This isn't a 2 factor attack. It's a social engineering Google account password reset attack. The attacking party is resetting your Google password and asking you to provide the code Google sends your registered mobile number via text to them.
Be warned, there's a nasty Google 2 factor auth attack going around
11–20 of 61 posts
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#12I wonder if this is at all related to a phishing attempt that just got my mom and all her friends. It came in as a "docusign" email that looked reasonably legit (to an ordinary person) that just had one button to sign and review a document. Apparently they asked for email, email password, and phone number. I was surprised to learn about the phone number bit and how they'd use it. Something like this is probably how.…
I just saw one of those. It's especially convincing when they target realtors' address books, because everyone in a real estate transaction is expecting a bunch of docusign links to be flying around from their realtor and their title company. So if something doesn't look kosher, they attribute it to a clunky process and hand over their login.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#13Earlier quoted context omitted.
Again, this is a social engineering attack. 2-factor remains mathematically secure.
It doesn't sound like "2-factor" if all they need is the single code on your phone.
Account recovery is always a nagging weak spot. At some point, a user will forgot their password or lose their TFA device, and now you need them to be able to prove their identity outside of the usual flow. And if you have enough users, this has to be automated, leaving even more room for exploitation.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#14Earlier quoted context omitted.
Again, this is a social engineering attack. 2-factor remains mathematically secure.
It doesn't sound like "2-factor" if all they need is the single code on your phone.
I'd say it is two factor (googles implementation, the attack is classical social engineering): something you know (the password) and something you have (access to your phone).
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#15Earlier quoted context omitted.
It doesn't sound like "2-factor" if all they need is the single code on your phone.
I'd say it is two factor (googles implementation, the attack is classical social engineering): something you know (the password) and something you have (access to your phone).
In Google's implementation, only the "something you have" is really necessary for access. If you have the phone but not the password, you can just issue a password reset, which is confirmed via the phone, so the password doesn't function as a second factor independent of the phone.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#16A friend is currently receiving spear phishing attempts via text. Claims their lost iPhone has been found and that they need to log into icloud10 . com
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#17I wonder if this is at all related to a phishing attempt that just got my mom and all her friends. It came in as a "docusign" email that looked reasonably legit (to an ordinary person) that just had one button to sign and review a document. Apparently they asked for email, email password, and phone number. I was surprised to learn about the phone number bit and how they'd use it. Something like this is probably how.…
I just saw one of those. It's especially convincing when they target realtors' address books, because everyone in a real estate transaction is expecting a bunch of docusign links to be flying around from their realtor and their title company. So if something doesn't look kosher, they attribute it to a clunky process and hand over their login.
This is exactly how my parents were phished. Interesting to hear it likely wasn't a coincidence that it came from their realtor.
I subsequently set them up with two factor almost everywhere, but I'd give at least even odds they'd fall for this, too. Sigh.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#18Earlier quoted context omitted.
It doesn't sound like "2-factor" if all they need is the single code on your phone.
Account recovery is always a nagging weak spot. At some point, a user will forgot their password or lose their TFA device, and now you need them to be able to prove their identity outside of the usual flow. And if you have enough users, this has to be automated, leaving even more room for exploitation.
> And if you have enough users, this has to be automated
Not really, they could just charge people $100 to retrieve a lost password and then do it manually.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#19Earlier quoted context omitted.
Account recovery is always a nagging weak spot. At some point, a user will forgot their password or lose their TFA device, and now you need them to be able to prove their identity outside of the usual flow. And if you have enough users, this has to be automated, leaving even more room for exploitation.
> And if you have enough users, this has to be automated Not really, they could just charge people $100 to retrieve a lost password and then do it manually.
That is a PR nightmare...
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#20Earlier quoted context omitted.
Account recovery is always a nagging weak spot. At some point, a user will forgot their password or lose their TFA device, and now you need them to be able to prove their identity outside of the usual flow. And if you have enough users, this has to be automated, leaving even more room for exploitation.
> And if you have enough users, this has to be automated Not really, they could just charge people $100 to retrieve a lost password and then do it manually.
And in the real world, no one would use that service. You aren't wrong though, that would be the way to do it if you wanted it to be secure.