Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

131–140 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#131

Post by martin-adams »

greenspot wrote: post #125

Always smiled at phishing scams but this scares the hell out of me, so I just headed to Google to setup 2-factor authentication. How is your experience? I understood that I can register specific machines not to use 2-factor, so if I loose my phone I still can login in. Anything else to consider?

You can create application specific passwords, but I don't know if you can log in to the master account with those.

But you can generate backup codes that you can print out or store somewhere safe for that emergency.

Re: The closest I've ever come to falling for a Gmail phishing attack

#132

Post by mikeash »

danielbarla wrote: post #95
michaelt wrote: post #93

Earlier quoted context omitted.

1. You visit the attacker's page and give them your username and password. 2. The attacker immediately tries them, triggering an SMS to you and an 'enter SMS code' page for them. 3. The attacker shows the 'enter SMS code' page to you, and you enter the code from the SMS you just received, giving it to the attacker. 4. The attacker completes their login using the SMS code. 5. The attacker shows the user some believabl…

Yep, that's what I'm saying too. If you've fallen for providing 1FA, you'll fall for 2FA too, since you think it's legit.

Apple's 2FA for iCloud will likely avoid this if you're careful. They do a GeoIP lookup of where the request is coming from and show the approximate location of the login attempt before they show you the 2FA code. For example, when logging in legitimately from home, it'll say that there's a login attempt from the city where I live. In the likely case where the phisher's server isn't in this area, it'll show something else, and I'll know what's up.

Obviously this isn't perfect because it depends on people actually paying attention to that, and on not having too many false positives due to GeoIP failures, but it seems like a nice improvement.

Apple has a nice UI on it (no surprise, I'm sure) where they show a map centered on the location in question, but even SMS-based solutions could include a quick "Login attempt from City" along with the code.

Re: The closest I've ever come to falling for a Gmail phishing attack

#133

Post by grivescorbett »

Jarwain wrote: post #106
hayleox wrote: post #92

Earlier quoted context omitted.

Oh my god that's awful, what's the point of making it so counterintuitive?? I'll never understand the motivation of companies that roll their own 2FA instead of just using TOTP or Authy.

It was probably the worst way they could have implemented 2FA; we're still vulnerable to a MITM attack. One of the more annoying things is that the codes are sent from a random 386 number. Out of the 7+ texts I've received thus far, only 2 were from the same number. Apparently the company they're using is named https://duo.com/

That's odd, we use duo at work and it's great. Every user is configured to get a push notification directly to the device which bypasses the issues with SMS.

Re: The closest I've ever come to falling for a Gmail phishing attack

#134

Post by space_fountain »

contravariant wrote: post #109
jneal wrote: post #98

Earlier quoted context omitted.

This is pretty scary. When you hear security professionals explain to laymen how to identify phishing attacks, it's almost always check the URL, make sure you're actually at google.com and not go0gle.com, or something like that. I can't even imagine what legitimate use there is to placing an entire HTML document into the URL. Just seems like a hack someone came up with as a solution to a problem, not the right soluti…

>I can't even imagine what legitimate use there is to placing an entire HTML document into the URL. Just seems like a hack someone came up with as a solution to a problem, not the right solution, but a solution nonetheless. It allows you to embed data in an URL, meaning you can link to documents that aren't necessarily stored anywhere, such as generated images/text. I suppose you could make an argument that it should…

Not to mention don't blobs allow us to do this now anyway?

Re: The closest I've ever come to falling for a Gmail phishing attack

#135

Post by sundvor »

Hm, a give-away would be that the image would most likely not be interactive like it is now for me (Chromium). I.e. a PDF attachment footer "icon" renders the preview, and then action buttons when hovering the mouse over it. The buttons are then changed to darker colours with alt text when hovering over them again.

Or did they manage to embed the JS to simulate these actions with the attack?

Re: The closest I've ever come to falling for a Gmail phishing attack

#136

Post by wopwopwop »

angrygoat wrote: post #120
wopwopwop wrote: post #116

Earlier quoted context omitted.

Not really. The phisher can just ask for the second factor the same way they ask for the password.

U2F knocks this on the head - a MITM site won't have the secret required to generate the token.

Wrong. The target domain asks the MITM for the secret, the MITM asks the victim for the secret, the victim gives the secret to the MITM and the MITM gives the secret to the target domain. Just like with the password.

You have no idea what you're talking about and yet you downvote first and ask questions later.

Re: The closest I've ever come to falling for a Gmail phishing attack

#137

Post by jcranmer »

xja wrote: post #71
willvarfar wrote: post #52

Earlier quoted context omitted.

And stop people emailing screen shots? The best approach I can come up with after five seconds thought is disabling links on non-text elements. And then they go make an anchor that is whitespace over top of a background image... so we'd also need to disable links on large expanses of empty whitespace in text when its embedded in a mail. I should think that can likely be worked around too, however. Got any more ideas?

I was think more of a specific mail scanning process for images that look exactly like UI elements, with some fuzzy match. If it matches, flag it with the usual warnings. It feels like there's at least the potential to explore options.

Break the image into several layers and use transparency for the non-included bits. Or you could go full Acid2-like crazy CSS to generate the image from multiple, apparently innocuous elements.

Re: The closest I've ever come to falling for a Gmail phishing attack

#138

Post by [deleted] »

xja wrote: post #71
willvarfar wrote: post #52

Earlier quoted context omitted.

And stop people emailing screen shots? The best approach I can come up with after five seconds thought is disabling links on non-text elements. And then they go make an anchor that is whitespace over top of a background image... so we'd also need to disable links on large expanses of empty whitespace in text when its embedded in a mail. I should think that can likely be worked around too, however. Got any more ideas?

I was think more of a specific mail scanning process for images that look exactly like UI elements, with some fuzzy match. If it matches, flag it with the usual warnings. It feels like there's at least the potential to explore options.

[deleted]

Re: The closest I've ever come to falling for a Gmail phishing attack

#139

Post by sly010 »

There is also a password alert chrome plugin by google [0].

If you ever enter your google password on any domain other than accounts.google.com. It will immediately alert you and give you a link to change your password. It can handle multiple passwords too if you have multiple google accounts.

[0] https://chrome.google.com/webstore/detail/password-alert/noo...

Re: The closest I've ever come to falling for a Gmail phishing attack

#140

Post by Dangeranger »

Use 2-Factor Auth. If you are a sysadmin make it required. Block image downloads by default. Turn on log in notifications for unknown devices. If you are a sysadmin in a controlled network and serve content via proxy block bit.ly. This is a clever and dangerous attack, but can still be avoided by following the above.
Post reply on HN