactly what I need, thanks!

Oh, 100% I need some more docs on the page: it's definitely not foolproof.

From my testing, it works even if the window is in the background somewhere but generally it stops working if you switch to a different tab within the same window.

You should get a popup though if you do something that causes the page to lose its Wake Lock (which works by listening to the release event: https://developer.mozilla.org/en-US/docs/Web/API/Screen_Wake...)

Yup, that's my bad CSS I'm afraid. https://bulma.io explicitly resets the color of <a> tags inside a hero, so I need to figure out how to stop/override that

I think this is "zero day" in the sense of no patch is available, not in the sense of skipping responsible disclosure.

This has a CVE number allocated (CVE-2022-29072) and the README mentions 7-zip disputing that this is their problem (rather, some underlying Windows component).

Good sentiment but so so tricky to get the wording right. You've got to write a sentence so perfect the fraudster can't pervert it or persuade the victim to ignore it.

For your example, the fraudster could say "yes, your account is being targeted by criminals, that's why I'm calling you". The warning inadvertently backs up their story

Defense in depth is a worthy goal though

You'll never get 100% of people remembering that advice 100% of the time. So how do you mitigate the situation when they forget?

2FA included in the free tier and there's even a 10% discount on the paid tiers if 2FA is enabled!

That's an incredibly cool and generous offer

My principle for https://phish.report (a tool for semi-automating the reporting of phishing sites) is: do as much statically or server side rendered as possible.

Deployment: Docker Compose. It's great to just set a DOCKER_HOST environment variable and I can deploy to any server with Docker installed.

Backend: a Go service. Could be any language really but that's what I know. Just takes requests, does some business logic and returns HTML templates.

Frontend: I'm not a frontend dev so I try to avoid it as much as possible. For UI, I use Bulma (a pretty comprehensive bunch of CSS components), with a tiny sprinkling of vanilla JS for small client-side animations (e.g. burger menu toggles). For any user action that hits the backend, I use https://htmx.org/ and just return a small HTML snippet as the API response. No point using client-side JS for that (no latency gains and makes the tech stack less homogenous).

Similar: https://ja3er.com/ which is formed by taking a bunch of (stable) attributes from your TLS handshake, appending them into a string, and hashing it.

They've also done the correlation with User Agent and it's surprisingly accurate.

Original post by Salesforce security team: https://engineering.salesforce.com/tls-fingerprinting-with-j...

I report a lot of phishing sites but it gets very annoying very quickly. As well as reporting to SafeBrowsing, etc. for each site you also need to look up the domain registrar and hosting provider (via WHOIS) and email them.

Rather than do this manually every time, I wrote a small CLI to automate the lookups and even open pre-templated emails: https://github.com/bradleyjkemp/abwhose

I'm now redoing this as a web app so that I can do the entire reporting process without leaving the browser: https://phish.report

Kinda fun trying to "speedrun" the process down to as few clicks as possible. And I'm pretty pleased with how fast I've gotten the process.

Now I'm looking to add some more account/user features e.g. a history of sites you've submitted. Perhaps some stats on how many times you've been the first to report a given site.