edit: accidentally double posted
double edit: 1. replied in above comment. 2. dunno. first time using HN, accidentally submitted twice when I was on comment posting cooldown I guess.
Ask HN: Google Doc email virus?
51–60 of 220 posts
Re: Ask HN: Google Doc email virus?
#52Links of interest: https://www.google.com/appsstatus#hl=en&v=issue&sid=4&iid=c7... https://www.reddit.com/r/google/comments/692cr4/new_google_d... https://www.theverge.com/2017/5/3/15534768/google-docs-phish...
From the reddit link it looks like Google has fixed it:
> Googler here -- I'm escalating to the correct engineering and product teams now.
> Edit: This is now resolved. Less than a half-hour after escalation, wow! =)
> Final edit: problem is resolved. I clicked the link and got an "oauth client disabled" message. Not pretty, but at least you won't get phished.
Re: Ask HN: Google Doc email virus?
#53Source code of the worm: https://pastebin.com/raw/EKdKamFq Edit: How I got this: Someone on reddit went to their site when it wasn't down, and downloaded the files linked in the page's HTML. I just posted it here. This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.
They even used Google analytics! UA-98290545-1
Re: Ask HN: Google Doc email virus?
#54The only tricky thing is not seeing these weird permissions. Google may block naming an app "Google Docs" but someone could always trick it with "Google Docs." or whatever
Re: Ask HN: Google Doc email virus?
#55[deleted]
Re: Ask HN: Google Doc email virus?
#56edit: accidentally double posted double edit: 1. replied in above comment. 2. dunno. first time using HN, accidentally submitted twice when I was on comment posting cooldown I guess.
1. where did you get this
2. why did you post the link in 3 separate comments
Re: Ask HN: Google Doc email virus?
#57We wrote a guide for google suite admins on how to lock down their domain. Oauth and phishing are major threats and google could do much more here https://medium.com/@longtermsec/more-tips-for-securing-your-...
Re: Ask HN: Google Doc email virus?
#58Its a malicious OAuth client (multiple clients?) that calls itself "Google Docs" and fooled user into giving access to read emails, while pretending to show as if it was needed by GDocs itself to access a Document, enabling launch of among other things password resets on other websites.
the root problem seems to be that the identity of OAuth Servers is not authenticated/clearly shown, i.e. a malicious app can claim that its name is Google Docs even though it is not endorsed by Google.
IMPORTANT NOTE: If you are running any website that has "Reset my password" it might be used by attacker, since even though the attacker does not have access to password, the attacker had access to email inbox. Thus the email password reset flow will allow attacker to compromise other websites that rely on Gmail account for password resets.
https://twitter.com/zachlatta/status/859843151757955072?ref_...
https://www.dropbox.com/s/l024nggmcizub40/Screenshot%202017-...
Re: Ask HN: Google Doc email virus?
#59Considering how easy it would be to filter this out, why has Google allowed it to continue spreading within their own email network? Obviously they have no control over what goes on outside of Gmail/G Suite, but inside their own network, they should be able to setup a basic filter to stop anything TO: hhhhhhh@mailinator or whatever it is. I received this email (but did not click the link) in my Gmail account from another Gmail user, so it never left the Google network. From the reports here it looks like it is still spreading even though Google disabled the app.
With all of Google's machine learning expertise, how is it that this got past all of their SPAM detectors? It took me 2 seconds to hover over the link and see it was a crazy link that ended up at a domain called google.pro. Really? One of the world's largest and most advanced email systems couldn't figure that out?
Re: Ask HN: Google Doc email virus?
#60Earlier quoted context omitted.
Source code of the worm: https://hastebin.com/gubegaqusi.xml Pretty much what you'd expect. Edit: This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.
Heh, they're using Google Analytics to track its spread. That's a nice touch.
It's possible to send any data we want to their Analytics tracker... perhaps we send them some spam?