Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Google Doc email virus?

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 220 posts

Re: Ask HN: Google Doc email virus?

#131

Post by throwaway847345 »

paulddraper wrote: post #113
ademarre wrote: post #99

I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations…

Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.

Passwords for authentication was just always a flawed idea, typing them into the DOM and sending them over the wire even more so.

Re: Ask HN: Google Doc email virus?

#132

Post by shmed »

evan_ wrote: post #123
kardos wrote: post #122

Earlier quoted context omitted.

Except that Google can kill those auths.

It's really a question of how malicious the author was- if they set it up to download everything attached to the account as soon as it connected, it could still cause a lot of damage.

Even worst: The hacker could have taken a list of lets say the top 1000 banking (or any type of online service) websites accross the globe. The moment the hacker get access to your gmail account, he initiatite a password recovery request on each of those 1000 websites, get the password reset link from the email, reset the password, delete the email. he could now have access to any other online account you have that had its recovery email set to your gmail account.

Re: Ask HN: Google Doc email virus?

#133

Post by [deleted] »

_pergosausage wrote: post #117
ghostly_s wrote: post #95

Earlier quoted context omitted.

> If your account was affected, you no longer need to do anything. How do you figure? An unknown actor presumably had full access to your email inbox for a non-zero amount of time and the proper remediation is "nothing"? If I was concerned this had affected me I would right now be changing my passwords to ____everything____.

After looking at the source code, it looks like all it does is send a copy of itself to somebody in your inbox, and nothing else.

[deleted]

Re: Ask HN: Google Doc email virus?

#134

Post by shmed »

_pergosausage wrote: post #117
ghostly_s wrote: post #95

Earlier quoted context omitted.

> If your account was affected, you no longer need to do anything. How do you figure? An unknown actor presumably had full access to your email inbox for a non-zero amount of time and the proper remediation is "nothing"? If I was concerned this had affected me I would right now be changing my passwords to ____everything____.

After looking at the source code, it looks like all it does is send a copy of itself to somebody in your inbox, and nothing else.

We dont really have any proof that this is the only code that got executed. Whoever owned the OAuth account had direct access to your information from google's servers, he wouldnt need to go through you as a client to get it.

Re: Ask HN: Google Doc email virus?

#135

Post by shmed »

ehsankia wrote: post #98
btym wrote: post #81

I love how simple this worm is. They haven't exploited any security holes (other that looking like Docs), it literally just asks for full access to your email address.

Yeah, I read articles calling it sophisticated. This is a super simple and straight forward worm. Disguise yourself as a known app and ask for more permission than you should. IDN exploits [0] and attachment faking [1] are more sophisticated if anything. [0] https://www.wordfence.com/blog/2017/04/chrome-firefox-unicod... [1] http://fortune.com/2017/01/18/google-gmail-scam-phishing/

Its sophisticated in the sense that it makes you trust them and willingly share your information with them. It doesn't rely on some brute force method or some complicated hacking method, it simply rely on a modern workflow that people are used to go through without thinking twice about it. It is simple and incredibly efficient.

Re: Ask HN: Google Doc email virus?

#136

Post by BadassFractal »

sudom82 wrote: post #35
jakob223 wrote: post #9

EDIT: According to a Google representative on the reddit thread, this application is now blocked. If your account was affected, you no longer need to do anything. If you fell for this, changing your password is not the right solution - you want to log into your google account and remove permissions from the application. https://myaccount.google.com/permissions?pli=1 should show a list of apps connected to your accoun…

Source code of the worm: https://hastebin.com/gubegaqusi.xml Pretty much what you'd expect. Edit: This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.

What context was that code expected to be executed in?

Re: Ask HN: Google Doc email virus?

#137

Post by xahrepap »

throwaway847345 wrote: post #131
paulddraper wrote: post #113

Earlier quoted context omitted.

Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.

Passwords for authentication was just always a flawed idea, typing them into the DOM and sending them over the wire even more so.

I agree. However I have yet to see a better alternative. Are there any out there?

Re: Ask HN: Google Doc email virus?

#138

Post by paulddraper »

bo1024 wrote: post #128
paulddraper wrote: post #113

Earlier quoted context omitted.

Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.

> changing my passwords every 30 days is looking less and less important. Sidenote: I don't think that was ever a good idea, unless you think you were likely to type your password into phishing sites in the last month.

Sadly, PCI compliance requirements believe otherwise :(

Re: Ask HN: Google Doc email virus?

#139

Post by paulddraper »

xahrepap wrote: post #137
throwaway847345 wrote: post #131

Earlier quoted context omitted.

Passwords for authentication was just always a flawed idea, typing them into the DOM and sending them over the wire even more so.

I agree. However I have yet to see a better alternative. Are there any out there?

Basic auth doesn't use the DOM.

Re: Ask HN: Google Doc email virus?

#140

Post by selfhatinmarxst »

xahrepap wrote: post #137
throwaway847345 wrote: post #131

Earlier quoted context omitted.

Passwords for authentication was just always a flawed idea, typing them into the DOM and sending them over the wire even more so.

I agree. However I have yet to see a better alternative. Are there any out there?

certificates
Post reply on HN