Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be warned, there's a nasty Google 2 factor auth attack going around

twitter.com

Post reply on HN
Print view View original

31–40 of 61 posts

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#31

Post by tetraodonpuffer »

Alex3917 wrote: post #18
etherealmachine wrote: post #13

Earlier quoted context omitted.

Account recovery is always a nagging weak spot. At some point, a user will forgot their password or lose their TFA device, and now you need them to be able to prove their identity outside of the usual flow. And if you have enough users, this has to be automated, leaving even more room for exploitation.

> And if you have enough users, this has to be automated Not really, they could just charge people $100 to retrieve a lost password and then do it manually.

I would love for services that I REALLY care about never ever ever being broken into (email, web hosting) there was ONLY the $100-and-speak-to-a-human option to change the password

I would even make it $100 + skype and show live on skype your passport.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#33

Post by bitL »

ams6110 wrote: post #2

So the scam is, attacker knows your gmail address and your phone number. They send you the text message about suspicous activity on your account. Then they attempt to reset the password on your gmail account. That triggers Google to send you the code. You reply to the attacker's message with the code as instructed, and they own your account.

This sounds like an ancient Agora protocol interaction attack back in the beginning of e-commerce :-D

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#34

Post by kbar13 »

bredman wrote: post #29
ocdtrekkie wrote: post #25

Earlier quoted context omitted.

Charging $100 is pretty punitive, but I've often wondered why more online services sensitive to attack don't use token credit card charges as a way to limit account duplication, increase complexity in a malicious operation, etc. Stealing credit cards is cheap, yes, but the additional cost to using such a card on a password reset would still be a deterrent.

IMO it's not that bad, people are used to paying locksmiths that much when locked out of houses or vehicles.

that doesn't mean it's a good thing

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#35

Post by Alex3917 »

ocdtrekkie wrote: post #25
Alex3917 wrote: post #18

Earlier quoted context omitted.

> And if you have enough users, this has to be automated Not really, they could just charge people $100 to retrieve a lost password and then do it manually.

Charging $100 is pretty punitive, but I've often wondered why more online services sensitive to attack don't use token credit card charges as a way to limit account duplication, increase complexity in a malicious operation, etc. Stealing credit cards is cheap, yes, but the additional cost to using such a card on a password reset would still be a deterrent.

> Charging $100 is pretty punitive

Not really, considering there is zero reason for anyone to ever lose a password assuming they are using a password manager. You could even make it free for the first few hours after the account is created or the password is changed in case the user pastes it into their password manager incorrectly.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#36

Post by sievebrain »

kjaftaedi wrote: post #28
JohnTHaller wrote: post #11

This isn't a 2 factor attack. It's a social engineering Google account password reset attack. The attacking party is resetting your Google password and asking you to provide the code Google sends your registered mobile number via text to them.

It is a 2 factor attack in the sense that it reduces the two factors down to one.

2 factor auth is not a defence against phishing. This is such a common misconception. All two-factor means is that someone with only your password cannot log in, or only your device.

What's happening here is that Google accounts without 2-factor but with a phone recovery path set up are being "account recovered" by a bad guy. It's just plain old phishing.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#37

Post by oplav »

kjaftaedi wrote: post #28
JohnTHaller wrote: post #11

This isn't a 2 factor attack. It's a social engineering Google account password reset attack. The attacking party is resetting your Google password and asking you to provide the code Google sends your registered mobile number via text to them.

It is a 2 factor attack in the sense that it reduces the two factors down to one.

I don't think there were ever 2 steps in this account recovery flow. There seems to be only 1 step when initiating a account recovery: provide the code sent to your phone.

A 2 factor recovery flow would be 1) verify an email that was sent to your recovery email address that triggers 2) this account recovery code sent to your phone.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#38

Post by Sephr »

azinman2 wrote: post #3

I wonder if this is at all related to a phishing attempt that just got my mom and all her friends. It came in as a "docusign" email that looked reasonably legit (to an ordinary person) that just had one button to sign and review a document. Apparently they asked for email, email password, and phone number. I was surprised to learn about the phone number bit and how they'd use it. Something like this is probably how.…

> "I figured if it was coming from you it would be real."

You should set up a strict DMARC policy (p=reject) to prevent people from spoofing your email address. It appears that you have not[1].

Additionally, you should harden your SPF record: change ~all to -all.

[1]: https://dmarcian.com/record-tools/azinman.com

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#39

Post by _delirium »

ocdtrekkie wrote: post #25
Alex3917 wrote: post #18

Earlier quoted context omitted.

> And if you have enough users, this has to be automated Not really, they could just charge people $100 to retrieve a lost password and then do it manually.

Charging $100 is pretty punitive, but I've often wondered why more online services sensitive to attack don't use token credit card charges as a way to limit account duplication, increase complexity in a malicious operation, etc. Stealing credit cards is cheap, yes, but the additional cost to using such a card on a password reset would still be a deterrent.

I seem to recall there were some services that charged a one-time small fee in the late-90s / early-2000s basically for that reason. But in the past 10 years most seem to have moved to requiring a mobile phone number as the hurdle instead. The idea is that it has some of the same deterrent effect for bad actors, since coming up with a steady stream of unused mobile numbers costs a nonzero amount, but produces less sign-up friction for legitimate users.

Re: Be warned, there's a nasty Google 2 factor auth attack going around

#40

Post by untog »

stephengillie wrote: post #4
ams6110 wrote: post #2

So the scam is, attacker knows your gmail address and your phone number. They send you the text message about suspicous activity on your account. Then they attempt to reset the password on your gmail account. That triggers Google to send you the code. You reply to the attacker's message with the code as instructed, and they own your account.

Again, this is a social engineering attack. 2-factor remains mathematically secure.

Sure, but implementation matters. I've long thought that 2 factor via SMS is a sub-optimal solution because it trains you to expect secure login info from a random shortcode SMS number.
Post reply on HN