12 ms·
We Got Phished
- minimaxir 10y agoIt's worth nothing the new user-image-before-password-input for Google is an anti-phishing feature. Of course, most people won't think that deeply when prompted with a password request and a similar UI.
- agwa 10y agoHow does it help? Can't the attacker make a query to Google for the user image and display it on the phishing page?
- deleted 10y ago[deleted]
- minimaxir 10y agoNo. There is no email-to-profile-pic mapping endpoint for unauthenticated users, to my knowledge.
- agwa 10y agoThen how does the image consistently display before the password has been provided? No matter what the answer is, I don't see how it could be an anti-phishing feature.
- minimaxir 10y agoGoogle naturally has their own private APIs which will only show the profile image for legitimate logins.
- lucb1e 10y agoAnd no phisher has ever copied anything from the original site before.
- gog 10y agoBecause the image location is stored in a cookie from before the attack and this cookie will not be sent by a browser to a phishing site. Try from the incognito windows in your browser the image should not show up since no cookies are being sent in the incognito window.
- zaroth 10y agoI use fresh incognito tabs constantly. So I guess I'll never see the image, and never know something is amiss. By I also never click an email link to login unless it's a plain text password reset. I receive authentic looking and topical Dropbox share requests from actual contacts (who have been hacked) trying to phish my Dropbox credentials maybe 4-5 times a year so I'm always on the lookout for it. This is a classic attack. Always check the URL!
- ejcx 10y agoI've seen targeted gmail phishing emails, within the last week, that contain the correct email picture. They are getting images from somewhere...so...no, this isn't a security feature.
- emodendroket 10y agoBut it's also the default behavior if you sign on from a computer Google doesn't recognize, so it's not really strange to see the grey icon instead.
- minimaxir 10y agoWhen you first go to a Google sign-on, it asks for your email. Once you input your email, it then shows you the profile picture corresponding to the account, and asks you to input the password. If the account has no profile picture, the icon is blue instead of gray. (Tested in Incognito mode)
- emodendroket 10y agoThat's not correct. If you sign on from an unrecognized computer, it doesn't show your photo. Using incognito mode doesn't make you "unrecognized;" you need to have a different IP.
- lucb1e 10y ago> a computer Google doesn't recognize If Google can recognize your computer without being logged in, it's time to up your privacy settings.
- emodendroket 10y agoUnless you connect from a different IP every time, Google can recognize your computer.
- lucb1e 10y agoWell there's NAT and dynamic addresses.
- emodendroket 10y agoYes, and I suppose you change your IP so frequently that you never visit the same page from the same IP twice.
- NeutronBoy 10y agoIt's partially because you can sign in with custom domains. By putting your email address in first, Google can figure out what signin mechanism to use prior to you inputting your password (or not, if you don't need one). For example, we use Google Apps at work with our custom domain, with an internal SSO server providing authentication services. You enter your email address, the Google page directs you to the internal SSO server, you get a token, take that back to Google, and you get logged in - no password required.
- BoysenberryPi 10y agoMany people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.
- makmanalp 10y agoHere's some more info on that: http://security.stackexchange.com/questions/19155/effectiveness-of-security-images http://security.stackexchange.com/questions/19155/effectiven...
- BoysenberryPi 10y agoThat's incredible. Not sure if I underestimated hackers ingenuity or underestimated how gullible people are..
- emodendroket 10y agoI don't know if it's "gullible" so much as not understanding or caring about the feature.
- throwthisawayt 10y agoI don't think it's gullible for a user to proceed when they see a site missing an image, I think it's gullible that an engineer expects that the user would notice without any actual evidence. seems like a cardinal sin of engineering - don't assume your users will behave a certain way.
- mamurphy 10y agoAs a note, I think many banks have now removed security images. My bank used to have them, and now they don't.
- justinpombrio 10y agoMy bank (ING Direct) had that. And then they were bought by Capital One, who removed it.
- misiti3780 10y ago2-factor would have prevented this - no ?
- carleverett 10y agoYep. This same phishing attack reached our office a few months back - it was a good motivating force for the whole office to enable 2FA. Probably an overall net positive for the company :)
- agwa 10y agoOnly if you use a U2F hardware token. 2FA using SMS or a smartphone app merely raises the bar for phishing: the attacker can forward the password along to the real service, prompt the user for the 2FA code, forward that along too, and then get a session cookie which they can use to access the account later.
- Throwaway23412 10y agoI've been thinking about buying a YubiKey. Could you elaborate on how U2F protects against MitM and phishing?
- agwa 10y agoU2F knows what domain you're using it with, and won't send an authentication token for google.com to phisher.com.
- deleted 10y ago[deleted]
- cft 10y agoI personally know some people who work for Exploratorium. Not the sharpest tools in the shed.. ;)
- sctb 10y agoPersonal attacks like this are not OK on Hacker News.
- Raphmedia 10y agoWe also got hit by this a few months back. It also got send to all of your company's contact. We had to mail all of them back and lost face. One hour in or so Google made it so that the emails (even those already received and opened) were blocked. It helped to mitigate the issue. Most of the outside contact that would have received the mail received it in their spam. We learned from it and have better security now.
- tikhonj 10y agoThis article seems great at describing how phishing actually works in practice, especially to people without much exposure to technology. I've gone through at least a couple of training emails from IT departments about phishing, and this was way more effective. A realistic case-study with a really clear description is valuable! This article could definitely augment the anti-phishing education at your organization—the only downside is that it's a bit long, so busy people probably won't want to read it :/.
- brachi 10y agoEducation is key. A great way to do that is with http://phishme.com/ http://phishme.com/, were you can also assess how vulnerable you'd be. The bad thing is that convincing an IT department to use it and maybe embarrass other people, specially technical, is hard.
- the_watcher 10y agoKudos to Exploratorium for sharing. Hopefully they're able to find a way to use it in their educational exhibits.
- mathgenius 10y agoYeah it is really good, and I'd like to post it on my fb, but it says nothing about how to protect against phishing, Ie. check the url. (Even that I'm not so sure about.)
- cloudjacker 10y agoI haven't read anything this interesting since the Milw0rm days, post more from that perspective
- space99 10y agoI have seen the infosec future and the future is going to be domain whitelisting. Banks are already doing it.
- jlgaddis 10y agoIn my vision of the future, most devices will not have a default gateway. Instead, everything will be forced through application layer proxy servers which inspect the traffic and decide whether to let it pass. This would include domain whitelisting, as you mentioned, content filtering and inspection, and/or anything else the {company,"protection service",user} wanted to add. I have no doubt that eventually, someday, we will live in a world where our electronic devices default to deny.
- nmc 10y agoThe beginning of the story is missing. PZ clicked on the link in the email because it was "received [...] from a familiar mailing list". Did PZ trust a mailing list where anyone could post? Or did the attackers spoof the "from" field? The former may have been prevented by employee training, the latter by SPF or similar technologies.
- phn 10y agoOr it could come from an already infected account, which might make the e-mail even less suspicious.
- nmc 10y agoYes but this would just mean an even bigger part of the story is missing — how that one got compromised.
- pauldancstep 10y agoHi, I'm the author of that blog post. The backstory is that, indeed, the "familiar mailing list" had been compromised; the attack was conveyed to us in much the same way as we passed it on to others.
- emodendroket 10y agoI mean, I don't think the argument at any point is that it couldn't have possibly been prevented or that nobody made a mistake in this story.
- tomjen3 10y agoSharing links is so common that if you want to punish users for that you can't run your business anymore. But yeah they shouldn't login on sites that the password isn't auto completed for.
- wichert 10y agoIn my experience if you use multiple Google accounts you get login prompts all the time: half the time the Google Doc/Drive link requires me to switch to another account, and occasionally asking for password confirmation as well.
- wingless 10y agoI use Lastpass and I just realized that it prevents phishing since it autocompletes my login info based on the domain.
- dawnerd 10y agoThat's why I love and recommend password managers to all my friends / relatives. Not only does it help prevent phishing but it promotes stronger passwords.
- zeveb 10y agoWhich is yet another reason (not that we needed one) why those pages which try to prevent autocomplete of passwords are wrong, wrong, wrong.
- loeg 10y agoWhile I also don't like sites breaking autocomplete, LastPass' "Show matching sites" dropdown only lists accounts valid for the current domain. So a very similar protection is available even without autocomplete.
- hughes 10y agoDon't forget that the LastPass chrome extension has been tricked in the past to extract passwords from arbitrary domains. It's still important to use your brain when clicking links and invoking LastPass's autofill functions. https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/ https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...
- JoshTriplett 10y agoLikewise - if Firefox doesn't automatically fill in a password that I expect it to, something strange is going on. (Especially now that Firefox automatically uses http credentials for the same page on https, which removes the one other common reasons for this to happen.)
- arkitaip 10y agoGoogle needs to add some optional intelligence to Chrome so that when it comes across a site with suspiciously similar design as key google urls by on a unrenognized url, it should warn the user.
- deleted 10y ago[deleted]
- davidpatrick 10y agoYou can use Google's AMP that is hosted on their domain, to host a redirect, effectively using their domain to host the phishing attempt. Check the screenshots on http://motherboard.vice.com/read/how-hackers-broke-into-john-podesta-and-colin-powells-gmail-accounts http://motherboard.vice.com/read/how-hackers-broke-into-john...
- moduspwnens14 10y agoDon't those screenshots just show domains crafted deceptively to look like Google domains? I don't see any legitimate Google ones. > “We are approaching the point in this case where there are only two reasons for why people say there’s no good evidence,” Rid told me. “The first reason is because they don’t understand the evidence—because the don’t have the necessary technical knowledge. The second reason is they don’t want to understand the evidence.” Is there anywhere we can see this evidence? Objectively I'm curious how an attack which consisted of basic phishing was determined to be definitively supported by the Russian government. If they broke SHA-256 or coerced a Russian CA to generate a Google certificate, I'd agree... but using bitly and decades-old "click this link to reset your password" links? Come on.
- dend 10y agoNotice in one of the last screenshots, the link actually points to a real Google.com domain, but in the /amp/ destination, under which a tiny(cc) link was hidden and therefore fetched the content that "seemed like" it came from Google when Google merely acted as a CDN.
- ivank 10y agoGoogle provides a Chrome extension that alerts you (and an administrator) if you accidentally enter your Google password on a site that isn't accounts.google.com: https://github.com/google/password-alert https://github.com/google/password-alert
- matthewcford 10y agoit doesn't seem to work on the kind of phishing attacks i've seen which use an iframe.
- joeblau 10y agoLike others, I use a password manager. As soon as I hit command + \ and nothing happened - I would have known something was up.
- ryanobjc 10y ago2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of attacks for now, it's worth it!
- shelbyfinally 10y agoIt's Yubikey. Google Authenticator doesn't do any kind of push notification when you log in. Each endpoint uses a shared secret (the server and the mobile app share that secret beforehand) to generate a time-limited code.
- kbar13 10y agoop isn't talking about totp, it's the push notification you get when you log in on a new device (the "review your recent login" notification)
- ryanobjc 10y agoActually I was talking about another method: http://lifehacker.com/google-prompt-lets-you-use-two-factor-authentication-wi-1782413235 http://lifehacker.com/google-prompt-lets-you-use-two-factor-... Essentially its like 2 factor auth, except you arent conveying codes from your phone to the computer. This is a nice feature because it is a lot more user friendly than normal 2fa, it's free if you have a smart phone and well, it works.
- botto 10y agoThis is why SQRL just needs to be completed and everyone should move to it.
- DvdGiessen 10y agoI never heard of SQRL specifically before, so I just spent some time researching it. From what I can find, it has some significant flaws[0], and it doesn't seem these can be addressed without defeating the few advantages this SQRL approuch has. [0]: http://security.blogoverflow.com/2013/10/debunking-sqrl/ http://security.blogoverflow.com/2013/10/debunking-sqrl/
- jlgaddis 10y agoEveryone should take with a large grain of salt anything that comes out of the mind or mouth of Steve Gibson [0]. [0]: http://attrition.org/errata/charlatan/steve_gibson/ http://attrition.org/errata/charlatan/steve_gibson/
- registered99 10y ago> URL shortener, which IT reverse engineered with a URL expander That's an interesting way to put it...
- ASalazarMX 10y agoWow, you're good. You easily reverse engineered their reverse engineering.
- mathgenius 10y agoOk, this article is great and I'd like to share it with all my friends. BUT, it says nothing about how to mitigate against phishing and so ... would leave the average internet user just vaguely paranoid, which is not helpful. I'd like to contact the author and get him to append something about "check the url". But I guess they are not advertising their email addresses anymore :-)
- bcjordan 10y agoWhy isn't there some browser-level identity / authentication you allow access to like oauth?
- x0x0 10y agoI recently saw a link, that I unfortunately can't find, where someone senior affiliated with Defcon or black hat nearly got phished. He was rushing packing in the midst of a flurry of amazon shipments to travel to some conference and got a very well timed phishing email asking him to confirm some sort of shipment details for amazon. He fortunately noticed it was the wrong product, but I seem to remember had started typing his info already. If someone like that can get nearly fooled, there's little hope for the rest of us or our families. It's time to give up preventing phishing and start working on amelioration. ps -- if anybody knows the story I'm talking about, I'd love the link.
- shawkinaw 10y agoIt seems to me that browsers could be smarter about this kind of thing. Like, "Hey, you just put your Gmail credentials into a non-Gmail login form, did you really mean to do that?" Obviously in the HN-type crowd, you know to always carefully check the URL of links and form submissions. But I just don't know how realistic it is for that to be expected of an average user.
- plttn 10y agoThere's actually a Google extension[0] for Chrome that does that with your Google account. [0]:https://chrome.google.com/webstore/detail/password-alert/noondiphcddnnabmjcihcjfbhfklnnep https://chrome.google.com/webstore/detail/password-alert/noo...
- burkaman 10y agoThat would be tough, because most people use one or two email addresses for basically all their accounts. And unless you're storing all their passwords, which would be a sketchy thing to turn on by default, there's no way to tell if they just put in their Gmail credentials or they really meant to log into gmal.ru. And actually even if you're storing their passwords, a lot (most?) people use the same password for lots of different logins. So I don't think there's a way to consistently do this, unless you combine it with a password manager that guarantees the user isn't duplicating passwords across different logins.
- shawkinaw 10y agoYeah, this specific idea might only work well if you're using a password manager. But it was only an example. It could be something as simple as, "You've never submitted a secure form to this site. Please check the address carefully." If you think it's Gmail, that would be an unexpected alert.
- Swizec 10y ago> Obviously in the HN-type crowd, you know to always carefully check the URL of links and form submissions. But I just don't know how realistic it is for that to be expected of an average user. How often do you actually check super carefully? I'm pretty sure I'm not as careful as I know I should be. Especially when busy and distracted and thinking about other things.
- callesgg 10y agoAt my company we get these things 2-3 times a year. Surprisingly many people understand that there is something fishy. But "Surprisingly many" is not enough. 2FA is not enough here a user that does not have the required knowledge to see what is phishing and what is not will most likely enter the 2FA key giving the bad guys the auth tokens anyway.
- ryanobjc 10y agoThat's why yubikey is important - it does it's own verification of the site. You can't MITM it.
- wfunction 10y agoDid not know! Thanks for mentioning!
- mackmgg 10y agoNewer Yubikeys support U2F, which I haven't seen any way to phish yet, but the Yubikey protocol is still possible to phish. To do this, the fake login page says that the token was incorrect the first time (which would possibly alert some people, but certainly not everyone), and then when the user submits a second token, the phishing site sends the first one to the real site. They now have an unused token which can be used up until the user logs into another website (thus invalidating the 'unused' one).
- bjackman 10y agoAt my workplace we hire a company to do occasional phishing attacks on employees. If you get got (I have been got) you are briefly made to feel foolish and have to do a training course. They release stats and like you I was surprised how few people fall for it. But people always fall for it. I think this forced exposure to phishing attacks is an excellent idea.
- bjackman 10y agoAt my workplace we hire a company to do occasional phishing attacks on employees. If you get got (I have been got) you are briefly made to feel foolish and have to do a training course. They release stats and like you I was surprised how few people fall for it. But people always fall for it. I think this forced exposure to phishing attacks is an excellent idea.
- ASalazarMX 10y agoIt's surprising that a dedicated phisher would go so blatantly overboard, knowing it would stand like a sore thumb. This wasn't spearphishing, it was regular phishing in a pond.
- elchief 10y agoYubikey + Chrome solves this. You should get two though. Register both. Put one somewhere very safe, like a safe-deposit box.
- heartsucker 10y ago> What makes an attack like this so effective is that you never expect to see something as convincing as this I've been working on phishing and counter-phishing recently, and if someone is actually putting any effort in, you have to expect something like this. Very legitimate looking email, the correct signature (complete with up to date font/logo), and a virtually perfect copy of the login page to whatever service they're using. All of this, even just to target a single person, is under 8 hours of work, which is to say, it's a simple task for someone who really wants to phish you. The article mentions having an IDS and disaster recovery plans, and this is the best you can hope for as pretty much everyone is susceptible to this, and AI still can be beaten. Source: I've done this, beaten Gmail's anti-scam filters, and phished CTOs.
- utefan001 10y agoA friend and I have a private github repo app that does host based DNS whitelisting. Looking for more Electron / node contributors. Trust the top 10,000 domains, then the user has to allow anything beyond that. Built off of dnsjack. App will point to corporate dns server. https://twitter.com/mabraFoo/status/790678093618900993 https://twitter.com/mabraFoo/status/790678093618900993
- tomjen3 10y agoThen you may be able to answer this question: is it really a problem that those people accessed the link but didn't login? Because sure you could put malware on it, but that's possible on any website.
- heartsucker 10y agoYes, but in theory some sort of MAC could stop it from accessing important files, or anti-virus could detect it and stop it too. But once the password leaves the computer, it's going to take a lot more effort to mitigate the damage. Also, your browser is on your side for protecting against malware, so for example if you have Flash disable, that's a whole vector you can just ignore.
- greggman 10y agoI fell for this one :( The signs were there but the simplicity of the email I think is what lowered my guard. http://blog.greggman.com/blog/getting-phished/ http://blog.greggman.com/blog/getting-phished/
- codedokode 10y agoThis just shows that password-based authorization doesn't work for normal (not computed engineers) people and needs to be replaced with physical cryptographic keys. This is a script kiddie level attack any teenager can do and it succeeded.
- seochang 10y agohttp://sanbatdongsanvinhomes.net/vinhomes-cao-xa-la-smart-city/ http://sanbatdongsanvinhomes.net/vinhomes-cao-xa-la-smart-ci...