Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

241–250 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#241

Post by Groxx »

mike_hearn wrote: post #40
xmodem wrote: post #5

Thanks for sharing this - this is fiendishly clever. Even with all the investment in infosec, we're still woefully unprepared to deal with this type of attack. We need to start thinking about new approaches to protect users.

It's a hard problem but the industry isn't doing as much as it could do. There's low hanging fruit that has gone unharvested for years at most big companies. 1. Reform the browser address bar. Safari does this right. Chrome, IMHO shamefully, does not. The address bar is completely ignored by a large fraction (I've read it's about 25%) of users because it's full of meaningless technobabble. These users navigate entire…

I'll toss on 5: iframes are the devil. Incredibly useful, obviously, but they also teach users to e.g. type in their payment-widget password in any domain, just because it appears after clicking a correct-looking button. They don't have a visible URL, or even a border, so there's no way for users to know that X isn't from this site, even if some other technique successfully made them aware of what site they were on.

Re: The closest I've ever come to falling for a Gmail phishing attack

#242

Post by jimmaswell »

colinbartlett wrote: post #64
jhardcastle wrote: post #23

Sysadmin at a school: we use GMail for our students and faculty, and we got hit by this hard right before the holiday break. Three employees and a handful of students all got hit by the attack within a two hour period. It's the most sophisticated attack I've seen. The attackers log in to your account immediately once they get the credentials, and they use one of your actual attachments, along with one of your actual…

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

I feel like all these kinds of extra security burdens aren't worth it. If you could quantify and add up all the inconvenience caused by extra security past simple password logins, affecting all users always, it would surely be more than what would have been caused by the attacks prevented, temporarily affecting a few users.

Re: The closest I've ever come to falling for a Gmail phishing attack

#243

Post by jdavis703 »

jimmaswell wrote: post #242
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

I feel like all these kinds of extra security burdens aren't worth it. If you could quantify and add up all the inconvenience caused by extra security past simple password logins, affecting all users always, it would surely be more than what would have been caused by the attacks prevented, temporarily affecting a few users.

What if they're able to comprise a person who works in HR who probably has copies of passports, social security numbers and other highly-sensitive PII in their email inbox? The fact is people send around all kinds of sensitive information via email, including IT/engineering who probably has discussions about various security holes they're working on patching.

Re: The closest I've ever come to falling for a Gmail phishing attack

#244

Post by jdavis703 »

hobarrera wrote: post #203
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

Probably not; the fake page can also prompt for the second factor and then quickly do the real authentication using that.

This is why having a warning for non-HTTPs sites is so important: http://boingboing.net/2016/11/05/chrome-is-about-to-start-wa....

Re: The closest I've ever come to falling for a Gmail phishing attack

#245

Post by shimon_e »

gaia wrote: post #239
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en

> Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing For now.

Re: The closest I've ever come to falling for a Gmail phishing attack

#246

Post by acchow »

gaia wrote: post #239
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en

Why would a yubikey prevent this? They can still send the 2FA code to Google to start your session...

Re: The closest I've ever come to falling for a Gmail phishing attack

#247

Post by jamescrowley »

acchow wrote: post #246
gaia wrote: post #239

Earlier quoted context omitted.

2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en

Why would a yubikey prevent this? They can still send the 2FA code to Google to start your session...

It's a different protocol. Not an expert but as I understand it U2F isn't totally out of band - the browser communicates the URL so the token you give wouldn't be accepted by Google when it is replayed

Re: The closest I've ever come to falling for a Gmail phishing attack

#248

Post by jamescrowley »

acchow wrote: post #246
gaia wrote: post #239

Earlier quoted context omitted.

2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en

Why would a yubikey prevent this? They can still send the 2FA code to Google to start your session...

@extrapickles describes it better further down: https://news.ycombinator.com/item?id=13376402

Re: The closest I've ever come to falling for a Gmail phishing attack

#249

Post by jlebar »

acchow wrote: post #246
gaia wrote: post #239

Earlier quoted context omitted.

2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en

Why would a yubikey prevent this? They can still send the 2FA code to Google to start your session...

No, they cannot with the U2F protocol (as implemented by yubikey).

The simplified version is, Google sends the browser a one-time key, which the browser forwards to the HW token to sign with its private key. Then the browser sends this back to the web server to verify, using its copy of the HW token's public key.

This would be vulnerable to MITM attacks, as you say.

So what the protocol actually does is concatenate the nonce sent by the web server with the origin of the web page as seen by the browser and have the HW token sign that. This way the server can verify that the HW token signed the right nonce for the right origin.

See https://docs.google.com/document/d/1SjCwdrFbVPG1tYavO5RsSD1Q..., search for "origin".

Re: The closest I've ever come to falling for a Gmail phishing attack

#250

Post by zbuf »

The problem here is monopoly, or mono culture.

The whole world is, basically, using one email client. The lack of diversity means a well written scam like this spreads easily.

I can say for certain I'd never fall for this scam -- because it looks like crap in Pine. I know I'm special, but the same applies to Thunderbird, or whatever.

There's probably a parallel to biology here. Let's get diversity back in our internet culture and with it resistance; scams like this will be harder to convince and much less likely to spread. Hopefully removing some of the incentive, too.

Post reply on HN