Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Google Doc email virus?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 220 posts

Re: Ask HN: Google Doc email virus?

#91

Post by eridius »

Alex3917 wrote: post #88
kelnos wrote: post #71

Earlier quoted context omitted.

> The gmail account you use to talk with people shouldn't be the same one you use to send password resets to. The vast majority of services don't support setting a separate password reset email, so that would be a showstopper for most people. You'd end up just having another email account you have to check all the time (since non-reset email would also go to this account), and could still easily get bitten by this so…

> You'd end up just having another email account you have to check all the time You'd need an extra tab open in your browser that you'd need to check multiple times per day. But most automated messages don't require a response within fifteen minutes or whatever, so there isn't much extra cognitive overhead. And for most people you probably also don't need that email address authed on your phone.

You don't seem to understand. Services send emails to users for a reason. Those users typically want to actually be able to read those emails. That means they need to actually check it regularly, and probably want it available on their phones as well. The email address used here is also the email address the service uses for password reset emails. If you redirect these services to a secondary email that you don't auth on your devices, then you're also greatly reducing the utility of these services.

Re: Ask HN: Google Doc email virus?

#92

Post by mintplant »

oh_sigh wrote: post #79
hemancuso wrote: post #19

Earlier quoted context omitted.

Doesn't look like a unicode trick on the app-strings I'm getting

Is there a database of homoglyphs for common fonts that one could use to write a visual string matching algorithm?

http://www.unicode.org/Public/security/8.0.0/confusables.txt

https://github.com/codebox/homoglyph

http://homoglyphs.net/

Re: Ask HN: Google Doc email virus?

#93

Post by vinchuco »

mailinatorguy wrote: post #74

Mailinator here: Yes, we sent the inbox to a blackhole but keep in mind, Mailinator does not and can not actually "Send" any email. It's a receive-only service. As always, any email "from" @mailinator.com has had it's reply-to forged (which is pretty trivial). Also - even before we blackholed the email, it's unlikely any email in that inbox (i.e. hhhh..) was read. Each box has a 50 email limit (FIFO) which was immedi…

Those can be easily harvested from there

Re: Ask HN: Google Doc email virus?

#94

Post by emersonrsantos »

mintplant wrote: post #45
sudom82 wrote: post #35

Earlier quoted context omitted.

Source code of the worm: https://hastebin.com/gubegaqusi.xml Pretty much what you'd expect. Edit: This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.

Heh, they're using Google Analytics to track its spread. That's a nice touch.

That made my day.

Re: Ask HN: Google Doc email virus?

#95

Post by ghostly_s »

jakob223 wrote: post #9

EDIT: According to a Google representative on the reddit thread, this application is now blocked. If your account was affected, you no longer need to do anything. If you fell for this, changing your password is not the right solution - you want to log into your google account and remove permissions from the application. https://myaccount.google.com/permissions?pli=1 should show a list of apps connected to your accoun…

> If your account was affected, you no longer need to do anything.

How do you figure? An unknown actor presumably had full access to your email inbox for a non-zero amount of time and the proper remediation is "nothing"? If I was concerned this had affected me I would right now be changing my passwords to ____everything____.

Re: Ask HN: Google Doc email virus?

#97

Post by ghostly_s »

slrz wrote: post #86

Hi, I'm Google Docs. Would you please grant me access to your Google account so that I can read, send, delete and manage your mail, as well as manage your contacts?

Hi Google Docs. I'm not sure I need any help managing my email at the moment, but maybe we can just be friends?

Re: Ask HN: Google Doc email virus?

#98

Post by ehsankia »

btym wrote: post #81

I love how simple this worm is. They haven't exploited any security holes (other that looking like Docs), it literally just asks for full access to your email address.

Yeah, I read articles calling it sophisticated. This is a super simple and straight forward worm. Disguise yourself as a known app and ask for more permission than you should. IDN exploits [0] and attachment faking [1] are more sophisticated if anything.

[0] https://www.wordfence.com/blog/2017/04/chrome-firefox-unicod...

[1] http://fortune.com/2017/01/18/google-gmail-scam-phishing/

Re: Ask HN: Google Doc email virus?

#99

Post by ademarre »

I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this:

> "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information."

That last part was in reference to one of my proposed mitigations, which they chose not to implement.

Here's the discussion on the IETF OAuth WG mailing list from that same time period: https://www.ietf.org/mail-archive/web/oauth/current/msg07625...

Re: Ask HN: Google Doc email virus?

#100

Post by evan_ »

mailinatorguy wrote: post #74

Mailinator here: Yes, we sent the inbox to a blackhole but keep in mind, Mailinator does not and can not actually "Send" any email. It's a receive-only service. As always, any email "from" @mailinator.com has had it's reply-to forged (which is pretty trivial). Also - even before we blackholed the email, it's unlikely any email in that inbox (i.e. hhhh..) was read. Each box has a 50 email limit (FIFO) which was immedi…

> it's unlikely any email in that inbox (i.e. hhhh..) was read.

Any way you can tell for sure?

Do you have any logs that could be used to graph the spread of this? E.g. if you were able to find the earliest email to that mailbox you should be able to tell when it started, and with who.

Post reply on HN