Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More Than 1M Google Accounts Breached by Gooligan

blog.checkpoint.com

Post reply on HN
Print view View original

51–60 of 183 posts

Re: More Than 1M Google Accounts Breached by Gooligan

#51

Post by undersuit »

ohyoutravel wrote: post #2

Malware on your Android device picked up from third party app stores (FDroid? Amazon?) that steals email accounts and auth tokens. Looks like it only works on the older Android 4 Jellybean software (and some Android 5 Lollipop) and below, so mostly concentrated in Asia where there are lower-end phones. You can see if your account has been affected here: https://gooligan.checkpoint.com/

Do you actually know which stores they mean? I'd hate for F-Droid to be vilified. F-Droid isn't just a store, it's an Android Repository Browser[1]. It would be a shame if the F-Droid repository was exploited beyond the concessions[2] that they allow.

[1] https://f-droid.org/wiki/page/Known_Repositories [2] https://f-droid.org/wiki/page/Antifeatures

Re: More Than 1M Google Accounts Breached by Gooligan

#52

Post by jasonkostempski »

deep_attention wrote: post #33
jasonkostempski wrote: post #23

Earlier quoted context omitted.

I've got a few crutches I'm not ready to give up so I'm on regular Android but I've been starting down the path of using F-Droid only apps so I can trasition more smoothly when I'm ready. The only app I've got left is Maps, OsmAnd is a little too tedious for me but I'll convince myself it's worth it eventually. I'm also concerned that I might not be able to get Project Fi working quite right.

I am using "Here WeGo" https://here.com/ (originally developed by Nokia), quite a good alternative to Google Maps. It does not need any Google services installed. Downloaded it directly from the Google Play store with Raccoon.

Hmm, that Raccoon thing seems ok but using something like that would be a bit of a sideways move for me. I'd rather move toward 100% libre software and not rely on proprietary software I'll need to hack around to maintain privacy.

Re: More Than 1M Google Accounts Breached by Gooligan

#53

Post by tyingq »

dri_ft wrote: post #39
tyingq wrote: post #15

Earlier quoted context omitted.

>Malware on your Android device picked up from third party app stores They say that, but then Google's G+ post[1] says "These apps are most often downloaded outside of Google Play" You could read "most often" as "some of these were downloaded from Google Play". Either way, they are exploiting known vulnerabilities. The big issue to me is that phone manufacturers / carriers, by choice, stop patching phones whenever th…

"Most often" might just be hedging.

Searched a bit more. This family of malware (Ghost Push) was being downloaded from the Play Store...at least in the past.

http://www.cmcm.com/blog/en/security/2015-10-14/825.html

"Apps infected with this Trojan have been found in Google Play as well as other popular app markets"

Re: More Than 1M Google Accounts Breached by Gooligan

#54

Post by ocdtrekkie »

dri_ft wrote: post #39
tyingq wrote: post #15

Earlier quoted context omitted.

>Malware on your Android device picked up from third party app stores They say that, but then Google's G+ post[1] says "These apps are most often downloaded outside of Google Play" You could read "most often" as "some of these were downloaded from Google Play". Either way, they are exploiting known vulnerabilities. The big issue to me is that phone manufacturers / carriers, by choice, stop patching phones whenever th…

"Most often" might just be hedging.

Adrian also stated they were removing affected apps from the Play Store. Many of the more recent vulnerabilities even show up in the Play Store first.

Adrian's constant defense hinges on saying "stick with the Play Store, where we protect you", but the Play Store really isn't much better, it's just that saying it is scares people from looking at competitors' markets.

Re: More Than 1M Google Accounts Breached by Gooligan

#55

Post by drvdevd »

cm2187 wrote: post #20
topspin wrote: post #16

Earlier quoted context omitted.

Yes. It never occurred to me to connect my portable devices to any accounts that mattered. Who does that?

It never occured to me that anything sent or received from a gmail account was private.

This is a good point. In a certain sense, all your webmail accounts are already compromised. It's just a question of "by whom"

[edit: substitute 'cloud' for 'webmail' to get an idea of the full range]

Re: More Than 1M Google Accounts Breached by Gooligan

#56

Post by r3bl »

mapleoin wrote: post #6

Does anyone else use a special account for their Android phone that they don't use for anything else?

Kind of.

I have a Google account created with a non-Gmail email address. I only use it for YouTube subscriptions (and I'm in the process of moving that to a basically RSS reader) and Google Play.

I have absolutely nothing work-related on my phone since I know that I can't update the system when a patch is submitted thanks to the shitty Android ecosystem. (And I'm still stuck at v5.0 and can't figure out a safe way to root my phone.)

Oh, and every single point of Google's tracking that I can turn off is turned off (like searches, YouTube history, location history etc).

Re: More Than 1M Google Accounts Breached by Gooligan

#57

Post by KingMachiavelli »

tonyplee wrote: post #31
ohyoutravel wrote: post #2

Malware on your Android device picked up from third party app stores (FDroid? Amazon?) that steals email accounts and auth tokens. Looks like it only works on the older Android 4 Jellybean software (and some Android 5 Lollipop) and below, so mostly concentrated in Asia where there are lower-end phones. You can see if your account has been affected here: https://gooligan.checkpoint.com/

If it is just auth tokens instead of email password, should google be able to invalidate all these auth tokens in their backend immediately? Force those uses to re-login and get new auth tokens?

The malware is still installed and would just capture the new auth tokens. And forcing the user to login would also give the malware an opportunity to capture the actual password.

Re: More Than 1M Google Accounts Breached by Gooligan

#58

Post by pierrec »

jrochkind1 wrote: post #24

> While Google implemented multiple mechanisms, like two-factor-authentication, to prevent hackers from compromising Google accounts, a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in. What's the right fix here? Should auth tokens be ip-address-tied? How much will that break? Or would that not even fix it?

While it might be possible to strengthen the mechanism used to keep sessions, the best fix isn't necessarily on that front. They have root access to the device you're logged in with, so they can do whatever they want with your current sessions. Auth tokens actually limit the damage by being expirable and being insufficient to perform a new login.

Re: More Than 1M Google Accounts Breached by Gooligan

#59

Post by [deleted] »

KingMachiavelli wrote: post #57
tonyplee wrote: post #31

Earlier quoted context omitted.

If it is just auth tokens instead of email password, should google be able to invalidate all these auth tokens in their backend immediately? Force those uses to re-login and get new auth tokens?

The malware is still installed and would just capture the new auth tokens. And forcing the user to login would also give the malware an opportunity to capture the actual password.

[deleted]

Re: More Than 1M Google Accounts Breached by Gooligan

#60

Post by tdkl »

devy wrote: post #40

We were just reading "Android security in 2016 is a mess"[1] 2 days ago and now we have another great example for it. https://news.ycombinator.com/item?id=13056288

"Windows is a mess because you can install a virus executable on it."

"You can't install Windows software outside App Store anymore, MS is taking muh freedoms."

You can't win.

Post reply on HN