Slashdot Mirror
Gmail, Google Docs Users Hit By Massive Email Phishing Scam (independent.co.uk)
New submitter reyahtbor warns of a "massive" phishing attack sweeping the web: Multiple media sources are now reporting on a massive Gmail/Google Docs phishing attack. The Independent is among the top publications reporting about it: "Huge numbers of people may have been compromised by the phishing scam that allows hackers to take over people's email accounts. It's not clear who is running the quickly spreading scam or why. But it gives people access to people's most personal details and information, and so the damage may be massive. The scam works by sending users an innocent looking Google Doc link, which appears to have come from someone you might know. But if it's clicked then it will give over access to your Gmail account -- and turn it into a tool for spreading the hack further. As such, experts have advised people to only click on Google Doc links they are absolutely sure about. If you have already clicked on such a link, or may have done, inform your workplace IT staff as the account may have been compromised. The hack doesn't only appear to be affecting Gmail accounts but a range of corporate and business ones that use Google's email service too. If you think you may have clicked on it, you should head to Google's My Account page. Head to the permissions option and remove the 'Google Doc' app, which appears the same as any other." UPDATE 5/3/17: Here's Google's official statement on today's phishing attack: "We have taken action to protect users against an email impersonating Google Docs & have disabled offending accounts. We've removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail."
How does clicking a link cause someone's account to be compromised? There is more to the story than clicking the link
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Dumped one of these into my mail trash just before I visited /. Suppsedly from 'office@metroroof.com' (a local vendor I used last year) to 'hhhhhhhhh@mailinator.com' with a bcc to my address. Told me that 'Jasmine Crews has shared a document on Google Docs with you." Had a button to click on reading 'Open in Docs'. I wonder what percent of people actually click on these things?
Also with a gif of the attack.
http://bgr.com/2017/05/03/goog...
"It starts with an email from a known contact, which says that the person has shared a Google Doc with you. You’re invited to click the link to open, which redirects you to a legitimate Google sign-in page. You’re prompted to select one of your Google accounts (remember: this is all using Google’s normal sign-in system), and then authorize a legit-looking app called “Google Docs” to manage your emails."
"That’s how the scam works: the app called “Google Docs,” which requests permission to read, send and delete emails, isn’t really a Google app. Rather, it’s an app controlled by the hackers. It seems that once it has permission to manage your email, it secretly sends out a bunch of emails to all your contacts, with the same phishing link."
Story is wrong.. there is no Permissions section
The proper path is My Account, Sign-in & Security, Connected Apps and sites, Manage Apps. You'll see a list of Apps, just make sure that you haven't given permissions to the Google Docs app. If you have, click on the Google Docs app and click on Remove.
Had an acquaintance get hit with this and received the phishing attempt. Didn't click the link because of the red flags (non-specific document name and the TO address) but sent him a warning and a link to this story. He replied telling me he knew about it and their IT department was handling it. I replied back but it bounced. I changed the subject, removed the phishing link in the quoted email thread and it went through. Looks like google is blocking these messages from being sent/received at all. Fairly recent change as well.
ASCII tastes bad dude.
Binary it is then.
Comment to submitter... next time, please find an article that provides a much better summary without all the gratuitous clickbait links, please. Like this one, or this one.
Anyways, in short, the doc makes an OAuth request for access to the user's e-mail and contacts. And since every user blindly accepts permissions such as these whenever they add an app to their phone, we had a lot of users at our district click "Accept".
Mod points to anyone who can parse the source code and summarize what it does, besides mass-email everyone in the contact list a copy of itself.
This is just an app doing what apps do: apping other apps! Only LUDDITES hate apps that app other apps!
Apps!
Anyone have any ideas how the attacker was able to register the name "Google Docs" with Google? I assume you're not supposed to be able to do this or we would have seen this attack much earlier. My original guess was that the name was in non-Latin (Unicode) letters with the same appearance as Latin letters, but my primitive method of copying and pasting into Python and checking for equality with the plain Latin string indicated this wasn't the case.
This is hitting school districts hard in my state. We invariably have people click on phishing scams and it only takes a couple per building to be a real problem.