Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

151–160 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#151

Post by hvidgaard »

spydum wrote: post #45
hvidgaard wrote: post #26

Earlier quoted context omitted.

Yes. That is the point of 2FA. Require something more than login credentials, preferably something physical you possess for an actual login to be successful.

Incorrect: U2F would prevent this, but simple 2FA challenge could simply be displayed at the next screen of the form, and once you submit, the malicious server could immediately use the token you provide. U2F does mutual auth of the u2f service, so it should fail.

U2F prevents mitm attacks, which this is an instance of. Using Google standard 2FA and save the machine/browser for 30 days it would pop up and say you need your 2FA, which would be suspicious. With U2F it would say the service is unknown, which is equally suspicious. But my point was simply that it prevents the attack with only the login information, not that the attack can be futher refined to get your 2FA token.

2FA is a great way to know when you have to look at all the data to decide wether or not to give the token. For instance, I always double check the URL when I'm about to hand out a 2FA code.

Re: The closest I've ever come to falling for a Gmail phishing attack

#152

Post by chinathrow »

Dangeranger wrote: post #140

Use 2-Factor Auth. If you are a sysadmin make it required. Block image downloads by default. Turn on log in notifications for unknown devices. If you are a sysadmin in a controlled network and serve content via proxy block bit.ly. This is a clever and dangerous attack, but can still be avoided by following the above.

The 2FA token is valid for up to 1 minute and the attacker could easily ask for it as well...

There were no image downloads, it was embedded within the message itself.

Re: The closest I've ever come to falling for a Gmail phishing attack

#154

Post by sly010 »

SamBam wrote: post #143
sly010 wrote: post #139

There is also a password alert chrome plugin by google [0]. If you ever enter your google password on any domain other than accounts.google.com. It will immediately alert you and give you a link to change your password. It can handle multiple passwords too if you have multiple google accounts. [0] https://chrome.google.com/webstore/detail/password-alert/noo...

It sounds like the attackers got in almost instantly -- presumably they logged in via script, not a human. Changing your password at that point would probably be like closing the stable door after the horse has bolted. Still useful, I guess, because it lets you know immediately what's up, so you can send out emergency emails to your contacts.

The plugin actually alerts you the moment you press down the last key on your keyboard, before you could even press enter, so you don't even get a chance to submit the password.

But even if you assume at that moment the attacker has your password... I had seen gmail takeovers live and Google's authentication system allows you to recover an account even after it was taken over as long as you still have the old methods of authentication and you are within an unspecified timeframe.

Of course you will have to spend the day cleaning up your email filters and apologizing all your contacts, but at least you will have your account back.

Re: The closest I've ever come to falling for a Gmail phishing attack

#155

Post by mike_hearn »

thomasahle wrote: post #54
mike_hearn wrote: post #40

Earlier quoted context omitted.

It's a hard problem but the industry isn't doing as much as it could do. There's low hanging fruit that has gone unharvested for years at most big companies. 1. Reform the browser address bar. Safari does this right. Chrome, IMHO shamefully, does not. The address bar is completely ignored by a large fraction (I've read it's about 25%) of users because it's full of meaningless technobabble. These users navigate entire…

> 1. Reform the browser address bar. Safari does this right. Chrome, IMHO shamefully, does not. ... The address bar should show the domain name only, or the EV identity when that's present, Chrome on Android does this. And it's extremely annoying. Since mobile browsers (and desktop browsers with tabs) usually don't show the title of pages, the address bar is the only place to tell e.g. what Wikipedia page you're curr…

Wikipedia pages have the title at the top of the page.

In practice, the sort of users who complain about such things are in my experience the sort who also have dozens of tabs open, which smushes the title down to just a few characters. Heck even when there's space in the tab bar Chrome won't allocate more than a few cm of space on screen to showing the title. HTML titles are pretty much a dying thing anyway, so given the ongoing pain caused by phishing I wouldn't hesitate to pull the plug on them.

Re: The closest I've ever come to falling for a Gmail phishing attack

#156

Post by mike_hearn »

marcosdumay wrote: post #115
mike_hearn wrote: post #40

Earlier quoted context omitted.

It's a hard problem but the industry isn't doing as much as it could do. There's low hanging fruit that has gone unharvested for years at most big companies. 1. Reform the browser address bar. Safari does this right. Chrome, IMHO shamefully, does not. The address bar is completely ignored by a large fraction (I've read it's about 25%) of users because it's full of meaningless technobabble. These users navigate entire…

#0 - Get browsers to agree on some protocol for client side certs, and make them usable. That voids the need for #s 1, 2, 3, or 4.

Make key management as user friendly as passwords and I'll agree. I don't think it's going to happen any time soon.

Re: The closest I've ever come to falling for a Gmail phishing attack

#157

Post by tscs37 »

IanCal wrote: post #68
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

I don't think so, I'm not sure how it could. One of the tweets points out that something like lastpass would help with this as it wouldn't allow you to autofill your password (as it's not on the google the domain), but then you could get it manually from there anyway.

Autofill should usually pull the user out of their tunnel vision and focus them on the site and what they are doing.

Not perfect but atleast they're not blindly typing in passwords.

Re: The closest I've ever come to falling for a Gmail phishing attack

#158

Post by mike_hearn »

lol768 wrote: post #63
mike_hearn wrote: post #40

Earlier quoted context omitted.

It's a hard problem but the industry isn't doing as much as it could do. There's low hanging fruit that has gone unharvested for years at most big companies. 1. Reform the browser address bar. Safari does this right. Chrome, IMHO shamefully, does not. The address bar is completely ignored by a large fraction (I've read it's about 25%) of users because it's full of meaningless technobabble. These users navigate entire…

> The address bar should show the domain name only, or the EV identity when that's present, and the browser industry should adopt practices to push usage of EV SSL everywhere. Only EV SSL is a feasible approach to get the actual, legal, verified identity of a server operator on the users screen in a reliable and scalable way. EV certs have their place, but I'm not sure they're better than a URL that you're familiar w…

If the legal name is Nationwide they should be able to get an EV cert under that name. Perhaps they just haven't bothered to do so?

The point of an EV cert is only half to give user meaningful names. The other half is that there's a meaningful level of verification done on the ownership of the name. If you're creating fake companies for the purposes of getting phishy EV cert names, it should be a lot easier to track down who you are. The standards around them are much more carefully spelled out than for DV certs.

Leaving your computer exposed is what lock screens are for.

Re: The closest I've ever come to falling for a Gmail phishing attack

#159

Post by sleepybrett »

dschep wrote: post #144
timruffles wrote: post #32

I reported this a back in March 2016, and Google said it was not an issue. Analysed whole attack here: https://gist.github.com/timruffles/5c76d2b61c88188e77f6 This was the response I got: > The address bar remains one of the few trusted UI components of the browsers and is the only one that can be relied upon as to what origin are the users currently visiting. If the users pay no attention to the address bar, phishin…

A minor change that would help (a little) is to replace all spaces in the address bar with %20.

Or make the whole bar red and flashing whenever someone uses the tricks this attack uses. Specifically data.text/html and inline script tags.

Re: The closest I've ever come to falling for a Gmail phishing attack

#160

Post by jonoberheide »

Jarwain wrote: post #73
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices. ^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used…

Sorry to hear about your experience, Jarwain!

Duo offers a choice of authentication methods, depending on the usability and security requirements of your application or organization.

Duo Push is actually one of the easiest (and most secure) authentication methods, as one of the commenters pointed out:

https://www.youtube.com/watch?v=tPLxe9HUDjY

It might be worth pinging your IT/security dept to ask about enabling Duo Push as an option or to change the policy for SMS passcodes (eg. you can just have one passcode sent instead of ten).

- Jon Oberheide, Co-Founder & CTO @ Duo

Post reply on HN