Slashdot Mirror
Gmail, Google Docs Users Hit By Massive Email Phishing Scam (independent.co.uk)
New submitter reyahtbor warns of a "massive" phishing attack sweeping the web: Multiple media sources are now reporting on a massive Gmail/Google Docs phishing attack. The Independent is among the top publications reporting about it: "Huge numbers of people may have been compromised by the phishing scam that allows hackers to take over people's email accounts. It's not clear who is running the quickly spreading scam or why. But it gives people access to people's most personal details and information, and so the damage may be massive. The scam works by sending users an innocent looking Google Doc link, which appears to have come from someone you might know. But if it's clicked then it will give over access to your Gmail account -- and turn it into a tool for spreading the hack further. As such, experts have advised people to only click on Google Doc links they are absolutely sure about. If you have already clicked on such a link, or may have done, inform your workplace IT staff as the account may have been compromised. The hack doesn't only appear to be affecting Gmail accounts but a range of corporate and business ones that use Google's email service too. If you think you may have clicked on it, you should head to Google's My Account page. Head to the permissions option and remove the 'Google Doc' app, which appears the same as any other." UPDATE 5/3/17: Here's Google's official statement on today's phishing attack: "We have taken action to protect users against an email impersonating Google Docs & have disabled offending accounts. We've removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail."
Changing a password doesn't invalidate the given app permissions if a user falls victim to this. The user's password isn't given over to the attacker. Changing the user's password won't do anything.
Story is wrong.. there is no Permissions section
The proper path is My Account, Sign-in & Security, Connected Apps and sites, Manage Apps. You'll see a list of Apps, just make sure that you haven't given permissions to the Google Docs app. If you have, click on the Google Docs app and click on Remove.
Here's how it appears to work:
1) Phishing email appears to come from one of your associates (in the "from" name as the "hhh...@mailinator.com" is the address a dead giveaway to suspicious folks)
2) You click on the link and it bounces you through a Google Oauth request, with parameters that will ask you to authorize either googledocs.gdocs.pro or googledocs.docscloud.win (either way, an attack site)
3) You click "Yes, I'd like to authorize..."
4) You end up on the attack site, and it grabs your contacts (except those with "google", "keeper" or "unty" in the name) and sends a fresh phishing email to all of them in slightly staggered batches
Basically, it's an email worm that bounces through an attack site. Fortunately it uses an Oauth2 request, so Google probably spiked it by killing the client API ID, killing some domains, and also appears to have changed something else too. If the author had been a little more subtle, he would now have backdoors into the Gmail/Gdocs of hundreds of thousands of users. Instead, by scraping/spamming all contacts, he got detected and crushed.
This is what's happening:
1) You receive a convincing looking e-mail from a known contact, apparently sharing a Google Doc with you.
2) Following the "Open the Doc" link directs you to Google's real pages for logging in, followed up by being prompted to grant permission to "Google Docs" to read, send, delete, and manage your e-mail, as well as your contacts. Clicking on "Google Docs" reveals that it's not the real app, but rather an app with the same name that's linked to some random gmail address. Again, all of this is still via Google's real pages.
3) If you grant permission, you're compromised, because you've effectively given a rogue app full access to your account via the app API. They have full access to your e-mails and contacts, and will send e-mails to all of your contacts indicating that you shared a doc with them, thus perpetuating the scam.
Notably, resetting your password will not revoke the scammer's access. Because you've granted the fake "Google Docs" app full permission to access your account via the app API, they have no need for your password. The best way to remove their access is by going to this Google page and removing access for the fake "Google Docs" app.