[deleted]
Ask HN: Google Doc email virus?
61–70 of 220 posts
Re: Ask HN: Google Doc email virus?
#62Re: Ask HN: Google Doc email virus?
#63Source code of the worm: https://pastebin.com/raw/EKdKamFq Edit: How I got this: Someone on reddit went to their site when it wasn't down, and downloaded the files linked in the page's HTML. I just posted it here. This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.
I like how the code has Javadoc comments, in case other developers need to maintain the worm or use its public API.
Re: Ask HN: Google Doc email virus?
#64This happened to me. An unknown person from my organization shared a Google doc. I didn't open it, and replied by saying 'what is this about?'. He said he didn't send any gdocs :|
Re: Ask HN: Google Doc email virus?
#65Any clues what this was trying to do? I suppose we have to wait for Google to publicise what went on once OAuth had been granted.
Re: Ask HN: Google Doc email virus?
#66Any clues what this was trying to do? I suppose we have to wait for Google to publicise what went on once OAuth had been granted.
My guess spreading + password resets + searching for files that can be downloaded/later used for crypto blackmail?
I think we are going to see some of the worst large scale ransom attempts shortly. They also timed it perfectly afternoon on hump day when everyone in USA is just getting ready for / back from lunch.
Re: Ask HN: Google Doc email virus?
#67EDIT: According to a Google representative on the reddit thread, this application is now blocked. If your account was affected, you no longer need to do anything. If you fell for this, changing your password is not the right solution - you want to log into your google account and remove permissions from the application. https://myaccount.google.com/permissions?pli=1 should show a list of apps connected to your accoun…
Source code of the worm: https://hastebin.com/gubegaqusi.xml Pretty much what you'd expect. Edit: This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.
On a brief skim, it doesn't seem to do much besides spread itself. Am I missing something, or was it just for lulz? Or maybe a grey hat trying to prove a point?
Re: Ask HN: Google Doc email virus?
#68Considering how easy it would be to filter this out, why has Google allowed it to continue spreading within their own email network? Obviously they have no control over what goes on outside of Gmail/G Suite, but inside their own network, they should be able to setup a basic filter to stop anything TO: hhhhhhh@mailinator or whatever it is. I received this email (but did not click the link) in my Gmail account from ano…
It was shut down within 30 minutes.
Re: Ask HN: Google Doc email virus?
#69Earlier quoted context omitted.
Source code of the worm: https://hastebin.com/gubegaqusi.xml Pretty much what you'd expect. Edit: This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.
On a brief skim, it doesn't seem to do much besides spread itself. Am I missing something, or was it just for lulz? Or maybe a grey hat trying to prove a point?
That's all this code does, but The author then has a backdoor to all the victim's email through the oauth app.
Re: Ask HN: Google Doc email virus?
#70Considering how easy it would be to filter this out, why has Google allowed it to continue spreading within their own email network? Obviously they have no control over what goes on outside of Gmail/G Suite, but inside their own network, they should be able to setup a basic filter to stop anything TO: hhhhhhh@mailinator or whatever it is. I received this email (but did not click the link) in my Gmail account from ano…
It was shut down within 30 minutes.
No it was more like hours from when I reported it and when the app was finally blocked.