The closest I've ever come to falling for a Gmail phishing attack • Hacker News Board

Re: The closest I've ever come to falling for a Gmail phishing attack

#41

Post by camus2 » Wed, Jan 11, 2017, 12:24 PM UTC

> The problem doesn't get better until we destigmatize it.

Absolutely, it can happen to anyone. I'm sick of people here or on other forums who do some victim blaming, calling phishing victims "idiots". It's not going to solve the problem. And often Gmail or Chrome teams dismiss these kind of issues.

I had to revert to the html version of Gmail because I was sick of all the phishing attempts and disable images in the client.

Re: The closest I've ever come to falling for a Gmail phishing attack

#42

Post by volent » Wed, Jan 11, 2017, 12:24 PM UTC

_wdh wrote: post #20

That's scary. Would having 2FA enabled on your Gmail account protect you from this kind of attack?

Yes

Re: The closest I've ever come to falling for a Gmail phishing attack

#43

Post by mike-cardwell » Wed, Jan 11, 2017, 12:25 PM UTC

_wdh wrote: post #20

That's scary. Would having 2FA enabled on your Gmail account protect you from this kind of attack?

Depends on the type of 2FA. If it's using U2F, then you'd be fine as that is tied to the domain name of the site you're on, but if it's using TOTP/HOTP (i.e. Google Authenticator), and the phishing site asked you for your 2FA code, and you gave it, then you would still be successfully phished.

Re: The closest I've ever come to falling for a Gmail phishing attack

#44

Post by slig » Wed, Jan 11, 2017, 12:28 PM UTC

crashdown wrote: post #28

_wdh wrote: post #20

That's scary. Would having 2FA enabled on your Gmail account protect you from this kind of attack?

Must do surely. The attackers would have your email and password but wouldn't be able to login?

What is stopping them from showing the TFA screen and asking for you to type the number?

Re: The closest I've ever come to falling for a Gmail phishing attack

#45

Post by spydum » Wed, Jan 11, 2017, 12:29 PM UTC

hvidgaard wrote: post #26

_wdh wrote: post #20

That's scary. Would having 2FA enabled on your Gmail account protect you from this kind of attack?

Yes. That is the point of 2FA. Require something more than login credentials, preferably something physical you possess for an actual login to be successful.

Incorrect: U2F would prevent this, but simple 2FA challenge could simply be displayed at the next screen of the form, and once you submit, the malicious server could immediately use the token you provide. U2F does mutual auth of the u2f service, so it should fail.

Re: The closest I've ever come to falling for a Gmail phishing attack

#46

Post by tantalor » Wed, Jan 11, 2017, 12:29 PM UTC

I was about to ask why don't browsers prompt for confirmation when submitting a password on an unfamiliar domain, but then I realized the fake login page would just use a normal text field instead of a password field and fake the password dots.

Re: The closest I've ever come to falling for a Gmail phishing attack

#47

Post by Kiro » Wed, Jan 11, 2017, 12:30 PM UTC

yread wrote: post #9

To save the click: Follow Tom Scott (‏@tomscott): This is the closest I've ever come to falling for a Gmail phishing attack. If it hadn't been for my high-DPI screen making the image fuzzy… https://pbs.twimg.com/media/C0W-dCCWQAAl0cn.jpg

This doesn't tell the whole story though. You should read the comments and see the subsequent images.

Re: The closest I've ever come to falling for a Gmail phishing attack

#48

Post by jpl56 » Wed, Jan 11, 2017, 12:32 PM UTC

new299 wrote: post #24

I guess it's an aims race, but I would guess there are a few potential ways to mitigate against this: 1. Watermark all images on the in-email preview. 2. You should be able to design a mail scanner which would detect images that look too much like gmail elements and flag them.

Yes! They do it for banknotes (it's impossible to scan or xerox them). They could do it in the same way for login pages!

Re: The closest I've ever come to falling for a Gmail phishing attack

#49

Post by cyberferret » Wed, Jan 11, 2017, 12:34 PM UTC

frogfuzion wrote: post #2

I think its naive to believe that even the most tech savvy are immune to phishing. People get tired, hurried, stressed - and during those moments anyone's guard can be let down.

Yes - I am vigilant to almost a paranoid level, but one day a phishing email came from "Australia Post" purporting to be a missed delivery notification on a day that I was expecting a delivery and thought I had missed the driver.

I was in a hurry, and frustrated and was a millisecond away from clicking the link when some gut feeling told me that something was not right. Closest I've come to date, and it worried me.

EDIT: Sorry, I meant to respond to @soneca below, as this relates to phishing emails arriving with impeccable timing...

Re: The closest I've ever come to falling for a Gmail phishing attack

#50

Post by sowpati » Wed, Jan 11, 2017, 12:35 PM UTC

andygambles wrote: post #39

The aim of EV certificates is to reduce such risks and highlight to the user the legitimacy of such websites. HTTPS alone only provides encryption. Google doesn't use EV anywhere but I feel it should on login pages especially given it is a high phishing target.

I'm not an expert, but as I understand, they don't actually use password fields on phishing pages. Instead they use normal text fields and fake password dots. So I'm not sure if they can be identified as login pages.

ETA: another parent comment talks about the same thing.