Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More Than 1M Google Accounts Breached by Gooligan

blog.checkpoint.com

Post reply on HN
Print view View original

31–40 of 183 posts

Re: More Than 1M Google Accounts Breached by Gooligan

#31

Post by tonyplee »

ohyoutravel wrote: post #2

Malware on your Android device picked up from third party app stores (FDroid? Amazon?) that steals email accounts and auth tokens. Looks like it only works on the older Android 4 Jellybean software (and some Android 5 Lollipop) and below, so mostly concentrated in Asia where there are lower-end phones. You can see if your account has been affected here: https://gooligan.checkpoint.com/

If it is just auth tokens instead of email password, should google be able to invalidate all these auth tokens in their backend immediately? Force those uses to re-login and get new auth tokens?

Re: More Than 1M Google Accounts Breached by Gooligan

#33

Post by deep_attention »

jasonkostempski wrote: post #23
YCode wrote: post #14

Earlier quoted context omitted.

So I guess you don't have access to Google Play? How do you get apps?

I've got a few crutches I'm not ready to give up so I'm on regular Android but I've been starting down the path of using F-Droid only apps so I can trasition more smoothly when I'm ready. The only app I've got left is Maps, OsmAnd is a little too tedious for me but I'll convince myself it's worth it eventually. I'm also concerned that I might not be able to get Project Fi working quite right.

I am using "Here WeGo" https://here.com/ (originally developed by Nokia), quite a good alternative to Google Maps. It does not need any Google services installed. Downloaded it directly from the Google Play store with Raccoon.

Re: More Than 1M Google Accounts Breached by Gooligan

#34

Post by knz »

pierrec wrote: post #28

Just to be clear, they didn't obtain any passwords, but auth tokens. This would potentially allow them to log into accounts, but only as long as the tokens are valid. Also, they don't reveal which "third party app stores" served infected apps, but they do provide a list of infected apps, and searching for these yields some real shady download sites: http://imgur.com/a/0luW3

Does 2FA help in this situation? If the token signs in from a previously unknown device/server wouldn't it prompt for authentication details?

Re: More Than 1M Google Accounts Breached by Gooligan

#35

Post by jasonkostempski »

mapleoin wrote: post #6

Does anyone else use a special account for their Android phone that they don't use for anything else?

Damn, should have thought of that. I assume it's not possible to transfer the few purchased apps I already have? I'd probably be willing to ditch them.

Re: More Than 1M Google Accounts Breached by Gooligan

#36

Post by cheeze »

jrochkind1 wrote: post #24

> While Google implemented multiple mechanisms, like two-factor-authentication, to prevent hackers from compromising Google accounts, a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in. What's the right fix here? Should auth tokens be ip-address-tied? How much will that break? Or would that not even fix it?

I'm not sure what the solution is, but my worry with tying to an IP address is the mobile setting where I may transition from work wifi to bus wifi to home wifi, with a mobile carrier in between all of those steps.

Maybe something like a device ID, although I assume that that can be easily stolen and spoofed.

Re: More Than 1M Google Accounts Breached by Gooligan

#37

Post by jasonkostempski »

Quiark wrote: post #32
mapleoin wrote: post #6

Does anyone else use a special account for their Android phone that they don't use for anything else?

So you don't access your gmail from the phone?

Even though I sign into my phone using my Google account, I use gmail through IMAP in K-9 which isn't tied to the phone account at all.

Re: More Than 1M Google Accounts Breached by Gooligan

#38

Post by haswell »

jrochkind1 wrote: post #24

> While Google implemented multiple mechanisms, like two-factor-authentication, to prevent hackers from compromising Google accounts, a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in. What's the right fix here? Should auth tokens be ip-address-tied? How much will that break? Or would that not even fix it?

I'm not sure what the right solution is, but tying tokens to IP addresses is probably not workable.

Better mechanisms for protecting tokens stored on the device seems like the only way to reasonably improve this situation.

Re: More Than 1M Google Accounts Breached by Gooligan

#39

Post by dri_ft »

tyingq wrote: post #15
ohyoutravel wrote: post #2

Malware on your Android device picked up from third party app stores (FDroid? Amazon?) that steals email accounts and auth tokens. Looks like it only works on the older Android 4 Jellybean software (and some Android 5 Lollipop) and below, so mostly concentrated in Asia where there are lower-end phones. You can see if your account has been affected here: https://gooligan.checkpoint.com/

>Malware on your Android device picked up from third party app stores They say that, but then Google's G+ post[1] says "These apps are most often downloaded outside of Google Play" You could read "most often" as "some of these were downloaded from Google Play". Either way, they are exploiting known vulnerabilities. The big issue to me is that phone manufacturers / carriers, by choice, stop patching phones whenever th…

"Most often" might just be hedging.
Post reply on HN