7 ms·

EDIT: According to a Google representative on the reddit thread, this application is now blocked. If your account was affected, you no longer need to do anythin

EDIT: According to a Google representative on the reddit thread, this application is now blocked. If your account was affected, you no longer need to do anything. If you fell for this, changing your password is not the right solution - you want to log into your google account and remove permissions from the application. https://myaccount.google.com/permissions?pli=1 https://myaccount.google.com/permissions?pli=1 should show a list of apps connected to your account. Also, if you fell for this, you sent a bunch of emails to people like the one you received, so maybe tell them not to click.

sebbean 9y ago
what application? i tried this and dont see anything in there that looks like it could be it
- EdwardMSmith 9y ago
  "Google Docs" with the real icon and everything.
  - sebbean 9y ago
    Not seeing that weirdly. Could it be "google chrome"?
    - cdubzzz 9y ago
      Apparently Google has already shut this down. Likely they revoked the access from all accounts as well.
      - bice 9y ago
        Link?
        el_duderino 9y ago
        https://www.reddit.com/r/google/comments/692cr4/new_google_docs_phishing_scam_almost_undetectable/dh36pv2/ https://www.reddit.com/r/google/comments/692cr4/new_google_d...
    - jrs235 9y ago
      I've seen 2 client ids used and yes Google Docs and Google Chrome, not sure if google closed them both/all down. Here's a video on what to do/look for: http://youtu.be/fjEenkk9Ntk?hd=1 http://youtu.be/fjEenkk9Ntk?hd=1
- sebbean 9y ago
  Removed picasa, im guessin that's just Google Photos tho. so idk
- deleted 9y ago
  [deleted]
- jakob223 9y ago
  It will be called "google docs" because for some reason that's allowed.
sudom82 9y ago
Source code of the worm: https://hastebin.com/gubegaqusi.xml https://hastebin.com/gubegaqusi.xml Pretty much what you'd expect. Edit: This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.
- mintplant 9y ago
  Heh, they're using Google Analytics to track its spread. That's a nice touch.
  - taf2 9y ago
    It's possible to send any data we want to their Analytics tracker... perhaps we send them some spam?
    - soared 9y ago
      Where is ilovevitaly when you need him?!
  - smacktoward 9y ago
    "No fair! You got your privacy invasion in my privacy invasion!"
  - emersonrsantos 9y ago
    That made my day.
- ben174 9y ago
  Sending everything to this mailinator address which oddly seems to be empty: https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhh.. https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhh.... Maybe Mailinator has purged the box and is rejecting mail from it. Good on them.
  - sudom82 9y ago
    Mailinator purged it early on yeah.
jrs235 9y ago
Here's a video I made on what you or they need to do: http://youtu.be/fjEenkk9Ntk?hd=1 http://youtu.be/fjEenkk9Ntk?hd=1
ghostly_s 9y ago
> If your account was affected, you no longer need to do anything. How do you figure? An unknown actor presumably had full access to your email inbox for a non-zero amount of time and the proper remediation is "nothing"? If I was concerned this had affected me I would right now be changing my passwords to ____everything____.
- bitskits 9y ago
  What attack vector does changing your password help with? Are you concerned they could have recovered the account password via the Oauth scope?
  - motti 9y ago
    Changing your password is the fastest way to ensure all authed sessions on any device is logged out. Google offers a "log out of any sessions" button somewhere in account settings, but most other services don't. If your email account is compromised, any service that do password resets via email confirmation, are potentially compromised by whoever has access to your email via OAuth.
    - bitskits 9y ago
      I'm pretty sure that changing your password does NOT revoke your oauth scopes, which was the attack vector here.
  - askvictor 9y ago
    The greater issue is the passwords of other accounts, which could now be 'recovered' as the attacker has your access to your email
    - bitskits 9y ago
      Yes, I agree, although revoking the scope should remove the access (and I assume Google did that for everyone already).
- 9y ago

sebbean 9y ago

what application? i tried this and dont see anything in there that looks like it could be it

EdwardMSmith 9y ago
"Google Docs" with the real icon and everything.
- sebbean 9y ago
  Not seeing that weirdly. Could it be "google chrome"?
  - cdubzzz 9y ago
    Apparently Google has already shut this down. Likely they revoked the access from all accounts as well.
    - bice 9y ago
      Link?
      - el_duderino 9y ago
        https://www.reddit.com/r/google/comments/692cr4/new_google_docs_phishing_scam_almost_undetectable/dh36pv2/ https://www.reddit.com/r/google/comments/692cr4/new_google_d...
  - jrs235 9y ago
    I've seen 2 client ids used and yes Google Docs and Google Chrome, not sure if google closed them both/all down. Here's a video on what to do/look for: http://youtu.be/fjEenkk9Ntk?hd=1 http://youtu.be/fjEenkk9Ntk?hd=1
sebbean 9y ago
Removed picasa, im guessin that's just Google Photos tho. so idk
deleted 9y ago
[deleted]
jakob223 9y ago
It will be called "google docs" because for some reason that's allowed.

sudom82 9y ago

Source code of the worm: https://hastebin.com/gubegaqusi.xml https://hastebin.com/gubegaqusi.xml Pretty much what you'd expect. Edit: This isn't the full source code. There was another PHP file visible on their website that unfortunately isn't visible anymore.

mintplant 9y ago
Heh, they're using Google Analytics to track its spread. That's a nice touch.
- taf2 9y ago
  It's possible to send any data we want to their Analytics tracker... perhaps we send them some spam?
  - soared 9y ago
    Where is ilovevitaly when you need him?!
- smacktoward 9y ago
  "No fair! You got your privacy invasion in my privacy invasion!"
- emersonrsantos 9y ago
  That made my day.
ben174 9y ago
Sending everything to this mailinator address which oddly seems to be empty: https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhh.. https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhh.... Maybe Mailinator has purged the box and is rejecting mail from it. Good on them.
- sudom82 9y ago
  Mailinator purged it early on yeah.

jrs235 9y ago

Here's a video I made on what you or they need to do: http://youtu.be/fjEenkk9Ntk?hd=1 http://youtu.be/fjEenkk9Ntk?hd=1

ghostly_s 9y ago

> If your account was affected, you no longer need to do anything. How do you figure? An unknown actor presumably had full access to your email inbox for a non-zero amount of time and the proper remediation is "nothing"? If I was concerned this had affected me I would right now be changing my passwords to ____everything____.

bitskits 9y ago
What attack vector does changing your password help with? Are you concerned they could have recovered the account password via the Oauth scope?
- motti 9y ago
  Changing your password is the fastest way to ensure all authed sessions on any device is logged out. Google offers a "log out of any sessions" button somewhere in account settings, but most other services don't. If your email account is compromised, any service that do password resets via email confirmation, are potentially compromised by whoever has access to your email via OAuth.
  - bitskits 9y ago
    I'm pretty sure that changing your password does NOT revoke your oauth scopes, which was the attack vector here.
- askvictor 9y ago
  The greater issue is the passwords of other accounts, which could now be 'recovered' as the attacker has your access to your email
  - bitskits 9y ago
    Yes, I agree, although revoking the scope should remove the access (and I assume Google did that for everyone already).
9y ago