Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oxford Temporarily Blocks Google Docs

blogs.oucs.ox.ac.uk

Post reply on HN
Print view View original

21–30 of 160 posts

Re: Oxford Temporarily Blocks Google Docs

#21

Post by EwanToo »

betterunix wrote: post #18
anonymouz wrote: post #9

Earlier quoted context omitted.

No, their reasoning is that the continuous phishing attacks caused unacceptable trouble with their email system (e.g., Hotmail dropping all emails coming from Oxford). Due to extensive international collaborations, keeping a universities email system running is probably one of the most important tasks of the IT team. Google Docs is nice and useful, but nowhere near as important. Given that they, practically speaking,…

"no alternative way of dealing with the phishing attacks effectively" How about not using passwords? All students, staff, and faculty should have ID cards; start issuing smartcards, and start using cryptographic techniques to authenticate users. Also, digitally sign all official mail, and instruct the users to check those signatures. These are not insurmountable problems. The real issue is that the IT team is not wil…

I also wonder why so many phishing emails are getting through the university spam filters - a slightly better solution might of been to remove links in external emails that point to docs.google.com.

But anyway, I don't want to start slagging off a particular team that I've never met - maybe they wanted to do all sorts of other, smarter, things and weren't allowed, and maybe they'll be allowed to do them now..

Re: Oxford Temporarily Blocks Google Docs

#22

Post by chalst »

blisterpeanuts wrote: post #13

Summary of the blog posting: Google Docs forms are being used in phishing attacks against stupid users. We closed down Google Docs. It didn't work and we had to open it up again after 2.5 hours. Unfortunately, there's no easy solutions to so-called phishing attacks other than educating users. I would recommend that the IT dept. dedicate its considerable resources and creativity to that end, and try to minimize use of…

considerable resources

This is a British university, not Goldman Sachs. The action was a dramatic, low-cost effort to get users' attention, educating users, if you like (from OP):

> While this wouldn’t be effective for users on other networks, in the middle of the working day a substantial proportion of users would be on our network and actively reading email. A temporary block would get users’ attention and, we hoped, serve to moderate the “chain reaction”.

Re: Oxford Temporarily Blocks Google Docs

#23

Post by Unosolo »

Why not enforce a velocity restriction on outgoing e-mails instead and put spam filters on outgoing e-mail then bounce offending mail back to sender?

Spammers are phishing for ox.ac.uk accounts because they're easy to exploit, right? Just raise the bar.

Re: Oxford Temporarily Blocks Google Docs

#24

Post by bigfudge2 »

FourthProtocol wrote: post #11
joelthelion wrote: post #7

Earlier quoted context omitted.

Network Admins need to learn that looking at what your users do and meddling with his data is not a legitimate activity. They should have learned that long ago. Fortunately, with encryption becoming more widespread, they will have to learn the lesson.

If it's your network, and you graciously allow me to use it, and I, through my use of your network breach the security of systems on your network, would you not do anything in the interests of not meddling with my data?

Except the network belongs to the institution (i.e. its users), not the IT department (although most do seem to think this way).

Re: Oxford Temporarily Blocks Google Docs

#25

Post by jnazario »

anonymouz wrote: post #9
EwanToo wrote: post #6

It's the perfect example of why security teams are often considered to be the least friendly, least approachable part of an already unapproachable department (IT). Their reasoning seems to be "Google Docs causes us (the security team) hassle, we don't use Google Docs, so we'll shut it down". They might as well of shut down the whole of the Internet, for all their nonsensical reasoning, except they'd of been affected…

No, their reasoning is that the continuous phishing attacks caused unacceptable trouble with their email system (e.g., Hotmail dropping all emails coming from Oxford). Due to extensive international collaborations, keeping a universities email system running is probably one of the most important tasks of the IT team. Google Docs is nice and useful, but nowhere near as important. Given that they, practically speaking,…

continuous phishing attacks via google docs? no, not quite. some collaborators and myself studied this a couple of years ago, it's a minuscule part of the phishing problem.

http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=61...

edited to add: here's the paper for you to read, i forgot i had a copy lying around.

http://monkey.org/~jose/tmp/PHISHING-FINAL-03-KN.pdf

Re: Oxford Temporarily Blocks Google Docs

#26

Post by fixed_input »

"We have to ask why Google, with the far greater resources available to them, cannot respond better. Indeed much, if not all, of the process could be entirely automated."

The problem lies with the people on the Internet though. I doubt the whole thing could be automated because of the simple fact that there are people out there who, just to troll, would and probably already zip through plenty of legitimate public Google docs and click the "report abuse" link at the bottom of each page.

The result is most likely an overwhelming amount of reported "abuse" pages are most likely legitimate, which is why actual malware docs don't get dealt with in a timely manner. Its like when people prank call 911, which could lead to actual emergencies not being responded to immediately.

Re: Oxford Temporarily Blocks Google Docs

#27

Post by mcherm »

They're attacking the wrong part of the problem.

If misleading messages ("phishing") are leading their users to enter credentials onto forms which are then used to send out spam, then the solution is not to block access to one of the sites that supports forms. There are an unlimited number of sites that support forms. There are LOTS of better ways to solve this problem. Here are a few:

* Train your users where it is and isn't safe to enter credentials.

* Don't give your users credentials. Have some alternate way to authenticate them like a login token.

* Put rate limiting on the ability of a single account to send out emails.

Blocking the site for just a few hours as an emergency response to a short-term attack is a much more reasonable approach. Sometimes, to react quickly, you need to take measures that are not the best possible choice. But there were better approaches, and the security team should take measures to ensure that they can react more effectively next time. For instance, in this case, a single mass-email or email "virus" had gone out and was tempting a large number of users to give out their credentials. Instead of blocking the site that was collecting the credentials, a better solution would have been to remove the email from the mailboxes of all the students. After all, the emails system is provided by the university, and this cuts off the problem at the root. They should institute the necessary technology to support doing this next time they have a phishing problem... perhaps they can even do this proactively: set up some honeypot accounts not receiving any legitimate emails and automatically destroy any emails matching the signature of emails received by these honeypot accounts (with manual review afterward to correct for false positives).

Re: Oxford Temporarily Blocks Google Docs

#28

Post by fnordfnordfnord »

anonymouz wrote: post #9
EwanToo wrote: post #6

It's the perfect example of why security teams are often considered to be the least friendly, least approachable part of an already unapproachable department (IT). Their reasoning seems to be "Google Docs causes us (the security team) hassle, we don't use Google Docs, so we'll shut it down". They might as well of shut down the whole of the Internet, for all their nonsensical reasoning, except they'd of been affected…

No, their reasoning is that the continuous phishing attacks caused unacceptable trouble with their email system (e.g., Hotmail dropping all emails coming from Oxford). Due to extensive international collaborations, keeping a universities email system running is probably one of the most important tasks of the IT team. Google Docs is nice and useful, but nowhere near as important. Given that they, practically speaking,…

My own employer has farmed out the admin of student email accounts to Google (wisely IMO). The system had some initial glitches I admit. On a few occasions (if I'm not mistaken) Google banned email originating from their own system. In other news, many faculty use Google Docs for communication with students, and a lengthy disruption would be a big hassle, at least for me.

Re: Oxford Temporarily Blocks Google Docs

#29

Post by mcherm »

jnazario wrote: post #25
anonymouz wrote: post #9

Earlier quoted context omitted.

No, their reasoning is that the continuous phishing attacks caused unacceptable trouble with their email system (e.g., Hotmail dropping all emails coming from Oxford). Due to extensive international collaborations, keeping a universities email system running is probably one of the most important tasks of the IT team. Google Docs is nice and useful, but nowhere near as important. Given that they, practically speaking,…

continuous phishing attacks via google docs? no, not quite. some collaborators and myself studied this a couple of years ago, it's a minuscule part of the phishing problem. http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=61... edited to add: here's the paper for you to read, i forgot i had a copy lying around. http://monkey.org/~jose/tmp/PHISHING-FINAL-03-KN.pdf

Thank you for posting ACTUAL RESEARCH!

Although I'll note that I didn't read the research since it's behind a $31 paywall.

Re: Oxford Temporarily Blocks Google Docs

#30

Post by freehunter »

jnazario wrote: post #25
anonymouz wrote: post #9

Earlier quoted context omitted.

No, their reasoning is that the continuous phishing attacks caused unacceptable trouble with their email system (e.g., Hotmail dropping all emails coming from Oxford). Due to extensive international collaborations, keeping a universities email system running is probably one of the most important tasks of the IT team. Google Docs is nice and useful, but nowhere near as important. Given that they, practically speaking,…

continuous phishing attacks via google docs? no, not quite. some collaborators and myself studied this a couple of years ago, it's a minuscule part of the phishing problem. http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=61... edited to add: here's the paper for you to read, i forgot i had a copy lying around. http://monkey.org/~jose/tmp/PHISHING-FINAL-03-KN.pdf

Just because you saw a small amount from Google Docs doesn't mean that Oxford isn't seeing a large amount, or large enough to concern them. If you're a researcher, you should know that you can't extrapolate your dataset to everyone.
Post reply on HN