[deleted]
Scammed out of $130K via fake Google call, spoofed Google email and auth sync
461–470 of 677 posts
Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync
#462Earlier quoted context omitted.
I can understand it. Ordinary users were getting locked out of their accounts when losing their phones. Some of those stories hit HN. Don't disable cloud sync unless you have a backup of all your TPTP secret keys. It's dangerous to advise people to disable cloud sync without mentioning backups. Being locked out of thousands of dollars in your crypto account is as damaging as losing that crypto to hackers.
In that case wouldn't you be better off just disabling 2FA? The problem with the cloud sync is that users like the one in the article think they have 2FA but in fact if their Google account is compromised all their accounts using Google Authenticator TOTP second factors are also compromised.
It's the same thing with Apple Passwords.
TOTP isn't that great, you should definitely use a hardware and/or pass key for important and financial services. That said your cloud synced Google Authenticator can be behind a Google account with strong 2FA (i.e. not SMS nor TOTP), then it's mostly fine.
The lesson here is really not to ever share codes you receive by SMS, and preferably disable phone as recovery and second factor.
Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync
#463My best guess is that this attack was purely social engineering, and that no email spoofing actually happened. I think that the email message in question is actually a legit email from Google. I'm not familiar with the formal account takeover process at Google, but my best guess is that the attacker simply requested an account takeover via the official Google process, which triggered this email to be sent by Google l…
Yeah, that part doesn't add up. If the email was sent by the attacker, why did it have a code he needed to give the attacker?
I think the attacker asked him to read an SMS code.
Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync
#464> On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.
This should be the real highlight of the issue here. I always check headers on my Samsung whenever I feel suspicious.
Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync
#465You don't need a spoofed email to steal someone's crypto. Criminals can just hold a gun to your head and demand your keys. It's happened lots of times and it's why traditional banks are way more secure than crypto. Well done to the author for talking about it, but I hope the real lesson is learned that crypto isn't a real store of wealth and can be stolen at any time....
True - but a phone call scales much easier than driving to someone's house with a gun.
Not just scale either. On the phone you're dealing with people having less fear from local repercussions, from reprisal, less care for the community, etc.
Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync
#466Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync
#467My best guess is that this attack was purely social engineering, and that no email spoofing actually happened. I think that the email message in question is actually a legit email from Google. I'm not familiar with the formal account takeover process at Google, but my best guess is that the attacker simply requested an account takeover via the official Google process, which triggered this email to be sent by Google l…
Yeah, that part doesn't add up. If the email was sent by the attacker, why did it have a code he needed to give the attacker?
Yes, at least two emails. One was the spoofed email from legal@google.com (which sadly convinced me this was legit) and the other was a Google recovery code email.
The spoofed email was deleted by the attacker, but I have a copy because I forwarded the email to phishing@google.com (something ChatGPT told me to do). The attacker then deleted the original but when I got my account back an hour later, Google bounced back the email. So that is the copy I have and the headers are not super helpful.
Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync
#468Earlier quoted context omitted.
Yeah, that part doesn't add up. If the email was sent by the attacker, why did it have a code he needed to give the attacker?
Yes, at least two emails. One was the spoofed email from legal@google.com (which sadly convinced me this was legit) and the other was a Google recovery code email. The spoofed email was deleted by the attacker, but I have a copy because I forwarded the email to phishing@google.com (something ChatGPT told me to do). The attacker then deleted the original but when I got my account back an hour later, Google bounced bac…
That makes sense, thanks for the clarification.
Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync
#469Literally got something similar to this last Friday. Sounded legit. My one weird trick that works every time - give me a ticket # and an official phone number to call back to and I can confirm the phone number is legit. This way you can continue the conversation if it is actually legit, and if it's not legit then all good. The guy who called me said "I can send you an email to show it's official" and I thought of tha…
I personally don't even allow them an opportunity to give a "phone number" either. I always ask them to identify their company and the branch that they are with - and then personally go to the official website of the company (i.e. https://amazon.com , etc.) and look up the phone number there. A little less convenient for a LOT more security.
I have the fun of making outbound calls to offer people a public service and collect payment if people desire it. Most people gladly hand over their credit card details. A few years ago, someone wisely asked why they should trust me. (It only happened once in a decade!) I said they don't have to. They could look up our phone number at an easily verifiable government website, then call back; they could call any facility operated by the department; or they could visit any facility. Said individual provided their credit card details right then and there. Virtually noone cares about security.
Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync
#470I'm pretty shocked that Gmail will deliver mail that claims to be from @google.com . Is that really what happened?
I bet the fact it is omitted and "lost", it was probably something like g00gle or googIe.