LOL One of the phishing examples is a page hosted on Google AMP Cache.
”This one is a little tricky”. No, it's a complete security trainwreck that Google have opted into for no good reason.
Google Phishing Quiz
61–70 of 103 posts
Re: Google Phishing Quiz
#62It says PDF is a potential attack vector. Have there been any attacks on Preview.app, since it became sandboxed?
We'll thankfully they gave us the actionable advice to ”be careful”. What does that even mean?
Re: Google Phishing Quiz
#63While the domain is a legit Google domain, I find it ironic that it’s hosted on “withgoogle.com”. If my parents followed my anti-phishing tips they would fail by clicking this link.
It's because google.com contains very valuable cookies which could be leaked if there was an XSS or something anywhere on the google.com domain.
Thats why things like this (which are often developed by third party contractors, and might not go through the same level of review), are hosted on another domain.
It's a flaw in the web though. A domain should have the ability to host content without that content gaining full control over the secrets/cookies of the hosting domain.
Re: Google Phishing Quiz
#64Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now
Yeah, that's the only reason I got a question 'wrong'. Sorry, but no third party app is getting access to my email for obvious security reasons. Doesn't matter how 'legit' the company is or what not.
This sounds conceptually right and I would definitely agree with it... if I haven't given multiple sites access to my email over the years.
Anything that interacts with your email is going to need it, and if you're signing up for that service odds are you know (or at least assume) it'll need some kind of access to your email. For example, I used unroll.me for years, which gives you a singular interface to block spam and fake subscriptions -- for these kinds of emails, there's often no (working) unsubscribe link. Unroll.me works by looking at each incoming email and, if it's from someone you've blocked, automatically deletes the email.
Similarly, it has other services that operate on emails you receive, like bundling up multiple emails into one (which, on the backend, deletes thoseincoming emails and concatenates them into a singular email with them all later).
It's easy to say "i'll never give a third party app access to my email", but for most people it comes down to the age old problem of trading data for services/conveniences that you find valuable.
Side-note: There've been many rumors over the years that Unroll.me sells information about the emails it scans. I think it's even more telling of the "trade data for service" paradigm that people continue to use the service even after finding out.
Re: Google Phishing Quiz
#65I wanted to point out one of the phishing schemes used a google amp link to disguise a URL as being from google..... sigh
My bet is on this site being developed by a google security team to try to embarrass other teams around google to get their act together and close flaws like this.
The concept of AMP for example should have been built into browsers, perhaps as a new protocol, for example:
Then the browser can go to any amp-provider to retrieve the amp page, which will be signed by the origin that it came from so the browser can still validate the amp-provider hasn't tampered anything. That model would also let any company be an amp provider with no trust required.
The benefit of AMP is much reduced with QUIC zero-rtt resume anyway.
Re: Google Phishing Quiz
#66I missed two: the "allow some random person to read your email" which I would never click on, and the one that had a PDF, even though they don't allow you to do anything with it. Just because someone sends you a PDF doesn't mean it's an attack vector. It would have been more helpful to say something like "this is someone you do business with as well, or someone you've never heard of." (which I find to be more useful…
And that's the rub: knowing what's phishing depends on who you are. Receiving a PDF with financial data has a completely different probability of being an attack if you know who the sender is and were expecting them to send such a file today. Also, assuming that a message is phishing is usually not harmful in any way. If I got an email from dropbox.com (and were a Dropbox customer), I'd ignore the email, and just typ…
PDF's especially are pretty low risk. They normally open with the in-chrome PDF viewer, which is sandboxed pretty much as well as web pages, so you would need two zero day exploits (since chrome generally auto-updates within a few days of an axploit being published) in addition to tricking them into opening the PDF to get into someones device.
Re: Google Phishing Quiz
#67I wanted to point out one of the phishing schemes used a google amp link to disguise a URL as being from google..... sigh
My bet is on this site being developed by a google security team to try to embarrass other teams around google to get their act together and close flaws like this. The concept of AMP for example should have been built into browsers, perhaps as a new protocol, for example: amp: https://newyorktimes.com Then the browser can go to any amp-provider to retrieve the amp page, which will be signed by the origin that it came…
Or just `amp://nytimes.com`, would make more sense even if it's being sent over https.
Re: Google Phishing Quiz
#68Earlier quoted context omitted.
Yeah, that's the only reason I got a question 'wrong'. Sorry, but no third party app is getting access to my email for obvious security reasons. Doesn't matter how 'legit' the company is or what not.
I've used TripIt. Reading your email is central to their "magic." The idea is that whenever you get any sort of travel confirmation, they automatically ingest it and compile all the info into trips, then handle stuff like reminding you to checkin, auto-filling up your checkin code, suggesting seats, etc. They also have an alternative for the privacy-minded where you just forward any confirmation emails you want them…
My workaround for this is to set up a dummy email address that I use for all travel. That email address then forwards the emails to both plans@tripit.com and my personal email address.
Re: Google Phishing Quiz
#69Earlier quoted context omitted.
I suppose it might make sense if you were installing a 3rd party gmail application on your desktop. I'm no oauth expert, but I would imagine an app would go through a flow like this.
I believe you can connect gmail to your local email client using IMAP/POP3, but I don't think that uses the oauth flow to do that (you just type in the password). I've never used any other kind of 3rd party gmail apps though.
Apple Mail uses that dialog.
Re: Google Phishing Quiz
#70I missed the one with the PDF attachment, for multiple reasons:
* To my knowledge, there are no extant PDF-based viruses that would affect me (on either Linux or OpenBSD), and just because something's infected with malware doesn't mean it's a phishing attempt (it could be that it's a legitimate email from a sender whose computer is infected with some malware that spreads itself through PDFs).
* The PDF is actually attached, so if this were a real email it would pop up in Gmail's built-in attachment viewer (and any errors occurring there would be more cause for alarm).
* Not all schools use .edu domains at all, let alone exclusively.
All things considered, the question's wrong. It's not conclusively a phishing attempt. It might be some other kind of malicious email, but phishing emails are a subset of malicious emails, not the other way around (just like how all carrots are vegetables but not all vegetables are carrots).