Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

161–170 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#161

Post by Jarwain »

grivescorbett wrote: post #133
Jarwain wrote: post #106

Earlier quoted context omitted.

It was probably the worst way they could have implemented 2FA; we're still vulnerable to a MITM attack. One of the more annoying things is that the codes are sent from a random 386 number. Out of the 7+ texts I've received thus far, only 2 were from the same number. Apparently the company they're using is named https://duo.com/

That's odd, we use duo at work and it's great. Every user is configured to get a push notification directly to the device which bypasses the issues with SMS.

That requires the user to use the Duo app though, right?

I don't recall whether I had the option to use the app when I enabled MFA initially. However, after the fact, and as far as I can find, I cannot go back and enable the app.

Re: The closest I've ever come to falling for a Gmail phishing attack

#162

Post by shadowlord »

skykooler wrote: post #148
shadowlord wrote: post #145

Correct me if I'm wrong, but that embedded image (pretending to be an attachment) redirects you to a (fake) Gmail login page. How is that supposed to trick anyone? I mean, isn't it unusual (i.e. never happens) for attachments to take you to a Gmail login page? So that's suspicious behaviour right there. How is it a serious phishing attack that's getting so much attention on a platform like HN where people are used to…

An attachment could take you to a login page if your Google account was logged out after you loaded Gmail. I've actually had this happen when I suspended my laptop (with a gmail tab open), got on a plane, and opened it again when I got off. When I tried to do something in Gmail again I was logged out (and when I logged in again I got the email from Google "Was this you?")

Yes I agree, in the situation you described, this becomes a legitimate threat. Thanks for pointing that one out.

Re: The closest I've ever come to falling for a Gmail phishing attack

#163

Post by sly010 »

mike_hearn wrote: post #40
xmodem wrote: post #5

Thanks for sharing this - this is fiendishly clever. Even with all the investment in infosec, we're still woefully unprepared to deal with this type of attack. We need to start thinking about new approaches to protect users.

It's a hard problem but the industry isn't doing as much as it could do. There's low hanging fruit that has gone unharvested for years at most big companies. 1. Reform the browser address bar. Safari does this right. Chrome, IMHO shamefully, does not. The address bar is completely ignored by a large fraction (I've read it's about 25%) of users because it's full of meaningless technobabble. These users navigate entire…

> 3. Kill re-authentications dead.

Then I would forget my password, like I always forget my github password and have to reset it every leap year when i log out for some reason, but i guess that's a small price to pay.

Re: The closest I've ever come to falling for a Gmail phishing attack

#164

Post by contravariant »

Jarwain wrote: post #112
contravariant wrote: post #109

Earlier quoted context omitted.

>I can't even imagine what legitimate use there is to placing an entire HTML document into the URL. Just seems like a hack someone came up with as a solution to a problem, not the right solution, but a solution nonetheless. It allows you to embed data in an URL, meaning you can link to documents that aren't necessarily stored anywhere, such as generated images/text. I suppose you could make an argument that it should…

Why even render the content of data:text/html in the first place?

Because that's precisely what the 'data:' URI is supposed to do. The URI is only a description of some resource, there's no reason one description should be treated differently than any other, unless it's actually pointing to a different resource.

Re: The closest I've ever come to falling for a Gmail phishing attack

#165

Post by et-al »

shadowlord wrote: post #145

Correct me if I'm wrong, but that embedded image (pretending to be an attachment) redirects you to a (fake) Gmail login page. How is that supposed to trick anyone? I mean, isn't it unusual (i.e. never happens) for attachments to take you to a Gmail login page? So that's suspicious behaviour right there. How is it a serious phishing attack that's getting so much attention on a platform like HN where people are used to…

Part of why we're impressed (and dismayed) is that they use a data URL to look like "accounts.google.com" and to load a remote script out of sight to the right of all the spaces. Maybe the URL protocol didn't fool you, but I think there are a good number of users out there who have been "trained" to check the URL to see that it says "accounts.google.com" and think it's fine.

And while clicking on an attachment shouldn't sign out a user, being automatically signed out has happened enough to most people that it seems like a fairly innocuous event, especially since this is supposed to be an attachment, not a link, and you just need to sign back in. So one does.

Re: The closest I've ever come to falling for a Gmail phishing attack

#166

Post by Jarwain »

jonoberheide wrote: post #160
Jarwain wrote: post #73

Earlier quoted context omitted.

My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices. ^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used…

Sorry to hear about your experience, Jarwain! Duo offers a choice of authentication methods, depending on the usability and security requirements of your application or organization. Duo Push is actually one of the easiest (and most secure) authentication methods, as one of the commenters pointed out: https://www.youtube.com/watch?v=tPLxe9HUDjY It might be worth pinging your IT/security dept to ask about enabling Duo…

Huh, I never would've expected to hear from the CTO just from making this post.

Thanks for the reply! I'll definitely get in contact with the school's OIT to figure out alternate options for authentication

Re: The closest I've ever come to falling for a Gmail phishing attack

#167

Post by jonoberheide »

Jarwain wrote: post #166
jonoberheide wrote: post #160

Earlier quoted context omitted.

Sorry to hear about your experience, Jarwain! Duo offers a choice of authentication methods, depending on the usability and security requirements of your application or organization. Duo Push is actually one of the easiest (and most secure) authentication methods, as one of the commenters pointed out: https://www.youtube.com/watch?v=tPLxe9HUDjY It might be worth pinging your IT/security dept to ask about enabling Duo…

Huh, I never would've expected to hear from the CTO just from making this post. Thanks for the reply! I'll definitely get in contact with the school's OIT to figure out alternate options for authentication

No prob! I can't claim to be a HN veteran (/me glares at @tqbf), but if I hear people are having issues, happy to help.

Re: The closest I've ever come to falling for a Gmail phishing attack

#168

Post by mayoff »

timruffles wrote: post #86
IanCal wrote: post #78

Earlier quoted context omitted.

I'd say the data: url part is important, as it lets you construct much more plausible looking contents for the address bar. The standard "check it's google.com" would probably fail for a lot of people. How many people really know that you can put a whole webpage in the URL?

Agreed - I think simply highlighting the data:... part of the URL with a vaguely scary colour would help.

Apple's approach in Safari is to only show the hostname in the address bar, unless the address bar has focus. This works pretty well in general (for non-power-users). Unfortunately, for a data URL, it just shows as much of the URL as fits. This may well include the phony “https://account.google.com” part of the URL and thus still mislead naive users.

Re: The closest I've ever come to falling for a Gmail phishing attack

#169

Post by shadowlord »

et-al wrote: post #165
shadowlord wrote: post #145

Correct me if I'm wrong, but that embedded image (pretending to be an attachment) redirects you to a (fake) Gmail login page. How is that supposed to trick anyone? I mean, isn't it unusual (i.e. never happens) for attachments to take you to a Gmail login page? So that's suspicious behaviour right there. How is it a serious phishing attack that's getting so much attention on a platform like HN where people are used to…

Part of why we're impressed (and dismayed) is that they use a data URL to look like "accounts.google.com" and to load a remote script out of sight to the right of all the spaces. Maybe the URL protocol didn't fool you, but I think there are a good number of users out there who have been "trained" to check the URL to see that it says "accounts.google.com" and think it's fine. And while clicking on an attachment should…

Yes, getting automatically signed out is a normal thing. And of course, the user wouldn't suspect that it was the attachment that caused that. So yes, I see it now how this is a legitimate concern.

Re: The closest I've ever come to falling for a Gmail phishing attack

#170

Post by grivescorbett »

Jarwain wrote: post #161
grivescorbett wrote: post #133

Earlier quoted context omitted.

That's odd, we use duo at work and it's great. Every user is configured to get a push notification directly to the device which bypasses the issues with SMS.

That requires the user to use the Duo app though, right? I don't recall whether I had the option to use the app when I enabled MFA initially. However, after the fact, and as far as I can find, I cannot go back and enable the app.

That's correct, of course without having the app installed there is no option other than SMS or a hardware token.

I remember that configuring this is tricky, but I did eventually get user self enrollment configured with push being the default. Happy to dig more into my config, if you're curious: gabe@untapt.com

Post reply on HN