Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

bewildered.substack.com

Post reply on HN
Print view View original

361–370 of 677 posts

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#361

Post by davidscoville »

ratorx wrote: post #353

I’m struggling to understand the chain of events, because the story starts midway. Is the claim that JUST the 2FA code was enough to pwn everything with no other vulnerabilities? If that’s the case, then that’s a way bigger problem. Or (given the password database link at the end), is the sequence: 1) various logins are pwned (Google leak or just other logins, but using gmail as the email - if just other things, then…

I think the attacker had my password, and they just needed a recovery method, which was the code I read over the phone.

I have no idea how they had my password, I never share passwords or use the same password. But I hadn’t changed my Google password in a while.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#362

Post by commandersaki »

UncleMeat wrote: post #183
____tom____ wrote: post #163

> Note: if you’re a developer and your users have gmail accounts, an authenticator code is NOT a 2nd factor, if that user is using Google Authenticator. So many people and developers do not understand two factor authentication. If the necessary information is automatically sync'd to another device, you likely don't have two factor auth. Example: If you log in from a Macbook, and the second auth is sent to your phone,…

There’s threats and there are threats. Second factors largely exist to prevent password stuffing from password reuse. Even if the second factor is the same device as the device where you are initiating a login this works just fine. If your goal is to stay safe even after one of your devices is owned then you’ve got a rarer (and way more difficult) threat model.

How did this user Coinbase account get hacked anyways? Did they reuse passwords? Did the attacker even have passwords?

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#363

Post by beeflet »

adrr wrote: post #187
bdangubic wrote: post #51

Earlier quoted context omitted.

the banks don’t give two shits about it :)

Banks do care because they are on the hook. If someone commits identity theft and steals money from the bank via your account, its on them.

There is no such thing as identity theft. That is a term made up by banks to pass the blame for their insecure means of authentication.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#364

Post by ratorx »

pluc wrote: post #359
ratorx wrote: post #353

I’m struggling to understand the chain of events, because the story starts midway. Is the claim that JUST the 2FA code was enough to pwn everything with no other vulnerabilities? If that’s the case, then that’s a way bigger problem. Or (given the password database link at the end), is the sequence: 1) various logins are pwned (Google leak or just other logins, but using gmail as the email - if just other things, then…

Passwords don't matter if you have access to the inbox and 2fa codes, you can just reset passwords.

But if you get access to the inbox, then you have a compromised device or the password via some other means right?

Inbox access is a fairly big compromise, even without the 2FA codes.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#365

Post by Waterluvian »

dec0dedab0de wrote: post #306
klik99 wrote: post #301

Literally got something similar to this last Friday. Sounded legit. My one weird trick that works every time - give me a ticket # and an official phone number to call back to and I can confirm the phone number is legit. This way you can continue the conversation if it is actually legit, and if it's not legit then all good. The guy who called me said "I can send you an email to show it's official" and I thought of tha…

Be careful with checking official numbers too, or at least tell any non-tech friends. Fake numbers have been ending up in search results on official looking websites. It's a real knife fight out there.

I find that when it’s legit a consistent thing happens, which smells of careful training: they instruct me to call the number on the back of the card, or on a bill.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#366

Post by commandersaki »

davidscoville wrote: post #100
avree wrote: post #80

Earlier quoted context omitted.

This isn't something "auth engineers" can control, there's no magic Google Authenticator flag on a 2fa code - it's all HMAC and numbers, you don't know if the code came from Authy, Google Auth, a homebrew code generator, a dongle, etc.

Exactly. Google created vulnerabilities for the whole industry by introducing cloud synced Authenticator codes.

Similarly the SSO sign in, which I think is much worse. Though arguably Coinbase is at fault for that one.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#367

Post by acdha »

blindriver wrote: post #294
acdha wrote: post #235

Earlier quoted context omitted.

That's a very harsh position to take and one I struggle to find support for in the post. I hope that you are never in the position where you make a mistake and others apply that standard to your response.

It’s weird that you think blaming other people for your own self-admitted mistakes is acceptable.

Good thing neither I nor the author did that, then.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#368

Post by twostorytower »

edm0nd wrote: post #292
fkskammerz wrote: post #46

Earlier quoted context omitted.

It was not legit from legal, I had the same attack on me two weeks ago. They were pretending to be from Google General Counsel responding to an estate request to my Google account being handed to another party who was supposedly the inheritor. What clued me in was that he said he couldnt share the estate documents with me until I gave him my popup 2FA code.

It was legit from Google email and servers. You cannot spoof an email from @google that will inbox

They clearly did.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#369

Post by bdangubic »

ratorx wrote: post #364
pluc wrote: post #359

Earlier quoted context omitted.

Passwords don't matter if you have access to the inbox and 2fa codes, you can just reset passwords.

But if you get access to the inbox, then you have a compromised device or the password via some other means right? Inbox access is a fairly big compromise, even without the 2FA codes.

Inbox is the biggest compromise of them all IMO. I realized this a decade ago and use a different email for every account that I have. None of them have anything to do with my name in any way, I use 4 random words to create new email for any new account that I need. Accidental takeover of any one account does not lead to total take over of my life :)

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#370

Post by beeflet »

madaxe_again wrote: post #180
atm3ga wrote: post #78

Earlier quoted context omitted.

I split my crypto assets between Coinbase and what is now a corrupted hard-drive I've yet to recover.

I keep mine on a broken raid 5 array (seagate flood drives - two failed within hours of each other) in a shoe box. It’s super secure.

RAID is cool but It's not much of a backup then if it's always plugged into a running computer. Half of risk comes from some process "intentionally" the erasing the data.

I use the super-sophisticated method of manually copying everything important to an external storage another every 5 weeks or so. That has never failed me.

Post reply on HN