Live data from Hacker News

Ask HN: Google Doc email virus?

news.ycombinator.com

71–80 of 220 posts

Re: Ask HN: Google Doc email virus?

#71

It's a pretty nasty one, since it uses their standard OAuth flow with an app "Google Docs" to have users grant full access to their email and contacts. 1. I can't believe Google doesn't have basic filters to disallow developers from registering an app named "Google Docs" 2. Perhaps there should be some more validation/limits associated with allowing apps on the platform that can gain full access to email. A secure em…

> A secure email account is the One True Source of authentication in the digital world. The gmail account you use to talk with people shouldn't be the same one you use to send password resets to. It's fine to allow CRM apps or whatever to have OAuth access to your regular gmail account, you just shouldn't give read-write access to the one you use for your retirement account or whatever. (Read-only access is much less…

> The gmail account you use to talk with people shouldn't be the same one you use to send password resets to.

The vast majority of services don't support setting a separate password reset email, so that would be a showstopper for most people. You'd end up just having another email account you have to check all the time (since non-reset email would also go to this account), and could still easily get bitten by this sort of spam/phishing.

Re: Ask HN: Google Doc email virus?

#72
Things like this are bound to happen when you have centralized systems controlling everything with full control of the information (no zero-knowledge storage like email/document/communication encryption). You're essentially trusting one third party provider with everything in your life/business/organization.

Re: Ask HN: Google Doc email virus?

#73
post #9

EDIT: According to a Google representative on the reddit thread, this application is now blocked. If your account was affected, you no longer need to do anything. If you fell for this, changing your password is not the right solution - you want to log into your google account and remove permissions from the application. https://myaccount.google.com/permissions?pli=1 should show a list of apps connected to your accoun…

Here's a video I made on what you or they need to do: http://youtu.be/fjEenkk9Ntk?hd=1

Re: Ask HN: Google Doc email virus?

#74
Mailinator here:

Yes, we sent the inbox to a blackhole but keep in mind, Mailinator does not and can not actually "Send" any email.

It's a receive-only service. As always, any email "from" @mailinator.com has had it's reply-to forged (which is pretty trivial).

Also - even before we blackholed the email, it's unlikely any email in that inbox (i.e. hhhh..) was read. Each box has a 50 email limit (FIFO) which was immediately overwhelmed. You couldn't click fast enough between seeing the inbox list and clicking an email.

Mailinator is simply a "receiver" in all of this but we have no indication our servers were otherwise involved.

Re: Ask HN: Google Doc email virus?

#76
post #22

Earlier quoted context omitted.

"Google Docs" with the real icon and everything.

Not seeing that weirdly. Could it be "google chrome"?

I've seen 2 client ids used and yes Google Docs and Google Chrome, not sure if google closed them both/all down. Here's a video on what to do/look for:

http://youtu.be/fjEenkk9Ntk?hd=1

Re: Ask HN: Google Doc email virus?

#77
Wow, Hired.com appears to have emailed all of their users about this. Must be spreadinq quickly. Note that they advise compromised users to change their password - which other comments indicate does not solve the issue.

Below is the Hired notification.

---

Important: Email Phishing Alert

Hi ,

It has come to our attention that some of our users may have been hit with a Google Docs phishing scam. It appears that this scam has been spreading throughout the internet today, and is not isolated to Hired or our customers and candidates. If you want more information, you can read about it here[1] or here[2].

If you receive a Hired email that says that someone from Hired has shared a Google Doc with you, please validate with the sender before clicking the link or doing anything else.

If you think your account may have been compromised, be sure to change your password immediately.

We apologize for this interruption to your day. Please let us know if you have any questions.

Thanks, The Hired team

[1] https://www.theverge.com/2017/5/3/15534768/google-docs-phish...

[2] https://gizmodo.com/a-huge-and-dangerously-convincing-google...

Re: Ask HN: Google Doc email virus?

#79

Earlier quoted context omitted.

Is it actually Google or is there some unicode trickery going on?

Doesn't look like a unicode trick on the app-strings I'm getting

Is there a database of homoglyphs for common fonts that one could use to write a visual string matching algorithm?
Post reply on HN