Методы деанонимизации и подмены личности

Уровень 0 · материалов: 4

В кластер входят документы о методах скрытого раскрытия личности или имитации чужих данных, но не входят документы о распространении вредоносного ПО через перенаправления.

Общие признаки: подмена личности, деанонимизация пользователей, эксплуатация доверия к интерфейсу, социальная инженерия

Группа выше: Деанонимизация и цифровой след

Материалы

• #3107 — Fake Comments in LiveJournal via HTML Injection — Представитель этого кластера

  Фальшивые комментарии в ЖЖ от известных блогеров — Jeditobe

  Смысл: The main idea is to warn users about a phishing method in LiveJournal where HTML injection allows a user to spoof the identity of others in comments, thereby misleading the public.

  A security flaw in LiveJournal allows users to use HTML code to create visually fake comments appearing to be written by famous bloggers.

• #5381 — The Illusion of Trust in Git Commit Attribution

  Линус Торвальдс, Бьёрн Страуструп и Брендан Грегг контрибьютят в мой хобби-проект. Зачем? — SlavniyTeo

  Смысл: The main idea is that Git's architecture allows for easy impersonation of authors because commit identity is not verified. The author demonstrates that GitHub's UI can be misled into showing famous developers as contributors to a project, highlighting a security risk where trust in the platform's interface can lead to phishing or reputational damage.

  The author demonstrates how easy it is to spoof Git commits to make it appear as though famous developers contributed to a project, warning that GPG signing doesn't fully solve the problem of identity theft.

• #11059 — De-anonymizing Windows Users via SMB Authentication Leaks

  Деанонимизируем пользователей Windows и получаем учетные данные Microsoft и VPN-аккаунтов — ValdikSS

  Смысл: The main idea is that the Windows Single Sign-on feature can be exploited to steal NTLM hashes and de-anonymize users by tricking the system into connecting to a malicious SMB server, potentially compromising Microsoft Accounts and VPN credentials.

  Windows automatically leaks NTLM password hashes to remote SMB servers via its Single Sign-on feature, allowing attackers to steal Microsoft Account and VPN credentials.

• #11452 — SSH Public Key De-anonymization via GitHub

  Вас сдаст Гитхаб: деанонимизация пользователей SSH-серверов — Deleted-user

  Смысл: The main idea is that reusing the same SSH public key for both public services (like GitHub) and private servers allows third parties to de-anonymize server owners by correlating publicly available keys with server access probes.

  Using the same SSH public key for GitHub and your private servers allows attackers to link your identity to your infrastructure because GitHub publishes your public keys.