Yeah, I'd open it on my chromebook. And if i see a login screen on the way to open said spreadsheet, i'd immediately start worrying and recheck things.
Good luck.
back
1 comments
They don't need luck, you just downloaded the attacker's payload onto your machine! Phishing is more than the old "click my link, enter your password". Often they use malware so all you have to do is download the attachment or click the link.
"chromebook"
see above
no default downloading, cannot execute anything downloaded
1. Chromebooks can have vulnerabilities too. A buffer overflow in the parsing code for the spreadsheet viewer and you've got arbitrary code execution.
2. What if you just click on a link? Browser exploits are a thing too
parser is in javascript (google docs), in a sandboxed browser (chrome), in a system whose root partition is read-only, and hash-verified each boot and whose bootloader is in a physically-write-protected SPI chip.
good luck :)
Oh, you're right, no one's ever been able to exploit javascript in chrome ;)
And you don't need to persist anything to disk, just get a key logger going in memory. Or scrape the data from your other processes. Once you get arbitrary code execution on the machine it's game over.
Seriously, I deal with this kind of stuff for a living. No one is immune to these kinds of attacks; not you, not me, not anyone.
google has a bug bounty ;)
https://www.google.com/about/appsecurity/chrome-rewards/inde...
Feel free to submit your function exploits that you say are so easy to make
Never said browser exploits are easy to make. I just pointed out that many times phishing is about just clicking on the link, not getting people to actually type in their passwords.