15 ms·
Ask HN: Google Doc email virus?
We just received multiple "google doc shares" that seemed sketchy and were not sent by the claimed sender.
They came from different companies that have no connection to each other, I assume others are seeing them too right about now. Anyone know whats up?
- alexlongterm 9y agoWe wrote a guide for google suite admins on how to lock down their domain. Oauth and phishing are major threats and google could do much more here https://medium.com/@longtermsec/more-tips-for-securing-your-g-suite-4d617bd04bc8 https://medium.com/@longtermsec/more-tips-for-securing-your-...
- mrpound 9y agoSame here. Several emails so far from different seemingly random companies and individuals with clearly malicious Google Docs requests w/ a suspicious param in the oauth request in the link: "&redirect_uri=3Dhttps%3A%2F%2Fgoogledocs.docscloud.info%2Fg.php&customparam=3Dcustomparam"
- WizardII 9y agoSeeing an alternate redirect redirect_uri= =3Dhttps%3A%2F%2Fgoogledocs.g-docs.win%2Fg.php
- deleted 9y ago[deleted]
- yurisagalov 9y agoLooks like this is fairly widespread. This is what the attack actually looks like: https://twitter.com/zachlatta/status/859843151757955072 https://twitter.com/zachlatta/status/859843151757955072
- maxerickson 9y agoIt managed to hit regional mainstream media here (like 10 minutes ago). I guess that probably just means someone working there got it though.
- d2kx 9y agoYeah @SwiftOnSecurity warned about this, lots of people/orgs affected
- ethn 9y agoI just received one of these as well. They seem to get their targets by compromising a single user and then by monitoring the people who are viewing the same Google Docs as the infected victim had in the past.
- killa_kyle 9y agoThis is burning through our office right now. emailing all clients! diablo!
- jakob223 9y agoEDIT: According to a Google representative on the reddit thread, this application is now blocked. If your account was affected, you no longer need to do anything. If you fell for this, changing your password is not the right solution - you want to log into your google account and remove permissions from the application. https://myaccount.google.com/permissions?pli=1 https://myaccount.google.com/permissions?pli=1 should show a list of apps connected to your account. Also, if you fell for this, you sent a bunch of emails to people like the one you received, so maybe tell them not to click.
- sebbean 9y agowhat application? i tried this and dont see anything in there that looks like it could be it
- EdwardMSmith 9y ago"Google Docs" with the real icon and everything.
- sebbean 9y agoNot seeing that weirdly. Could it be "google chrome"?
- cdubzzz 9y agoApparently Google has already shut this down. Likely they revoked the access from all accounts as well.
- bice 9y agoLink?
- el_duderino 9y agohttps://www.reddit.com/r/google/comments/692cr4/new_google_docs_phishing_scam_almost_undetectable/dh36pv2/ https://www.reddit.com/r/google/comments/692cr4/new_google_d...
- aaronmiler 9y agoOur support team is getting spammed a lot from our customers. We're in the education space, and it's spreading pretty quick. On initial inspection the URL looks harmless, but it's got some malicious params in there, mainly redirect_uri=https%3A%2F%2Fgoogledocs.g-docs.win%2Fg.php It appears to request read/send access to your email, and then spam all your contacts
- tedmiston 9y agoI received one with this address as well.
- pinaceae 9y agoamazing how large this is, our company just a massive wave of those. all from "internal" addresses.
- hemancuso 9y agoIt's a pretty nasty one, since it uses their standard OAuth flow with an app "Google Docs" to have users grant full access to their email and contacts. 1. I can't believe Google doesn't have basic filters to disallow developers from registering an app named "Google Docs" 2. Perhaps there should be some more validation/limits associated with allowing apps on the platform that can gain full access to email. A secure email account is the One True Source of authentication in the digital world. Google should make it way harder for people to get tricked into granting full access to their inbox.
- the_mitsuhiko 9y agoIs it actually Google or is there some unicode trickery going on?
- hemancuso 9y agoDoesn't look like a unicode trick on the app-strings I'm getting
- oh_sigh 9y agoIs there a database of homoglyphs for common fonts that one could use to write a visual string matching algorithm?
- mintplant 9y agohttp://www.unicode.org/Public/security/8.0.0/confusables.txt http://www.unicode.org/Public/security/8.0.0/confusables.txt https://github.com/codebox/homoglyph https://github.com/codebox/homoglyph http://homoglyphs.net/ http://homoglyphs.net/
- aaronmiler 9y agoFrom what I can tell, it's actually Google, but then they redirect you to a malicious URL after auth/approval
- 9y ago
- gigabo 9y agoReported as a service disruption on the status dashboard: > We're investigating reports of an issue with Google Drive. We will provide more information shortly. https://www.google.com/appsstatus#hl=en&v=issue&sid=4&iid=c708d68b1884a629816e361895c125a5 https://www.google.com/appsstatus#hl=en&v=issue&sid=4&iid=c7...
- MediaSquirrel 9y agoSame here
- seanp2k2 9y agoYes, it's phishing. More discussion: https://www.reddit.com/r/google/comments/692cr4/new_google_docs_phishing_scam_almost_undetectable/ https://www.reddit.com/r/google/comments/692cr4/new_google_d...
- EdwardMSmith 9y agoFeels like "I love you" all over again.
- kzisme 9y agoLink for the lazy https://en.wikipedia.org/wiki/ILOVEYOU https://en.wikipedia.org/wiki/ILOVEYOU
- r721 9y agoArticles: https://motherboard.vice.com/en_us/article/massive-gmail-google-doc-phishing-email https://motherboard.vice.com/en_us/article/massive-gmail-goo... https://www.theverge.com/2017/5/3/15534768/google-docs-phishing-attack-share-this-document-with-you-spam https://www.theverge.com/2017/5/3/15534768/google-docs-phish... https://blog.malwarebytes.com/cybercrime/2017/05/google-docs-app-spam-goes-phishing/ https://blog.malwarebytes.com/cybercrime/2017/05/google-docs...
- rst 9y agoSANS writeup: https://isc.sans.edu/diary/22372 https://isc.sans.edu/diary/22372
- caydo00n 9y agoAnyone know how far spread this is? it just Hit our school emails
- ceejayoz 9y agoVery. Convincing and nicely coded to spread. Thankfully, the attack method means Google just has to shut off the app in their systems (which they appear to have done).
- ocdtrekkie 9y agoLooks really wide. It hit our org too. Though in our case, we don't use Google accounts internally, and hence it isn't a threat to us. And it looks like Google is responding. The link in the emails no longer works, as the OAuth credentials have been revoked. I assume Google will be removing all the applicable app permission grants themselves.
- caydo00n 9y agoAnyone know how far spread this is? it just Hit our school emails
- stevewilhelm 9y agoLinks of interest: https://www.google.com/appsstatus#hl=en&v=issue&sid=4&iid=c708d68b1884a629816e361895c125a5 https://www.google.com/appsstatus#hl=en&v=issue&sid=4&iid=c7... https://www.reddit.com/r/google/comments/692cr4/new_google_docs_phishing_scam_almost_undetectable/?st=j29dyxal&sh=34df3bf4 https://www.reddit.com/r/google/comments/692cr4/new_google_d... https://www.theverge.com/2017/5/3/15534768/google-docs-phishing-attack-share-this-document-with-you-spam https://www.theverge.com/2017/5/3/15534768/google-docs-phish...
- et-al 9y agoFrom the reddit link it looks like Google has fixed it: > Googler here -- I'm escalating to the correct engineering and product teams now. > Edit: This is now resolved. Less than a half-hour after escalation, wow! =) > Final edit: problem is resolved. I clicked the link and got an "oauth client disabled" message. Not pretty, but at least you won't get phished.
- TorKlingberg 9y ago"Fixed" in the sense that this app is now blocked. Is there anything to stop an other worm like this, with a different name?
- Spoom 9y agoI'm sure they'll do a post-mortem and come up with additional protections, they just take longer than the immediate fix.
- sudom82 9y agoSource code of the worm: https://pastebin.com/raw/EKdKamFq https://pastebin.com/raw/EKdKamFq Edit: How I got this: Someone on reddit went to their site when it wasn't down, and downloaded the files linked in the page's HTML. I just posted it here. This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.
- FreezerburnV 9y agoWhere'd you get this?
- ben174 9y agoSending everything to this mailinator address which oddly seems to be empty: https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhhhhhh#/#public_maildirdiv https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhh... Maybe Mailinator has purged the box and is rejecting mail from it. Good on them.
- justusthane 9y agoPlease correct me if I'm wrong, but I don't think anything was being sent to that mailinator address. From looking at both that source code and emails received by my users, the mailinator address seems to be only in the message header "to" field, which, AFAIK, doesn't do anything other than display in the mail client. The actual recipient's address is in the envelope recipient field. I don't understand what the purpose of that mailinator address was.
- evan_ 9y agoIt sends an email to that mailinator address, with all of the contacts BCC'd. mailinator shut it down very quickly but emails definitely went to that address.
- ficklepickle 9y agoThey even used Google analytics! UA-98290545-1
- patmcguire 9y agoYes, it's all over.
- evan_ 9y agountil copycats start
- aaronmiler 9y agoJust checked the malicious link again. It looks like Google removed (at least one of) their access tokens Checked the URL containing: googledocs.g-docs.win%2Fg.php
- deleted 9y ago[deleted]
- mathattack 9y agoI got a few, then it died. Perhaps Google now recognizes this as spam.
- petervandijck 9y agoYes, same here.
- sudom82 9y agoedit: accidentally double posted double edit: 1. replied in above comment. 2. dunno. first time using HN, accidentally submitted twice when I was on comment posting cooldown I guess.
- tbodt 9y ago1. where did you get this 2. why did you post the link in 3 separate comments
- jaimehrubiks 9y agoThe only tricky thing is not seeing these weird permissions. Google may block naming an app "Google Docs" but someone could always trick it with "Google Docs." or whatever
- deleted 9y ago[deleted]
- aub3bhat 9y agoIts a malicious OAuth client (multiple clients?) that calls itself "Google Docs" and fooled user into giving access to read emails, while pretending to show as if it was needed by GDocs itself to access a Document, enabling launch of among other things password resets on other websites. the root problem seems to be that the identity of OAuth Servers is not authenticated/clearly shown, i.e. a malicious app can claim that its name is Google Docs even though it is not endorsed by Google. IMPORTANT NOTE: If you are running any website that has "Reset my password" it might be used by attacker, since even though the attacker does not have access to password, the attacker had access to email inbox. Thus the email password reset flow will allow attacker to compromise other websites that rely on Gmail account for password resets. https://twitter.com/zachlatta/status/859843151757955072?ref_src=twsrc%5Etfw&ref_url=https%3A%2F%2Ftwitter.com%2Fzachlatta%2Fstatus%2F859843151757955072 https://twitter.com/zachlatta/status/859843151757955072?ref_... https://www.dropbox.com/s/l024nggmcizub40/Screenshot%202017-05-03%2016.01.26.png?dl=0 https://www.dropbox.com/s/l024nggmcizub40/Screenshot%202017-...
- coleca 9y agoConsidering how easy it would be to filter this out, why has Google allowed it to continue spreading within their own email network? Obviously they have no control over what goes on outside of Gmail/G Suite, but inside their own network, they should be able to setup a basic filter to stop anything TO: hhhhhhh@mailinator or whatever it is. I received this email (but did not click the link) in my Gmail account from another Gmail user, so it never left the Google network. From the reports here it looks like it is still spreading even though Google disabled the app. With all of Google's machine learning expertise, how is it that this got past all of their SPAM detectors? It took me 2 seconds to hover over the link and see it was a crazy link that ended up at a domain called google.pro. Really? One of the world's largest and most advanced email systems couldn't figure that out?
- bitmapbrother 9y agoIt was shut down within 30 minutes.
- welder 9y agoNo it was more like hours from when I reported it and when the app was finally blocked.
- yuhong 9y agoReddit post: https://www.reddit.com/r/google/comments/692cr4/new_google_docs_phishing_scam_almost_undetectable/ https://www.reddit.com/r/google/comments/692cr4/new_google_d... (you can view complete timestamps by hovering.)
- deleted 9y ago[deleted]
- garyfirestorm 9y agoThis happened to me. An unknown person from my organization shared a Google doc. I didn't open it, and replied by saying 'what is this about?'. He said he didn't send any gdocs :|
- cloudaphant 9y agoAny clues what this was trying to do? I suppose we have to wait for Google to publicise what went on once OAuth had been granted.
- aub3bhat 9y agoMy guess spreading + password resets + searching for files that can be downloaded/later used for crypto blackmail? I think we are going to see some of the worst large scale ransom attempts shortly. They also timed it perfectly afternoon on hump day when everyone in USA is just getting ready for / back from lunch.
- wjke2i9 9y agoThings like this are bound to happen when you have centralized systems controlling everything with full control of the information (no zero-knowledge storage like email/document/communication encryption). You're essentially trusting one third party provider with everything in your life/business/organization.
- mailinatorguy 9y agoMailinator here: Yes, we sent the inbox to a blackhole but keep in mind, Mailinator does not and can not actually "Send" any email. It's a receive-only service. As always, any email "from" @mailinator.com has had it's reply-to forged (which is pretty trivial). Also - even before we blackholed the email, it's unlikely any email in that inbox (i.e. hhhh..) was read. Each box has a 50 email limit (FIFO) which was immediately overwhelmed. You couldn't click fast enough between seeing the inbox list and clicking an email. Mailinator is simply a "receiver" in all of this but we have no indication our servers were otherwise involved.
- vinchuco 9y agoThose can be easily harvested from there
- evan_ 9y ago> it's unlikely any email in that inbox (i.e. hhhh..) was read. Any way you can tell for sure? Do you have any logs that could be used to graph the spread of this? E.g. if you were able to find the earliest email to that mailbox you should be able to tell when it started, and with who.
- dghughes 9y agoHalf the people reading this post probably have gone there by now and read what's there.
- welder 9y ago> Each box has a 50 email limit (FIFO) which was immediately overwhelmed. That makes me think the malicious author didn't expect this to spread as wide as it did.
- mailinatorguy 9y agoIt's my guess that Mailinator is extremely irrelevant to their plan. They planned to propagate via BCC but they needed a "To:" address - preferably one that didn't bounce. So they hit the "h" key awhile, then added @mailinator.com
- philip1209 9y agoWow, Hired.com appears to have emailed all of their users about this. Must be spreadinq quickly. Note that they advise compromised users to change their password - which other comments indicate does not solve the issue. Below is the Hired notification. --- Important: Email Phishing Alert Hi <first name>, It has come to our attention that some of our users may have been hit with a Google Docs phishing scam. It appears that this scam has been spreading throughout the internet today, and is not isolated to Hired or our customers and candidates. If you want more information, you can read about it here[1] or here[2]. If you receive a Hired email that says that someone from Hired has shared a Google Doc with you, please validate with the sender before clicking the link or doing anything else. If you think your account may have been compromised, be sure to change your password immediately. We apologize for this interruption to your day. Please let us know if you have any questions. Thanks, The Hired team [1] https://www.theverge.com/2017/5/3/15534768/google-docs-phishing-attack-share-this-document-with-you-spam https://www.theverge.com/2017/5/3/15534768/google-docs-phish... [2] https://gizmodo.com/a-huge-and-dangerously-convincing-google-docs-phishin-1794888973 https://gizmodo.com/a-huge-and-dangerously-convincing-google...
- jmcdiesel 9y agoI work for a fortune 500 (wont disclose) but we just shut off email for our entire organization due to this...
- AdmiralAsshat 9y agoMy brother called me about 15 minutes ago to tell me this hit his student e-mail as well. I'd be curious at the postmortem how quickly this thing spread.
- btym 9y agoI love how simple this worm is. They haven't exploited any security holes (other that looking like Docs), it literally just asks for full access to your email address.
- ehsankia 9y agoYeah, I read articles calling it sophisticated. This is a super simple and straight forward worm. Disguise yourself as a known app and ask for more permission than you should. IDN exploits [0] and attachment faking [1] are more sophisticated if anything. [0] https://www.wordfence.com/blog/2017/04/chrome-firefox-unicode-phishing/ https://www.wordfence.com/blog/2017/04/chrome-firefox-unicod... [1] http://fortune.com/2017/01/18/google-gmail-scam-phishing/ http://fortune.com/2017/01/18/google-gmail-scam-phishing/
- shif 9y agoIt's sophisticated because of it's simplicity and effectiveness.
- chii 9y agoTechnical simplicity, but sophisticated social engineering. Guess what the weakest link is between apps? It sure isnt the tech.
- shmed 9y agoIts sophisticated in the sense that it makes you trust them and willingly share your information with them. It doesn't rely on some brute force method or some complicated hacking method, it simply rely on a modern workflow that people are used to go through without thinking twice about it. It is simple and incredibly efficient.
- M1233mjm 9y agoWhen can we expect a public statement regarding the phishing scam and the fallout? We all know it used our accounts to forward itself to everyone in our contact lists, but what about our emails? Have those also been forwarded/harvested? We need to know this to know how to react.
- ben_jones 9y agoWe have an entire generation that's been trained by big tech companies to instantly click agree, share, like, etc., buttons. This is only going to get worse.
- slrz 9y agoHi, I'm Google Docs. Would you please grant me access to your Google account so that I can read, send, delete and manage your mail, as well as manage your contacts?
- pmcpinto 9y agoI received it too
- ademarre 9y agoI reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations, which they chose not to implement. Here's the discussion on the IETF OAuth WG mailing list from that same time period: https://www.ietf.org/mail-archive/web/oauth/current/msg07625.html https://www.ietf.org/mail-archive/web/oauth/current/msg07625...
- bwackwat 9y agoThis is the most valuable comment here.
- paulddraper 9y agoUnicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.
- machine-wisdom 9y agoWhen you change your Google password, all OAuth tokens are revoked. The next time you use an OAuth connected App you will have to authorize it again, hopefully not making the same mistake twice.
- zeeveener 9y agoThe problem, it seems, is that we are increasing the complexity of the "Secure Software" in an attempt to thwart the most sophisticated attacks. However, as many people are already thinking, Complexity reduces Security and Stability. Therefore, it seems that the more we try to fight the "hackers", the more likely we will add some insecurity which they can exploit.
- glubGlub 9y ago
- packetized 9y agoEagerly awaiting the response from Cloudflare detailing their response, since all of the domains associated with this so far appear to have been hosted with them, or at least fronted by their service.
- TimButterfield 9y agoThere is also a Docusign phish email going around. I received a couple of them yesterday from mail2world, though signed by [company name].onmicrosoft.com for that user's business email address. They purported to be from people I knew.
- sergiotapia 9y agoJust received one as well. Source is Hired.com - according to them: https://cl.ly/1i0b0v110s0J https://cl.ly/1i0b0v110s0J --- Hi Sergio, It has come to our attention that some of our users may have been hit with a Google Docs phishing scam. It appears that this scam has been spreading throughout the internet today, and is not isolated to Hired or our customers and candidates. If you want more information, you can read about it here or here. If you receive a Hired email that says that someone from Hired has shared a Google Doc with you, please validate with the sender before clicking the link or doing anything else. If you think your account may have been compromised, be sure to change your password immediately. We apologize for this interruption to your day. Please let us know if you have any questions. Thanks, The Hired team
- _pergosausage 9y agoThe very same thing happened at my university. The sender is hhhhhhhhhhhhhhhh@mailinator.com
- mailinatorguy 9y agoUm. The TO address is hhhhhh@mailinator.com. Not the sender.
- yeboi 9y agoHere's an interesting case that I encountered (~1:20pm maybe): 1) I clicked on the link on my phone's email app. It looked super believable since it was coming from a person I was expecting a Google Doc invite from. I allowed access to "Google Docs" and then the page hit a 502 gateway error. 2) I tried it again on my computer by logging in, and this time, when the page was loading (after I allowed access), I saw the website was not legitimate (based on the url) SO I immediately closed the tab. Here's the interesting part: None of my contacts got a "Google Docs" invite from me - meaning I didn't "send" any mail. Any idea how I can see if the person behind this has my emails too via API requests?
- sumitgt 9y agoGo to your Google account's security settings and see which apps have access. Revoke access from any app that is not needed or has the display name "Google Docs".
- choxi 9y agoI got one from "DocuSign": https://twitter.com/choxi/status/844949531896655872 https://twitter.com/choxi/status/844949531896655872 The link went to a page that looked like Google Docs and asked for my Google login, but I noticed the domain was wrong so I didn't sign in. I tried the link again today and it looks like Chrome does flag it as a phishing site now.
- Clubber 9y agoThe bad thing about centralized internet is it makes some mail servers much juicer targets than the decentralized mail servers of old. I decided gmail wasn't for me when I read they harvested your emails for ads. 1GB in 2004 sounded so enticing too! If you are technically savvy and have access to a static IP, I highly recommend setting up postfix/dovecot and registering a domain. It's fairly straight forward for technical people. You can have it setup, soup to nuts in an hour or two. There's online docs everywhere. It's probably not going to be as secure as a gmail, but it's a much smaller target. Most internet providers will give you a static for an extra $5 or so.
- rspeer 9y agoAnd then nobody ever receives your mail because the big mail servers don't trust you.
- Macuyiko 9y agoYeah exactly - last time I went through the trouble of setting up my own e-mail I decided it just wasn't worth it between PTR records, dmarc, and SPF. It's possible, sure, but takes away all of the old-fashioned enjoyment of quickly setting up a Linux box with postfix and on your way you were.
- Clubber 9y agoI don't have that problem and my mail PTR doesn't reverse to my mail domain, it reverses to my ISP. Maybe because I have a really old domain.
- spydum 9y agoNext up, prepare for the inbox onslaught of every CASB provider hawking their wares and telling you all about the googpocalypse and how they are uniquely prepared to solve it!
- discreditable 9y agoG Suite admins: you can check for compromise by going to Reports > Token in the admin panel. A compromise looks like this: https://i.imgur.com/Dm0NNTn.png https://i.imgur.com/Dm0NNTn.png
- codedokode 9y agoAs we saw one should not let users decide who can get access to their email account. Users are easily fooled. Google should review all applications wanting such access manually. Though this is unrelated to the topic I think it would be good if Google reviewed apps permissions in Google Play too because users are bad at this.
- Markoff 9y agoso what should i tell my mom to avoid her Gmail being hacked in future same way? (it wasn't hacked since they had only English language audience this time) don't click on unknown links which take you to Google login page and never approve access to your data in any dialog?
- GrumpyNl 9y agoGoogle is on it https://techcrunch.com/2017/05/03/heres-googles-official-statement-on-todays-fast-spreading-phishing-attack/?ncid=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&sr_share=twitter https://techcrunch.com/2017/05/03/heres-googles-official-sta...
- sleepychu 9y agoIs there mitigation against deploying exactly this attack another way?
- wmblaettler 9y agoTo see the list of apps connected to your Google Account: https://myaccount.google.com/permissions https://myaccount.google.com/permissions
- ownc 9y agoMy teacher said not to open this email.
- ownc 9y agoMy fucking 6th fucking grade teacher said not to fucking open the fucking email.
- os400 9y agoG Suite customers have been asking for the ability to whitelist OAuth clients/scopes for their domains for years, for this exact reason. So far, Google hasn't really given a shit. I guess that might finally change now.
- cassie942 9y agothere was a warning may 4 about a massive google doc phising scam check on.digg.com/2py2k5g
- cassie942 9y agowarning may 4 of massive google docs phising scam check on.digg.com/2py2k5g