Slashdot Mirror
Gmail, Google Docs Users Hit By Massive Email Phishing Scam (independent.co.uk)
New submitter reyahtbor warns of a "massive" phishing attack sweeping the web: Multiple media sources are now reporting on a massive Gmail/Google Docs phishing attack. The Independent is among the top publications reporting about it: "Huge numbers of people may have been compromised by the phishing scam that allows hackers to take over people's email accounts. It's not clear who is running the quickly spreading scam or why. But it gives people access to people's most personal details and information, and so the damage may be massive. The scam works by sending users an innocent looking Google Doc link, which appears to have come from someone you might know. But if it's clicked then it will give over access to your Gmail account -- and turn it into a tool for spreading the hack further. As such, experts have advised people to only click on Google Doc links they are absolutely sure about. If you have already clicked on such a link, or may have done, inform your workplace IT staff as the account may have been compromised. The hack doesn't only appear to be affecting Gmail accounts but a range of corporate and business ones that use Google's email service too. If you think you may have clicked on it, you should head to Google's My Account page. Head to the permissions option and remove the 'Google Doc' app, which appears the same as any other." UPDATE 5/3/17: Here's Google's official statement on today's phishing attack: "We have taken action to protect users against an email impersonating Google Docs & have disabled offending accounts. We've removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail."
How does clicking a link cause someone's account to be compromised? There is more to the story than clicking the link
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Dumped one of these into my mail trash just before I visited /. Suppsedly from 'office@metroroof.com' (a local vendor I used last year) to 'hhhhhhhhh@mailinator.com' with a bcc to my address. Told me that 'Jasmine Crews has shared a document on Google Docs with you." Had a button to click on reading 'Open in Docs'. I wonder what percent of people actually click on these things?
Also with a gif of the attack.
http://bgr.com/2017/05/03/goog...
"It starts with an email from a known contact, which says that the person has shared a Google Doc with you. You’re invited to click the link to open, which redirects you to a legitimate Google sign-in page. You’re prompted to select one of your Google accounts (remember: this is all using Google’s normal sign-in system), and then authorize a legit-looking app called “Google Docs” to manage your emails."
"That’s how the scam works: the app called “Google Docs,” which requests permission to read, send and delete emails, isn’t really a Google app. Rather, it’s an app controlled by the hackers. It seems that once it has permission to manage your email, it secretly sends out a bunch of emails to all your contacts, with the same phishing link."
Story is wrong.. there is no Permissions section
The proper path is My Account, Sign-in & Security, Connected Apps and sites, Manage Apps. You'll see a list of Apps, just make sure that you haven't given permissions to the Google Docs app. If you have, click on the Google Docs app and click on Remove.
Had an acquaintance get hit with this and received the phishing attempt. Didn't click the link because of the red flags (non-specific document name and the TO address) but sent him a warning and a link to this story. He replied telling me he knew about it and their IT department was handling it. I replied back but it bounced. I changed the subject, removed the phishing link in the quoted email thread and it went through. Looks like google is blocking these messages from being sent/received at all. Fairly recent change as well.
ASCII tastes bad dude.
Binary it is then.
Comment to submitter... next time, please find an article that provides a much better summary without all the gratuitous clickbait links, please. Like this one, or this one.
Anyways, in short, the doc makes an OAuth request for access to the user's e-mail and contacts. And since every user blindly accepts permissions such as these whenever they add an app to their phone, we had a lot of users at our district click "Accept".
Mod points to anyone who can parse the source code and summarize what it does, besides mass-email everyone in the contact list a copy of itself.
This is just an app doing what apps do: apping other apps! Only LUDDITES hate apps that app other apps!
Apps!
Anyone have any ideas how the attacker was able to register the name "Google Docs" with Google? I assume you're not supposed to be able to do this or we would have seen this attack much earlier. My original guess was that the name was in non-Latin (Unicode) letters with the same appearance as Latin letters, but my primitive method of copying and pasting into Python and checking for equality with the plain Latin string indicated this wasn't the case.
This is hitting school districts hard in my state. We invariably have people click on phishing scams and it only takes a couple per building to be a real problem.
The question has been asked, here and elsewhere, what we possibly could have told the novices out there in order to immunize them against this sort of attack. The question is even more relevant now that this proof of concept has been a smashing success, which must surely have emboldened other bad guys to improve up on it.
Just tell them to deny any request, even from a trusted entity, to obtain permissions or passwords to another service they use, even if, as in this case, the service (Google Docs) is under the same roof as the message delivery service (GMail).
This means:
NO autodebit. (Just give us your account numbers and Telephone Inc will autodebit your monthly bill!)
NO autoimport. (Just import all your tax data using your MyBux.com password, and we'll do the rest!)
NO autosubscription. (For just $9.99 automatically billed to your credit card every month, Happy Music will deliver unlimited music!)
And above all NO permissions to your personal accounts for ANYONE other than on a doc-by-doc basis for the sake of collaboration, in which case grant the permission manually by going to Google Docs (or whatever collaboration app) and explicitly adding the person by his/her email address, NOT his/her name, which might map to a different email address.
The only thing you can safely give out is your wifi password, because all routers should be presumed pwned. Practice good endpoint security, and give up on everything else.
This was done by about noon PST yesterday (5/3). Sites hosting the phishing attack were off line and DNS for many/most simply vanished. Email addresses were harvested already, which seems to be the point of the campaign. That, and to validate massive scale manipulation of Google's OAUTH. To the bad guys, it was a big success.
The subject of many/most of these emails was "hhhhhhhhh" (maybe a few more "h"s), so quite honestly people should have known something was wrong. Still, it appears to come from someone trusted, so many people bit the hook on the phishing.
Luckily this was not hosting or abusing malicious code behind it. At least, from the investigating I did yesterday that was the case.
Rules for the masses: Never open attachments you don't expect, even if you know the source. If the message subject and body look bad, the message most likely is too. Sadly even companies with massive education programs teaching these rules were beat up by this one.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.