Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Google Doc email virus?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 220 posts

Re: Ask HN: Google Doc email virus?

#121

Post by zeeveener »

paulddraper wrote: post #113
ademarre wrote: post #99

I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations…

Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.

The problem, it seems, is that we are increasing the complexity of the "Secure Software" in an attempt to thwart the most sophisticated attacks.

However, as many people are already thinking, Complexity reduces Security and Stability. Therefore, it seems that the more we try to fight the "hackers", the more likely we will add some insecurity which they can exploit.

Re: Ask HN: Google Doc email virus?

#122

Post by kardos »

smudgymcscmudge wrote: post #69
andrewflnr wrote: post #67

Earlier quoted context omitted.

On a brief skim, it doesn't seem to do much besides spread itself. Am I missing something, or was it just for lulz? Or maybe a grey hat trying to prove a point?

That's all this code does, but The author then has a backdoor to all the victim's email through the oauth app.

Except that Google can kill those auths.

Re: Ask HN: Google Doc email virus?

#123

Post by evan_ »

kardos wrote: post #122
smudgymcscmudge wrote: post #69

Earlier quoted context omitted.

That's all this code does, but The author then has a backdoor to all the victim's email through the oauth app.

Except that Google can kill those auths.

It's really a question of how malicious the author was- if they set it up to download everything attached to the account as soon as it connected, it could still cause a lot of damage.

Re: Ask HN: Google Doc email virus?

#124

Post by evan_ »

justusthane wrote: post #101
ben174 wrote: post #42

Earlier quoted context omitted.

Sending everything to this mailinator address which oddly seems to be empty: https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhh... Maybe Mailinator has purged the box and is rejecting mail from it. Good on them.

Please correct me if I'm wrong, but I don't think anything was being sent to that mailinator address. From looking at both that source code and emails received by my users, the mailinator address seems to be only in the message header "to" field, which, AFAIK, doesn't do anything other than display in the mail client. The actual recipient's address is in the envelope recipient field. I don't understand what the purpo…

It sends an email to that mailinator address, with all of the contacts BCC'd. mailinator shut it down very quickly but emails definitely went to that address.

Re: Ask HN: Google Doc email virus?

#126

Post by shif »

ehsankia wrote: post #98
btym wrote: post #81

I love how simple this worm is. They haven't exploited any security holes (other that looking like Docs), it literally just asks for full access to your email address.

Yeah, I read articles calling it sophisticated. This is a super simple and straight forward worm. Disguise yourself as a known app and ask for more permission than you should. IDN exploits [0] and attachment faking [1] are more sophisticated if anything. [0] https://www.wordfence.com/blog/2017/04/chrome-firefox-unicod... [1] http://fortune.com/2017/01/18/google-gmail-scam-phishing/

It's sophisticated because of it's simplicity and effectiveness.

Re: Ask HN: Google Doc email virus?

#128

Post by bo1024 »

paulddraper wrote: post #113
ademarre wrote: post #99

I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations…

Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.

> changing my passwords every 30 days is looking less and less important.

Sidenote: I don't think that was ever a good idea, unless you think you were likely to type your password into phishing sites in the last month.

Re: Ask HN: Google Doc email virus?

#130

Post by [deleted] »

bo1024 wrote: post #128
paulddraper wrote: post #113

Earlier quoted context omitted.

Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.

> changing my passwords every 30 days is looking less and less important. Sidenote: I don't think that was ever a good idea, unless you think you were likely to type your password into phishing sites in the last month.

[deleted]
Post reply on HN