Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

101–110 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#101

Post by feld »

Jarwain wrote: post #73
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices. ^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used…

This is the most unintuitive approach to 2FA I've ever seen

Re: The closest I've ever come to falling for a Gmail phishing attack

#102

Post by swiley »

willvarfar wrote: post #52
xja wrote: post #35

Earlier quoted context omitted.

That's a real shame. There are certainly things they could do to prevent images looking quite so similar to UI elements.

And stop people emailing screen shots? The best approach I can come up with after five seconds thought is disabling links on non-text elements. And then they go make an anchor that is whitespace over top of a background image... so we'd also need to disable links on large expanses of empty whitespace in text when its embedded in a mail. I should think that can likely be worked around too, however. Got any more ideas?

Far better would be to not render HTML emails at all. They're an abomination and have always been causing security problems of different kinds.

Re: The closest I've ever come to falling for a Gmail phishing attack

#103

Post by gearhart »

xja wrote: post #82
tdkl wrote: post #62

Earlier quoted context omitted.

Yeah, more people needs to get scammed, then the media will advertise how it happened and how to prevent it. It's called learning and is a sign of maturity.

To be frank I think that's a bit naive. These attacks are a numbers game. There's a low cost to sending the emails and a much larger payoff. Education helps, but it's still possible to catch people off guard, tired, new users etc. Anything that can be done to flag these emails as spam, or increase the cost to the attacker helps.

Whilst I agree with you that the issue should be addressed by mail clients, these emails are not a numbers game in quite the same way as usual spam.

Since they rely on attachments and subject lines that are drawn from an individual user's gmail account, they have to propagate through a network, and they can't be just mass-emailed. Anything that can get the ratio of people falling for this lower than 1/ will completely eliminate the issue.

Re: The closest I've ever come to falling for a Gmail phishing attack

#104

Post by acdha »

dankohn1 wrote: post #70
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

No. A man-in-the-middle phishing attack can ask you for your second factor and pass it through to Gmail.

This is definitely true of TOTP but U2F was designed to prevent phishing attacks by incorporating the hostname in the protocol[1], which means the attacker needs to successfully compromise SSL as well.

1. https://security.stackexchange.com/questions/71316/how-secur...

Re: The closest I've ever come to falling for a Gmail phishing attack

#105

Post by striking »

Jarwain wrote: post #73
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices. ^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used…

That's a pretty awful method of securing anything.

Like, that would prevent me from using 2FA.

Whatever happened to standards?

Re: The closest I've ever come to falling for a Gmail phishing attack

#106

Post by Jarwain »

hayleox wrote: post #92
Jarwain wrote: post #73

Earlier quoted context omitted.

My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices. ^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used…

Oh my god that's awful, what's the point of making it so counterintuitive?? I'll never understand the motivation of companies that roll their own 2FA instead of just using TOTP or Authy.

It was probably the worst way they could have implemented 2FA; we're still vulnerable to a MITM attack.

One of the more annoying things is that the codes are sent from a random 386 number. Out of the 7+ texts I've received thus far, only 2 were from the same number.

Apparently the company they're using is named https://duo.com/

Re: The closest I've ever come to falling for a Gmail phishing attack

#107

Post by Jarwain »

striking wrote: post #105
Jarwain wrote: post #73

Earlier quoted context omitted.

My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices. ^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used…

That's a pretty awful method of securing anything. Like, that would prevent me from using 2FA. Whatever happened to standards?

I guess someone wanted to make a new standard (https://xkcd.com/927/)

Re: The closest I've ever come to falling for a Gmail phishing attack

#109

Post by contravariant »

jneal wrote: post #98
timruffles wrote: post #32

I reported this a back in March 2016, and Google said it was not an issue. Analysed whole attack here: https://gist.github.com/timruffles/5c76d2b61c88188e77f6 This was the response I got: > The address bar remains one of the few trusted UI components of the browsers and is the only one that can be relied upon as to what origin are the users currently visiting. If the users pay no attention to the address bar, phishin…

This is pretty scary. When you hear security professionals explain to laymen how to identify phishing attacks, it's almost always check the URL, make sure you're actually at google.com and not go0gle.com, or something like that. I can't even imagine what legitimate use there is to placing an entire HTML document into the URL. Just seems like a hack someone came up with as a solution to a problem, not the right soluti…

>I can't even imagine what legitimate use there is to placing an entire HTML document into the URL. Just seems like a hack someone came up with as a solution to a problem, not the right solution, but a solution nonetheless.

It allows you to embed data in an URL, meaning you can link to documents that aren't necessarily stored anywhere, such as generated images/text.

I suppose you could make an argument that it shouldn't be shown as a regular URL.

Re: The closest I've ever come to falling for a Gmail phishing attack

#110

Post by Jarwain »

timruffles wrote: post #32

I reported this a back in March 2016, and Google said it was not an issue. Analysed whole attack here: https://gist.github.com/timruffles/5c76d2b61c88188e77f6 This was the response I got: > The address bar remains one of the few trusted UI components of the browsers and is the only one that can be relied upon as to what origin are the users currently visiting. If the users pay no attention to the address bar, phishin…

Why is data:text/html even valid or rendered to the page in the first place? I'm having trouble coming up with a valid usecase for this
Post reply on HN