Is it really that easy to hack someone's Discord? Is it the same with: Telegram, Twitter, facebook ...ect ? and does this work if I'm accessing Discord through Firefox ?
https://lemmy.dbzer0.com/post/26547520
=> More informations about this toot | More toots from zaknenou@lemmy.dbzer0.com
Typically, with scams like this, the attacker is using a tool like Evilginx.
The way this works is that Evilginx runs on a server that the hacker controls and will request the login page from whatever service they are targeting(Discord, Steam, Google, etc) and then serve it to you as a proxy. It looks entirely legitimate unless you make sure to very closely check the URL.
Once you login, it will take a copy of your Username, your password, and your session token(the thing that lets Discord know it’s you so you don’t need to login again after every refresh). and suddenly the attackers now have access to your account to do whatever they want with it.
Discord should absolutely prevent modifying links in this way specifically for this reason, but good practice as a user is to hover over every link and make sure it’s pointing where it’s supposed to. Don’t click on anything that looks suspicious.
=> More informations about this toot | More toots from Godort@lemm.ee
Does this rely on the user typing in their password, or does somehow even the browser fall for it and autofill it?
Because in that case, to respond to OP: Firefox is not vulnerable to this, but most users themselves are. Using a password manager like Bitwarden would help, because if you add the website’s real URL to your password entey (happens automatically for the current URL at password entry creation), bitwarden will simply just not show your password entry when the URL does not match.
Also, install uBlock Origin and turn on it’s phising blocklists in the settings. It can be helpful.
=> More informations about this toot | More toots from ReversalHatchery@beehaw.org
An attack using this tool does require that the user actually logs in, but because they’re just acting as a proxy for the real login page, the only way you’d spot the difference is if the URL doesn’t match (or that your password manager doesn’t auto-fill)
However, it’s pretty easy to see that someone would be fooled by that as you’d expect to need to confirm your identity when adding a gift card to your steam account.
=> More informations about this toot | More toots from Godort@lemm.ee
text/geminiThis content has been proxied by September (3851b).