191–200 of 220 posts
Links of interest: https://www.google.com/appsstatus#hl=en&v=issue&sid=4&iid=c7... https://www.reddit.com/r/google/comments/692cr4/new_google_d... https://www.theverge.com/2017/5/3/15534768/google-docs-phish...
From the reddit link it looks like Google has fixed it: > Googler here -- I'm escalating to the correct engineering and product teams now. > Edit: This is now resolved. Less than a half-hour after escalation, wow! =) > Final edit: problem is resolved. I clicked the link and got an "oauth client disabled" message. Not pretty, but at least you won't get phished.
It's a pretty nasty one, since it uses their standard OAuth flow with an app "Google Docs" to have users grant full access to their email and contacts. 1. I can't believe Google doesn't have basic filters to disallow developers from registering an app named "Google Docs" 2. Perhaps there should be some more validation/limits associated with allowing apps on the platform that can gain full access to email. A secure em…
Believe! I think this is just one of the many cases where after the fact everyone is like "oh wow, how didn't they think about it". But that doesn't say you would have thought about this before reading this.
Earlier quoted context omitted.
Yeah, I read articles calling it sophisticated. This is a super simple and straight forward worm. Disguise yourself as a known app and ask for more permission than you should. IDN exploits [0] and attachment faking [1] are more sophisticated if anything. [0] https://www.wordfence.com/blog/2017/04/chrome-firefox-unicod... [1] http://fortune.com/2017/01/18/google-gmail-scam-phishing/
It's sophisticated because of it's simplicity and effectiveness.
Earlier quoted context omitted.
The problem, it seems, is that we are increasing the complexity of the "Secure Software" in an attempt to thwart the most sophisticated attacks. However, as many people are already thinking, Complexity reduces Security and Stability. Therefore, it seems that the more we try to fight the "hackers", the more likely we will add some insecurity which they can exploit.
Complexity doesn't reduce security. Complexity can both improve and reduce security depending on specifics, and thus generalizes to "no correlation" demonstrating that generalizations are often misleading.
Earlier quoted context omitted.
Then oauth based attacks like this come along and your password (however strong it may be) and two-factor auth are bypassed completely... It's interesting Apple can scale personally vetting apps for the app store but Google apparently can't be bothered to do the same for apps that could actually ruin businesses and lives with the data they could scoop up
It is not quite a virus, it works more akin to a trojan and exploits people not thinking about what they're clicking. In 10s, why would Google docs ask for an oAuth prompt with big permissions? People click through security dialogs, it is a known fact.
(Of course, this is a different situation and all, and there is a lot of sense in your comment that mine doesn't at all invalidate.)
Earlier quoted context omitted.
This was particularly effective because the app was registered as "Google Docs" - to not even filter names of your own products out seems ripe picking for imposter apps.
I've seen this point and agree with it, but I really have to wonder: if the app was just called "Documents" or "My Docs" and had a professional-looking icon, would a significant number of people really have given it a second look anyway?
Mailinator here: Yes, we sent the inbox to a blackhole but keep in mind, Mailinator does not and can not actually "Send" any email. It's a receive-only service. As always, any email "from" @mailinator.com has had it's reply-to forged (which is pretty trivial). Also - even before we blackholed the email, it's unlikely any email in that inbox (i.e. hhhh..) was read. Each box has a 50 email limit (FIFO) which was immedi…
> it's unlikely any email in that inbox (i.e. hhhh..) was read. Any way you can tell for sure? Do you have any logs that could be used to graph the spread of this? E.g. if you were able to find the earliest email to that mailbox you should be able to tell when it started, and with who.
Earlier quoted context omitted.
I've seen this point and agree with it, but I really have to wonder: if the app was just called "Documents" or "My Docs" and had a professional-looking icon, would a significant number of people really have given it a second look anyway?
It was "Google Docs"
Earlier quoted context omitted.
I like how the code has Javadoc comments, in case other developers need to maintain the worm or use its public API.
That's gotta be a copy-paste job. If someone was actually cheeky enough to comment their malware they would've left jokes, puns, etc.