Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

bewildered.substack.com

Post reply on HN
Print view View original

91–100 of 677 posts

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#91

Post by fkskammerz »

crawftv wrote: post #60
barbazoo wrote: post #13

> Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly. I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know. > The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-sy…

The biggest red flag in all these stories is getting a call from a customer support person trying to help you. When it seems like it’s impossible to get ahold of them in a real emergency.

It doesnt seem to be a red-flag. The caller was calling as an Attorney from Google General Counsel responding to an estate request. They followed up with a spoofed @google.com email with their name corroborating the call.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#92

Post by general1465 »

atm3ga wrote: post #77
barbazoo wrote: post #13

> Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly. I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know. > The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-sy…

I've set my phone to not answer unknown callers (those not in my address list) and more importantly, I've done this for my parents as well and further instruct them as often as possible to not believe anything they get in email. With all of this, my mom still will reach out at least once or twice a year in a panic about some scam email she thinks is real.

Well easy to say, but if you are working in the real world, then unknown callers may be important - i.e. FedEx trying to push your package through the customs and if they can not contact you, your package goes either back or is destroyed.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#93

Post by thrill »

davidscoville wrote: post #75
rwmj wrote: post #10

Does anyone know how the email from (or appearing to be from) @google.com works? Wouldn't the Apple account reject it because it fails DKIM/etc?

I’ve heard scammers use Google tools like Google forms or Google cloud to send out fraudulent emails that appear like they come from Google.

The latest attempted scams I’m getting on my gmail account are fake postmaster bounces “from” google.com.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#94

Post by jgilias »

wcoenen wrote: post #88

Thanks for sharing. I already had it in the back of my mind that this cloud sync thing in Google Authenticator was not very secure. I'm getting rid of it right now. I do see why Google did it; it's going to be difficult to educate users to always set up 2FA both on a primary and a backup device. Much easier and convenient to automatically sync different devices. But your story makes it obvious that something isn't qu…

Authy has solved this though. The cloud sync is opt-in, and encrypted with a password. This makes it immensely more involved to compromise.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#95

Post by wmf »

fn-mote wrote: post #82
bdangubic wrote: post #51

Earlier quoted context omitted.

the banks don’t give two shits about it :)

The difference is that you have leverage to force the banks to care. There isn't any federal regulation at all covering your Bitcoin.

Bitcoin exchanges like Coinbase are regulated by the CFTC in the US. This case is more of a Google problem though.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#96

Post by blevinstein »

I avoided this exact scam. The most important thing is to never trust an incoming phone number. If they can't give you a publicly posted phone number that you can call inbound, they are a scammer.

Google has dozens of properties and it is easy to generate an email from one of them that seems to confirm the attacker's identity. Never trust any of these to identify a legitimate representative.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#97

Post by wmf »

avree wrote: post #80
davidscoville wrote: post #74

Earlier quoted context omitted.

I believe they logged into coinbase with Google SSO. And then they used my Google Authenticator codes which were cloud synced as the second factor auth method. A warning to auth engineers: if an account is using a Gmail address, then auth codes from Google Authenticator should not be considered a second factor.

This isn't something "auth engineers" can control, there's no magic Google Authenticator flag on a 2fa code - it's all HMAC and numbers, you don't know if the code came from Authy, Google Auth, a homebrew code generator, a dongle, etc.

It sounds like we're back to physical Yubikeys as the only secure auth.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#99

Post by sega_sai »

I always read these stories and worry that I will fall for something like this at some point. With all the complexity around authentication, 2FA, backup codes, text messages, cloud-sync, pass keys etc, I find it impossible to be confident that you won't be phished/spoofed/hacked.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#100

Post by davidscoville »

avree wrote: post #80
davidscoville wrote: post #74

Earlier quoted context omitted.

I believe they logged into coinbase with Google SSO. And then they used my Google Authenticator codes which were cloud synced as the second factor auth method. A warning to auth engineers: if an account is using a Gmail address, then auth codes from Google Authenticator should not be considered a second factor.

This isn't something "auth engineers" can control, there's no magic Google Authenticator flag on a 2fa code - it's all HMAC and numbers, you don't know if the code came from Authy, Google Auth, a homebrew code generator, a dongle, etc.

Exactly. Google created vulnerabilities for the whole industry by introducing cloud synced Authenticator codes.
Post reply on HN