5 ms·
It sounds like the lion's share of their effort is going towards blocking attacks that prey on users' lack of knowledge. Infected email attachments and phishing
by Meekro 11y ago
It sounds like the lion's share of their effort is going towards blocking attacks that prey on users' lack of knowledge. Infected email attachments and phishing are both examples of this that they brought up in the talk[1].
It worries me, though, that they're willing to accommodate novices to such a degree that they open up advanced users to targeted attacks. For example, Gmail bugs you quite a bit to set a "recovery phone number," but doesn't make it clear that this isn't like 2-factor auth. The phone number is actually a single factor that can be used to reset your password. It even works if you have "traditional" 2-factor enabled.
Thus, the attack looks like this:
1. Look up target's social security number. This is easy with certain online services that were meant for private investigators, but actually let anyone get an account.
2. Contact their cell phone provider. If you don't know which one, guess. There are only a handful of common providers and you'll hit on it eventually. Impersonate the target, say you're going on vacation and need your calls and texts forwarded, and give them the SSN from step 1 to verify.
3. Go to Gmail and say you forgot your password. Opt for the phone based reset, and wait for the text with a reset token to come in. Ideally, do this while the target is asleep to give yourself time to work.
High profile individuals have actually been hit this way, and I think Gmail should offer greater protection to sophisticated users who do everything right, don't fall for phishing, and would never forget their password, but can fall victim to highly targeted attacks.
[1] https://www.youtube.com/watch?v=nkV9kOsTyJU https://www.youtube.com/watch?v=nkV9kOsTyJU
- wstrange 11y agoWould a cell phone provider forward to any number on a verbal request over the phone? That seems pretty sketchy to me.
- pfg 11y agoCustomer service turns out to be the weakest link for many services[1][2]. I would not be surprised at all if this were the case. [1]: http://krebsonsecurity.com/2015/12/2016-reality-lazy-authentication-still-the-norm/ http://krebsonsecurity.com/2015/12/2016-reality-lazy-authent... [2]: https://medium.com/@espringe/amazon-s-customer-service-backdoor-be375b3428c4#.jhgdqc8ro https://medium.com/@espringe/amazon-s-customer-service-backd...
- bigiain 11y agoCheck this out: https://youtu.be/bjYhmX_OUQQ?t=2m30s https://youtu.be/bjYhmX_OUQQ?t=2m30s A phone provider's key goal is to continue to provide charged-for services to their customers, not to secure your bank account or dns registrar account... They'll do whatever's needed to allow paying customers to pay or pay more.
- sametmax 11y agoIt makes sense : their business it not security. Companies use them for that, and never asked for permission, they don't have to honor it. Alhough as a customer, I'd like my phones not to be redirect to anybody asking for it, but I understand they don't have the security measures a bank should have.
- deadtofu 11y agoWouldn't your payment to such a service be tracable, if it was used for a nefarious purpose?
- Meekro 11y agoYes, the private investigation service you used to lookup the SSN would have your payment trail, unless you used a prepaid visa. But how does that help? All the target knows is, his phone has been forwarded and his Gmail password changed. Even assuming the police are willing to help (which is unlikely), all they'll discover is that your phone number is forwarding to a disposable cell phone which was bought with cash.
- voltagex_ 11y agoWould this attack work outside of the US?
- jzwinck 11y agoIf your telco authenticates phone support using your government ID number, it very well may work. People in some countries do not even try to keep their ID number private. Some companies ask you to enter it in various places for their own convenience. It was the same in the US some years ago...people did not view SSNs as very sensitive personal data. Some of those people are still alive today.
- eru 11y agoSSNs are not supposed to be used as ID numbers, even. Companies still use them.
- wonderlust 11y agoSocial security number is step 1? Then you likely have bigger problems then your gmail. If your in a position that this actually is a big problem, get a private email server and gpg.
- marcoperaza 11y agoYou can buy lists of Social Security numbers online. You give it to dozens of people and companies in your life, and thousands more have access to it afterward.
- wonderlust 11y agoAnd with it you can steal an identity.
- felisml 11y agoBecause countless companies are stupid and treat it as authentication. It's a password that you reuse everywhere and never change.
- eru 11y agoBy the way, you _can_ change your SSN. Nobody ever bothers to do so, though.
- nommm-nommm 11y agoOnly under certain circumstances. "The SSA may assign a new Social Security numberto you if you are being harassed, abused, or are in grave danger when using the original number, or if you can prove that someone has stolen your number and is using it."
- Meekro 11y agoYou're right that many things are insecure. Of all the services people use on a daily basis, Gmail is probably among the best-defended. It still has security problems, though, and I want it to get better and not use the lack of quality competitors as an excuse to stop improving. Unfortunately, maintaining and securing a private email server can be a big job. Google already does that job, and their data centers are much more secure than the VPS provider where you'll host your private email server. All I'm asking for -- and I don't think this is unreasonable -- is to rely on their world-class technical security, while being able to disable all password recovery methods, which are vulnerable to social engineering.