Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Google Doc email virus?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 220 posts

Re: Ask HN: Google Doc email virus?

#101

Post by justusthane »

ben174 wrote: post #42
sudom82 wrote: post #34

Source code of the worm: https://pastebin.com/raw/EKdKamFq Edit: How I got this: Someone on reddit went to their site when it wasn't down, and downloaded the files linked in the page's HTML. I just posted it here. This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.

Sending everything to this mailinator address which oddly seems to be empty: https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhh... Maybe Mailinator has purged the box and is rejecting mail from it. Good on them.

Please correct me if I'm wrong, but I don't think anything was being sent to that mailinator address.

From looking at both that source code and emails received by my users, the mailinator address seems to be only in the message header "to" field, which, AFAIK, doesn't do anything other than display in the mail client.

The actual recipient's address is in the envelope recipient field.

I don't understand what the purpose of that mailinator address was.

Re: Ask HN: Google Doc email virus?

#102

Post by math0ne »

hemancuso wrote: post #12

It's a pretty nasty one, since it uses their standard OAuth flow with an app "Google Docs" to have users grant full access to their email and contacts. 1. I can't believe Google doesn't have basic filters to disallow developers from registering an app named "Google Docs" 2. Perhaps there should be some more validation/limits associated with allowing apps on the platform that can gain full access to email. A secure em…

I think they do, I got an app shut down because it was named too similar to one of their products, this was just a week ago or so.

Re: Ask HN: Google Doc email virus?

#103

Post by bwackwat »

ademarre wrote: post #99

I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations…

This is the most valuable comment here.

Re: Ask HN: Google Doc email virus?

#104

Post by bitskits »

ghostly_s wrote: post #95
jakob223 wrote: post #9

EDIT: According to a Google representative on the reddit thread, this application is now blocked. If your account was affected, you no longer need to do anything. If you fell for this, changing your password is not the right solution - you want to log into your google account and remove permissions from the application. https://myaccount.google.com/permissions?pli=1 should show a list of apps connected to your accoun…

> If your account was affected, you no longer need to do anything. How do you figure? An unknown actor presumably had full access to your email inbox for a non-zero amount of time and the proper remediation is "nothing"? If I was concerned this had affected me I would right now be changing my passwords to ____everything____.

What attack vector does changing your password help with? Are you concerned they could have recovered the account password via the Oauth scope?

Re: Ask HN: Google Doc email virus?

#105

Post by welder »

mailinatorguy wrote: post #74

Mailinator here: Yes, we sent the inbox to a blackhole but keep in mind, Mailinator does not and can not actually "Send" any email. It's a receive-only service. As always, any email "from" @mailinator.com has had it's reply-to forged (which is pretty trivial). Also - even before we blackholed the email, it's unlikely any email in that inbox (i.e. hhhh..) was read. Each box has a 50 email limit (FIFO) which was immedi…

> Each box has a 50 email limit (FIFO) which was immediately overwhelmed.

That makes me think the malicious author didn't expect this to spread as wide as it did.

Re: Ask HN: Google Doc email virus?

#107

Post by motti »

bitskits wrote: post #104
ghostly_s wrote: post #95

Earlier quoted context omitted.

> If your account was affected, you no longer need to do anything. How do you figure? An unknown actor presumably had full access to your email inbox for a non-zero amount of time and the proper remediation is "nothing"? If I was concerned this had affected me I would right now be changing my passwords to ____everything____.

What attack vector does changing your password help with? Are you concerned they could have recovered the account password via the Oauth scope?

Changing your password is the fastest way to ensure all authed sessions on any device is logged out. Google offers a "log out of any sessions" button somewhere in account settings, but most other services don't.

If your email account is compromised, any service that do password resets via email confirmation, are potentially compromised by whoever has access to your email via OAuth.

Re: Ask HN: Google Doc email virus?

#108

Post by mailinatorguy »

welder wrote: post #105
mailinatorguy wrote: post #74

Mailinator here: Yes, we sent the inbox to a blackhole but keep in mind, Mailinator does not and can not actually "Send" any email. It's a receive-only service. As always, any email "from" @mailinator.com has had it's reply-to forged (which is pretty trivial). Also - even before we blackholed the email, it's unlikely any email in that inbox (i.e. hhhh..) was read. Each box has a 50 email limit (FIFO) which was immedi…

> Each box has a 50 email limit (FIFO) which was immediately overwhelmed. That makes me think the malicious author didn't expect this to spread as wide as it did.

It's my guess that Mailinator is extremely irrelevant to their plan.

They planned to propagate via BCC but they needed a "To:" address - preferably one that didn't bounce.

So they hit the "h" key awhile, then added @mailinator.com

Re: Ask HN: Google Doc email virus?

#109

Post by hulahoof »

garyfirestorm wrote: post #64

This happened to me. An unknown person from my organization shared a Google doc. I didn't open it, and replied by saying 'what is this about?'. He said he didn't send any gdocs :|

It sounds so simple, but the msn messenger era taught me to always follow up on a shared file for this reason (address book worms were a minor scourge in my circles at the time).
Post reply on HN