Slashdot Mirror
Google Was Warned About This Week's Mass Phishing Email Attack Six Years Ago (vice.com)
An anonymous reader quotes a report from Motherboard: For almost six years, Google knew about the exact technique that someone used to trick around one million people into giving away access to their Google accounts to hackers on Wednesday. Even more worrisome: other hackers might have known about this technique as well. On October 4, 2011, a researcher speculated in a mailing list that hackers could trick users into giving them access to their accounts by simply posing as a trustworthy app. This attack, the researcher argued in the message, hinges on creating a malicious application and registering it on the OAuth service under a name like "Google," exploiting the trust that users have in the OAuth authorization process. OAuth is a standard that allows users to grant websites or applications access to their online email and social networking accounts, or parts of their accounts, without giving up their passwords. "Imagine someone registers a client application with an OAuth service, let's call it Foobar, and he names his client app 'Google, Inc.'. The Foobar authorization server will engage the user with 'Google, Inc. is requesting permission to do the following,'" Andre DeMarre wrote in the message sent to the Internet Engineering Task Force (IETF), the independent organization responsible for many of the internet's operating standards. "The resource owner might reason, 'I see that I'm legitimately on the https://www.foobar.com/ site, and Foobar is telling me that Google wants permission. I trust Foobar and Google, so I'll click Allow,'" DeMarre concluded. As it turns out, DeMarre claims he warned Google directly about this vulnerability in 2012, and suggested that Google address it by checking to see ensure the name of any given app matched the URL of the company behind it. In a Hacker News post, DeMarre said he reported this attack vector back then, and got a "modest bounty" for it.
OAuth is a standard that allows users to grant websites or applications access to their online email and social networking accounts, or parts of their accounts
Lesson #1 of computer security: don't aggregate all your data on somebody else's computer.
Lesson #2 of computer security: don't aggregate all your data with all of everybody else's data, especially when also in violation of Lesson #1.
Lesson #3 of computer security: they aren't on your side. (For any arbitrary value of "they", but most especially including companies inducing you to violate Lessons #1 and #2).
Betteridge said it best. Not no, but hell no.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
It's a web app, not a mobile app, and this is a social engineering attack, not a hack, so the device doesn't matter. As such, you can fall prey to this exact scam while using a Mac, a Surface tablet running Windows, or an Android phone with the latest security updates.
While I agree that there are risks for users storing their data in the cloud, it seems like Google should be liable for damage done by this attack. Google clearly was notified and was aware of the vulnerability, hence the bug bounty paid out. I understand that it's not possible to deliver patches immediately, but there are reasonable standards depending on the scope of the vulnerability. Several years is beyond the length of a reasonable length to fix a security issue that could compromise a user's account that might contain sensitive and confidential data. It sure seems like Google was negligent in their security, and ought to be held responsible for damages caused in the attack. There needs to be a lot more liability when businesses are negligent in implementing reasonable security practices and when they fail to respond to reports of security issues within a reasonable amount of time. The only way for security to become a priority is when failing to practice it causes real financial penalties.
'I see that I'm legitimately on the https://www.foobar.com/ site, and Foobar is telling me that Google wants permission. I trust Foobar and Google, so I'll click Allow,'"
Let's see. You're on the attacker's website and you trust it (apparently because it has https in the URL), and you trust Google, so you allow the attacker free access to your google account. How is this Google's fault again? I mean, you give access to your account to people you shouldn't and it's someone else's fault?
Up next, new app scam named "Goggle, Inc.". Another 1 million people clicked on it.
Honestly, it's the first thought that popped into my head when they changed the way the permissions interface for Oauth worked about 8ish years ago. Don't know if there's much, if anything you can do about it though, other than ban the app on a case by case basis, or put some kind of filter in place that remembers the name of every trademark holder. But even then, there'll still be bad guys that manage to get through it.
This signature has Super Cow Powers
The attack sounds quite obvious, thinking about it. Just fake the whole thing, and store the credentials in the process.
It's for me just another reason to avoid Google, Facebook, LinkedIn, or whatever login you can find on various web sites. I'd rather create a new account with unique password. Without direct link to any other web site, without giving them a chance to access to any of my info on the other web sites, without allowing Google and Facebook yet another vector of tracking me (why else are they offering that service?).
Someone using their Google credentials to log in to just about anything, has a big problem were there Google account to be compromised. All those sites suddenly become accessible. It maybe takes a bit of guesswork and luck from the attacker, but they already have the credentials. That's just no fun.
Admittedly the same could happen if my LastPass master password is compromised, but the chance of that is less as I know when to expect to have to enter it. It's a whole lot harder for any software to fake this. I bet it's not impossible, just much harder than setting up a genuine looking web site or app and asking me for it.
I'm sorry but.... there is nothing special about this attack. They named their service google docs in Oauth and that's about the extent of things. I apologize that despite 20 years of warnings about phishing and reading shit users are still dumb as hell and click anything on their screen. At some point we need to admit to ourselves that no amount of security is going to stop a stupid user
Did someone say cake?
The only thing under Trump's watch is maybe a mole and tiny hands.
I wasn't talking about Gmail. I was talking about the rogue app.
Are you surprised an ifanboy wouldn't understand the issue?
So "do no evil" really fucked up this time.
Are you surprised an ifanboy wouldn't understand the issue?
Why does it matter what platform he prefers? Does his choice offend you? Harm you? Threaten you?
Stick to the facts, correct his misconceptions, and move along. You'll find that the quality of your life improves significantly when you stop getting worked up about the preferences of others.
They didn't fix the problem, they just blocked this shit from their system. This may very well still be possible with some changes, like Google Sheets instead of Docs.
What stops this would be attacker from obtaining a certificate for whatever phishing domain they register?
This green lock is no guarantee you are on the site you think you are. You'll have to open it and check the certificate details. Too much work for what I'd estimate at about 99.99% of the average computer users.