Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More Than 1M Google Accounts Breached by Gooligan

blog.checkpoint.com

Post reply on HN
Print view View original

41–50 of 183 posts

Re: More Than 1M Google Accounts Breached by Gooligan

#41

Post by ec109685 »

knz wrote: post #34
pierrec wrote: post #28

Just to be clear, they didn't obtain any passwords, but auth tokens. This would potentially allow them to log into accounts, but only as long as the tokens are valid. Also, they don't reveal which "third party app stores" served infected apps, but they do provide a list of infected apps, and searching for these yields some real shady download sites: http://imgur.com/a/0luW3

Does 2FA help in this situation? If the token signs in from a previously unknown device/server wouldn't it prompt for authentication details?

No. The malware steals a secret stored on the device that gives the attacker the same access to your google account as your own phone.

Re: More Than 1M Google Accounts Breached by Gooligan

#42

Post by StavrosK »

jasonkostempski wrote: post #37
Quiark wrote: post #32

Earlier quoted context omitted.

So you don't access your gmail from the phone?

Even though I sign into my phone using my Google account, I use gmail through IMAP in K-9 which isn't tied to the phone account at all.

I second this, I love K-9.

Re: More Than 1M Google Accounts Breached by Gooligan

#43

Post by haswell »

knz wrote: post #34
pierrec wrote: post #28

Just to be clear, they didn't obtain any passwords, but auth tokens. This would potentially allow them to log into accounts, but only as long as the tokens are valid. Also, they don't reveal which "third party app stores" served infected apps, but they do provide a list of infected apps, and searching for these yields some real shady download sites: http://imgur.com/a/0luW3

Does 2FA help in this situation? If the token signs in from a previously unknown device/server wouldn't it prompt for authentication details?

FTA:

> While Google implemented multiple mechanisms, like two-factor-authentication, to prevent hackers from compromising Google accounts, a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in.

The trouble is that auth tokens are generally not tied to a specific device or IP. There aren't really any mechanisms for this in standard OAuth 2.0 flows (if indeed this is what they're using).

Re: More Than 1M Google Accounts Breached by Gooligan

#44

Post by rolodato »

jrochkind1 wrote: post #24

> While Google implemented multiple mechanisms, like two-factor-authentication, to prevent hackers from compromising Google accounts, a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in. What's the right fix here? Should auth tokens be ip-address-tied? How much will that break? Or would that not even fix it?

Token binding would solve this by binding OAuth tokens to TLS connections, so they can't be used even if stolen: https://tools.ietf.org/html/draft-jones-oauth-token-binding-...

Re: More Than 1M Google Accounts Breached by Gooligan

#45

Post by n1tro »

I used to work in an ad-tech company focused on mobile cpi offers that for several months paid the salaries of everyone involved by injecting malware in cracked apps on several third party app stores (they were making a profit out of it enough to dedicate a team only for this).

They even managed to automate all the process of "selling" cracked apps on third party stores. It is amazing how easy it is to trick broke 13yr old kids into installing stuff on their phones.

I left shortly after i found out about this.

Re: More Than 1M Google Accounts Breached by Gooligan

#46

Post by rolodato »

knz wrote: post #34
pierrec wrote: post #28

Just to be clear, they didn't obtain any passwords, but auth tokens. This would potentially allow them to log into accounts, but only as long as the tokens are valid. Also, they don't reveal which "third party app stores" served infected apps, but they do provide a list of infected apps, and searching for these yields some real shady download sites: http://imgur.com/a/0luW3

Does 2FA help in this situation? If the token signs in from a previously unknown device/server wouldn't it prompt for authentication details?

No, but this would be solved if Google and client applications implemented OAuth token binding: https://tools.ietf.org/html/draft-jones-oauth-token-binding-...

Re: More Than 1M Google Accounts Breached by Gooligan

#47

Post by [deleted] »

jrochkind1 wrote: post #24

> While Google implemented multiple mechanisms, like two-factor-authentication, to prevent hackers from compromising Google accounts, a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in. What's the right fix here? Should auth tokens be ip-address-tied? How much will that break? Or would that not even fix it?

[deleted]

Re: More Than 1M Google Accounts Breached by Gooligan

#50

Post by 4rtemis »

YCode wrote: post #14
4rtemis wrote: post #8

Earlier quoted context omitted.

I don't use a Google account on my android phone. Cyanogenmod sans google anything.

So I guess you don't have access to Google Play? How do you get apps?

Fdroid for what I use daily. Firefox Aurora direct from FF which auto updates. HumbleBundle for games because I like funding DRMFree + outside GPlay distribution methods.

I use raccoon to download from GPlay if I need to as a peer stated and know when to update with apktrack from fdroid, but really that's only for Slack since we use it at work. Slack uses Google Push Notifications like most apps, so it doesn't notify me about updates, but I check it periodically enough. I could go the microG route, but I prefer not having to interface with google servers at all if possible.

Edit: Maybe I can either convince my work to use something like Riot.im when it gets mature enough, or use a slack bridge for it and rid myself of this problem.

Post reply on HN