Slashdot Mirror
Egypt Government Used Gmail Third-Party Apps To Phish Activists (zdnet.com)
An anonymous reader quotes a report from ZDNet: Members of Amnesty International say that Egyptian authorities are behind a recent wave of spear-phishing attacks that have targeted prominent local human rights defenders, media, and civil society organizations' staff. The attacks used a relatively new spear-phishing technique called "OAuth phishing," Amnesty experts said. OAuth phishing is when attackers aim to steal a user account's OAuth token instead of the account password. When a user grants a third-party app the right to access their account, the app receives an OAuth token instead of the user's password. These tokens work as authorization until the user revokes their access. Amnesty investigators said that in the recent spear-phishing campaign that targeted Egyptian activists, authorities created Gmail third-party apps through which they gained access to victim's accounts. Victims would receive an email that looked like a legitimate Gmail security alert. But when they clicked the link, they'd be redirected to a page where a third-party app would request access to their account. Once the victim granted the app access to their Gmail account, the user would be redirected to the account's legitimate security settings page where they'd be left to change their password. Even if the victim changes their password, at this point, the phishers would still have access to the account via the newly acquired OAuth token. The Amnesty International report says the spear-phishing campaign also targeted Yahoo, Outlook and Hotmail users.
Intelligent activists or anyone really have never used gmail or oauth
Good thing that everybody on slashdot is better than average! I know I am, and everyone claims to be!
Don't use Gmail it was designed to be mined, Google itself called Gmail and all email, Postcards, with ZERO, expectations of privacy or security. They mine everything they can get hold of, their focus and as it is their focus, security comes in no where, not even last, just a big ole zero, well, technically in 10 out of 10, it would be negative 10, as Gmail's primary function is not email but email data mining. Reality here, GMail, functioning as it is designed to function compared to snail mail, it is a travesty against humanity. Alphabet/Google should be ashamed but you get bet they are not beyond, bullshit public relations and marketing, designed to be mined. Help save people's lives, drop gmail and block gmail addresses, help to protect people from their own foolishness.
Chaos - everything, everywhere, everywhen
.CNBC is reporting that "US households see biggest decline in net worth since the financial crisis"
https://www.cnbc.com/2019/03/0...
The fall amounted to a drop of 3.4 percent.
And the Beeb yesterday reported that the US trade deficit is highest now than in the past 10 years.
Wonder why CNN, CNBC, Fox, et al did not report this, at least not in the front page. Probably buried way back, behind the obits and the "buy turnips" ads.
https://www.bbc.com/news/busin...
Let me get this straight. A third-party app was created that requested access to a gmail account. E-Mail messages where sent out requesting that people grant these third-party apps access to their gmail account. The user granted the third-party access to their gmail account. What is the problem, exactly?
And we all know security is a social construct, created by the Male Patriarchy to disenfranchise the workers. Just remember out anthem!
"This is the final struggle.
Let us group together and tomorrow.
The Internationale
Will be the human race."
civil society organizations' staff
So they accidentally targeted their own government?
When you give a tool like OAuth to ordinary users they will just "click yes to continue" whenever some app asks them to. At least when they have to enter their password manually they have some idea in the back of their mind that maybe they shouldn't be doing that. A tool like OAuth that accepts tokens granted by the user to third parties in lieu of username and password is practically designed to snooker users.