Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

71–80 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#71

Post by xja »

willvarfar wrote: post #52
xja wrote: post #35

Earlier quoted context omitted.

That's a real shame. There are certainly things they could do to prevent images looking quite so similar to UI elements.

And stop people emailing screen shots? The best approach I can come up with after five seconds thought is disabling links on non-text elements. And then they go make an anchor that is whitespace over top of a background image... so we'd also need to disable links on large expanses of empty whitespace in text when its embedded in a mail. I should think that can likely be worked around too, however. Got any more ideas?

I was think more of a specific mail scanning process for images that look exactly like UI elements, with some fuzzy match.

If it matches, flag it with the usual warnings.

It feels like there's at least the potential to explore options.

Re: The closest I've ever come to falling for a Gmail phishing attack

#72

Post by TillE »

slazaro wrote: post #19

The only two things that I think could have prevented me from falling for this is: I don't have images loaded by default for unknown senders, and LastPass wouldn't match the domain and therefore wouldn't show the button to autocomplete on the password box. Depending on how observant I'd be at the moment, I might check the URL bar and see something fishy. But I could fall for this, which is worrying.

Right, I almost never manually enter passwords on the web. If LastPass isn't automatically filling the field, something is very wrong.

It's a nice extra security check, in addition to the primary benefits of using a password manager.

Re: The closest I've ever come to falling for a Gmail phishing attack

#73

Post by Jarwain »

colinbartlett wrote: post #64
jhardcastle wrote: post #23

Sysadmin at a school: we use GMail for our students and faculty, and we got hit by this hard right before the holiday break. Three employees and a handful of students all got hit by the attack within a two hour period. It's the most sophisticated attack I've seen. The attackers log in to your account immediately once they get the credentials, and they use one of your actual attachments, along with one of your actual…

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices.

^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used in that order (0 code on first login, 1 code on second, etc.), and the page informs the user which number they're on.

Re: The closest I've ever come to falling for a Gmail phishing attack

#74

Post by midgetjones »

dankohn1 wrote: post #70
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

No. A man-in-the-middle phishing attack can ask you for your second factor and pass it through to Gmail.

That's assuming the attacker could log in with it before it expired, isn't it?

Re: The closest I've ever come to falling for a Gmail phishing attack

#75

Post by mike-cardwell »

thomasahle wrote: post #59
mike-cardwell wrote: post #43

Earlier quoted context omitted.

Depends on the type of 2FA. If it's using U2F, then you'd be fine as that is tied to the domain name of the site you're on, but if it's using TOTP/HOTP (i.e. Google Authenticator), and the phishing site asked you for your 2FA code, and you gave it, then you would still be successfully phished.

Is the difference here that TOTP/HOTP is entered by the user, while U2F is entered automatically?

Yes. With U2F the recipient of the token is verified by a machine. With TOTP/HOTP it is verified by the user looking at the browser address bar.

Re: The closest I've ever come to falling for a Gmail phishing attack

#77

Post by danielbarla »

IanCal wrote: post #68
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

I don't think so, I'm not sure how it could. One of the tweets points out that something like lastpass would help with this as it wouldn't allow you to autofill your password (as it's not on the google the domain), but then you could get it manually from there anyway.

Well, when the attacker attempts to log in via the stolen credentials, they would get the 2FA check, and you would get an SMS.

Normally this would alert you to the fact that someone is logging in to your account, and would stop the attacker since they lack the 2FA one time pass. In this case though, since you've already fallen for the "I'm trying to log in to Google again", the attacker will probably fake the 2FA screen as well, and you'll merrily type it in.

Re: The closest I've ever come to falling for a Gmail phishing attack

#78

Post by IanCal »

timruffles wrote: post #32

I reported this a back in March 2016, and Google said it was not an issue. Analysed whole attack here: https://gist.github.com/timruffles/5c76d2b61c88188e77f6 This was the response I got: > The address bar remains one of the few trusted UI components of the browsers and is the only one that can be relied upon as to what origin are the users currently visiting. If the users pay no attention to the address bar, phishin…

I'd say the data: url part is important, as it lets you construct much more plausible looking contents for the address bar. The standard "check it's google.com" would probably fail for a lot of people.

How many people really know that you can put a whole webpage in the URL?

Re: The closest I've ever come to falling for a Gmail phishing attack

#79

Post by microtonal »

midgetjones wrote: post #74
dankohn1 wrote: post #70

Earlier quoted context omitted.

No. A man-in-the-middle phishing attack can ask you for your second factor and pass it through to Gmail.

That's assuming the attacker could log in with it before it expired, isn't it?

Yes, but as per the standard TOTP codes are valid for a window of 1 minute.

TOTP barely protects against phishing. What you want is an U2F key as the second factor. It's not like they are expensive anyway (usually 7-15 Euro) and quite some large services support U2F tokens already (Google, Dropbox, GitHub, Fastmail, etc.).

Post reply on HN