Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

81–90 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#81

Post by microtonal »

thomasahle wrote: post #59
mike-cardwell wrote: post #43

Earlier quoted context omitted.

Depends on the type of 2FA. If it's using U2F, then you'd be fine as that is tied to the domain name of the site you're on, but if it's using TOTP/HOTP (i.e. Google Authenticator), and the phishing site asked you for your 2FA code, and you gave it, then you would still be successfully phished.

Is the difference here that TOTP/HOTP is entered by the user, while U2F is entered automatically?

Besides what mike-cardwell says, TOTP relies on a shared secret, while U2F uses challenge response authentication. Even if a MITM captures the (encrypted) challenge-response sequence, a new authentication requires a new challenge-response.

Re: The closest I've ever come to falling for a Gmail phishing attack

#82

Post by xja »

tdkl wrote: post #62
willvarfar wrote: post #52

Earlier quoted context omitted.

And stop people emailing screen shots? The best approach I can come up with after five seconds thought is disabling links on non-text elements. And then they go make an anchor that is whitespace over top of a background image... so we'd also need to disable links on large expanses of empty whitespace in text when its embedded in a mail. I should think that can likely be worked around too, however. Got any more ideas?

Yeah, more people needs to get scammed, then the media will advertise how it happened and how to prevent it. It's called learning and is a sign of maturity.

To be frank I think that's a bit naive.

These attacks are a numbers game. There's a low cost to sending the emails and a much larger payoff.

Education helps, but it's still possible to catch people off guard, tired, new users etc.

Anything that can be done to flag these emails as spam, or increase the cost to the attacker helps.

Re: The closest I've ever come to falling for a Gmail phishing attack

#83

Post by Jarwain »

slazaro wrote: post #19

The only two things that I think could have prevented me from falling for this is: I don't have images loaded by default for unknown senders, and LastPass wouldn't match the domain and therefore wouldn't show the button to autocomplete on the password box. Depending on how observant I'd be at the moment, I might check the URL bar and see something fishy. But I could fall for this, which is worrying.

Assuming the attack is the same as what jhardcastle experienced, the email is propagated by sending emails to those who have received emails from the victim before. Alternately, it would be a known sender sending you that email.

Re: The closest I've ever come to falling for a Gmail phishing attack

#84

Post by mike-cardwell »

JorgeGT wrote: post #51
slig wrote: post #44

Earlier quoted context omitted.

What is stopping them from showing the TFA screen and asking for you to type the number?

Well, Google TFA doesn't ask you to type your number (and others only some digits) so it probably would rise a red flag big enough to "awake you" from auto-pilot, I hope.

I assume you're using the type of 2FA where this is not the case. We are discussing the type of 2FA where Google does ask you to enter your number. I.e, TOTP. When I log into Google, it asks me to type my 2FA number in.

Re: The closest I've ever come to falling for a Gmail phishing attack

#85

Post by Tepix »

mike-cardwell wrote: post #34
slazaro wrote: post #19

The only two things that I think could have prevented me from falling for this is: I don't have images loaded by default for unknown senders, and LastPass wouldn't match the domain and therefore wouldn't show the button to autocomplete on the password box. Depending on how observant I'd be at the moment, I might check the URL bar and see something fishy. But I could fall for this, which is worrying.

"I don't have images loaded by default for unknown senders" Does this just prevent the display of images which require fetching from a remote URL, or does it also include images which are embedded in the email as attachments?

It does not prevent this if the image is attached to the mail.

Re: The closest I've ever come to falling for a Gmail phishing attack

#86

Post by timruffles »

IanCal wrote: post #78
timruffles wrote: post #32

I reported this a back in March 2016, and Google said it was not an issue. Analysed whole attack here: https://gist.github.com/timruffles/5c76d2b61c88188e77f6 This was the response I got: > The address bar remains one of the few trusted UI components of the browsers and is the only one that can be relied upon as to what origin are the users currently visiting. If the users pay no attention to the address bar, phishin…

I'd say the data: url part is important, as it lets you construct much more plausible looking contents for the address bar. The standard "check it's google.com" would probably fail for a lot of people. How many people really know that you can put a whole webpage in the URL?

Agreed - I think simply highlighting the data:... part of the URL with a vaguely scary colour would help.

Re: The closest I've ever come to falling for a Gmail phishing attack

#87

Post by das_keyboard »

xja wrote: post #71
willvarfar wrote: post #52

Earlier quoted context omitted.

And stop people emailing screen shots? The best approach I can come up with after five seconds thought is disabling links on non-text elements. And then they go make an anchor that is whitespace over top of a background image... so we'd also need to disable links on large expanses of empty whitespace in text when its embedded in a mail. I should think that can likely be worked around too, however. Got any more ideas?

I was think more of a specific mail scanning process for images that look exactly like UI elements, with some fuzzy match. If it matches, flag it with the usual warnings. It feels like there's at least the potential to explore options.

Why don't just put a little frame around embedded elements like pictures, etc? Maybe with a little icon indicating the type.

Re: The closest I've ever come to falling for a Gmail phishing attack

#88

Post by IanCal »

danielbarla wrote: post #77
IanCal wrote: post #68

Earlier quoted context omitted.

I don't think so, I'm not sure how it could. One of the tweets points out that something like lastpass would help with this as it wouldn't allow you to autofill your password (as it's not on the google the domain), but then you could get it manually from there anyway.

Well, when the attacker attempts to log in via the stolen credentials, they would get the 2FA check, and you would get an SMS. Normally this would alert you to the fact that someone is logging in to your account, and would stop the attacker since they lack the 2FA one time pass. In this case though, since you've already fallen for the "I'm trying to log in to Google again", the attacker will probably fake the 2FA scr…

I was thinking this would be done automatially. You enter username and password, they send to google and get a 2fa request. Show you the same screen and ask for your 2FA pass, which they then send on and they're in.

Someone else mentioned U2F would work though as that's tied to the domain, but I don't really know much about that.

Re: The closest I've ever come to falling for a Gmail phishing attack

#89

Post by midgetjones »

microtonal wrote: post #79
midgetjones wrote: post #74

Earlier quoted context omitted.

That's assuming the attacker could log in with it before it expired, isn't it?

Yes, but as per the standard TOTP codes are valid for a window of 1 minute. TOTP barely protects against phishing. What you want is an U2F key as the second factor. It's not like they are expensive anyway (usually 7-15 Euro) and quite some large services support U2F tokens already (Google, Dropbox, GitHub, Fastmail, etc.).

Thanks!

Is the 1 minute window always the case? In the authenticator app, it seems like codes expire after ~30 seconds. If I wait till the last few seconds before using the code, does that make me any safer?

Re: The closest I've ever come to falling for a Gmail phishing attack

#90

Post by mike-cardwell »

tehabe wrote: post #80

I wonder if the usage of plain-text mails would reduce phishing or increase it?

You mean, if the phishers sent text email instead of html email, would they be less successful? Probably. So why would they?

Are you suggesting that all email/webmail clients stop rendering HTML?

Post reply on HN