Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

bewildered.substack.com

Post reply on HN
Print view View original

411–420 of 677 posts

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#411

Post by galaxy_gas »

tartoran wrote: post #279
arethuza wrote: post #161

Earlier quoted context omitted.

A lot of them phone me and ask for my wife by name "Can I speak to XYZ" - I usually reply "No" and end the call. Actually, for the last few calls I've not even been saying the "No". Maybe 3 or 4 of these a day

You should not even respond to these. Responding gives them some valuable information about your phone number. Just junk it + report as spam.

I wonder, how this in affects modern software stack that have AI with the AI Call Screening which will ask questions, you can automatically identify certain dimensions: phone is active -- phone has a plan,-- phone is a Pixel or iPhone with a specific minimum model and OS ver ?

Then because of the leak side channel effect they can further future target calls such as coming from google about your problem with "your pixel 9 or 10?"

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#412

Post by mschuster91 »

skygazer wrote: post #357
dec0dedab0de wrote: post #306

Earlier quoted context omitted.

Be careful with checking official numbers too, or at least tell any non-tech friends. Fake numbers have been ending up in search results on official looking websites. It's a real knife fight out there.

It's interesting how easily Google results rankings are manipulated by bad actors, and how unvetted the scams are in paid adverts on and through Google. The web is untrustworthy, and Google transparently passes it to users. We'd probably be better off if Yahoo's quaint curated list of sites had won out.

> It's interesting how easily Google results rankings are manipulated by bad actors, and how unvetted the scams are in paid adverts on and through Google.

Well, SEO, I get that this kind of gaming is hard to prevent, not at Google's scale.

But the AdWords scams? Or all the other fake ad scams, chumboxes and god knows what? The complete lack of audits around something that actually causes money to change hands should be outright banned.

At the high end of ads, think large brand TV spots, you got entire teams of lawyers involved to make sure licensing, actor releases, technical details, corporate identity and a myriad of other things are taken care of.

But at the low end? Some rando from St Petersburg can post an ad for a book "uncovering Western lies about NATO expansion", some Indian can post an ad for "Norton Removal", some American an ad for a f2p game with content that clearly does not describe the actual gameplay or some Chinese can post an ad for penile enlargement pills - and none of the four will get even one human eye on the ad before the campaign goes live and the ads are displayed to actual users, even though all four either violate Western laws outright or are at least banned by the providers/networks.

And the problem isn't just limited to Google, Youtube, AdWords, Unity Ads [1], Taboola [2], Outbrain [3], Facebook/Insta [4] - it's everywhere, the entire low range of ads is infested to the core. Self-service ad platforms should be shut down, period - the industry has shown that "self regulation" doesn't work.

[1] https://discussions.unity.com/t/does-anyone-screen-these-ads...

[2] https://www.vice.com/en/article/taboolas-content-chum-boxes-...

[3] https://www.skeptic.org.uk/2021/01/the-outbrain-drain-why-ne...

[4] https://www.vice.com/en/article/instagram-and-facebook-are-o...

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#413

Post by vunderba »

klik99 wrote: post #301

Literally got something similar to this last Friday. Sounded legit. My one weird trick that works every time - give me a ticket # and an official phone number to call back to and I can confirm the phone number is legit. This way you can continue the conversation if it is actually legit, and if it's not legit then all good. The guy who called me said "I can send you an email to show it's official" and I thought of tha…

I personally don't even allow them an opportunity to give a "phone number" either. I always ask them to identify their company and the branch that they are with - and then personally go to the official website of the company (i.e. https://amazon.com, etc.) and look up the phone number there.

A little less convenient for a LOT more security.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#415

Post by lo_zamoyski »

jfim wrote: post #106
crawftv wrote: post #60

Earlier quoted context omitted.

The biggest red flag in all these stories is getting a call from a customer support person trying to help you. When it seems like it’s impossible to get ahold of them in a real emergency.

I've actually gotten legitimate calls from the bank, although the correct way to handle those is to say that you won't give any information to them but you'll call them back.

Amazing they would call and request information, given how many institutions advise never to do that.

What a shit show.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#416

Post by lo_zamoyski »

craftkiller wrote: post #157
aj7 wrote: post #124

Earlier quoted context omitted.

I use a variation of this. I answer but do not speak. A legitimate caller will speak immediately.

Not always true. My landlord recently had a contractor call me. I did my usual "pick up and don't say anything" routine for unrecognized numbers, and the contractor silently hung up and never called back. Thankfully my roommate actually answered the call, but pick-up-shut-up prevents legit people from leaving voicemails and sometimes prevents legit people from reaching you entirely. Personally, I would utter a confus…

Let it go to voicemail.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#419

Post by sowbug »

sroussey wrote: post #126

A few reminders bear repeating: — no support group from a big company is going to call you. Ever. — never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that! — Don’t put all your private info behind one password, so don’t use Google Authenticator backed by your Google Account as your password manager. Always use a third party…

Has anyone invented something like the TLS three-way handshake, or a U2F challenge, that can use spoken words as a transport layer? People could then be "safely" tricked into reading back "correct-horse-battery-staple" or whatever, because they actually wouldn't have the ability to generate a usable sequence unless the attacker first provided something that only the real site owner could provide.

I'm imagining something with the non-phishability of U2F but the usability of an SMS 6-digit code. Maybe that's U2F.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#420

Post by rslashuser »

I'm super curious how this hack worked, but I feel like the story is just about the last step. What did the attacker have such that this last step did it?

My guess is that the attacker had the google password, and also the login for Coinbase was somehow stored in Google, so the attacker getting into google also exposed Coinbase. I just looked at Coinbase, and it does have a "Sign In With Google" feature.

If you want to live the stripped-down TOTP lifestyle, you have to love this 20 line Python solution. Does not depend on weird libs, and the last edit is 4 years ago. Write the seed on a Post-It and you're all set. Not so convenient, but sound sleeping! https://github.com/susam/mintotp

Post reply on HN