8 ms·
> “Click here to read more details” the email said. The click opened the “Google” password dialog, and the unlucky team member entered the password for our deve
by IncRnd 9y ago
> “Click here to read more details” the email said. The click opened the “Google” password dialog, and the unlucky team member entered the password for our developer account. This looked all legit to the team member, so we did not notice the pishing attack as such at this point. Pishing for Chrome extensions was simply not on our radar screen.
First, it is excellent that you disclosed the issue.
Second, based upon the quoted text you really aren't accepting responsibility for having been phished. The team member wasn't "unlucky." Your "radar" shouldn't trick you into thinking you won't be attacked.
- deleted 9y ago[deleted]
- Pxtl 9y agoWhile I normally agree, I think it's important that they referred to the specific person without using blaming language. The team failed and screwed up because they had bad policies with their account. The individual team member who was holding the keys when the screw-up happened? Unlucky. Fix the process, not the people. It's good that they're not throwing the poor person under the bus.
- hartator 9y agoI don't think more policies will make a better place. One of the team member screw up and stuff like this happen. I am questioning his security education to have been phished so easily.
- sillysaurus3 9y agoIt's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you. The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game. A policy of popping up a popup "glance at url bar" every time you copy your password from your password manager (which you're using, right?) would go a long way.
- charleslmunger 9y agoThat's a good habit, but a good tool to help you avoid getting phished is https://support.google.com/a/answer/6197508?hl=en https://support.google.com/a/answer/6197508?hl=en It alerts if you enter your google password anywhere but the real google sign in page.
- franciscop 9y ago> The only real defense is to glance at the url bar every time you're about to enter your password. With i18n not even that: https://www.theguardian.com/technology/2017/apr/19/phishing-url-trick-hackers https://www.theguardian.com/technology/2017/apr/19/phishing-... Benign POC: https://www.аррӏе.com/ https://www.xn--80ak6aa92e.com/ (open it and it'll look like a normal "l" in the url box)
- rhizome 9y agoYou might be surprised: https://pbs.twimg.com/media/CiWPIQSU4AAIndY.jpg https://pbs.twimg.com/media/CiWPIQSU4AAIndY.jpg
- greggman 9y agoAs someone who's been phished even though I've written article s on phishing in the past, all it takes is a moment of weakness. In my case everything looked normal at a glance. 2FA saved me but if they'd had asked for 2FA I wouldn't have noticed. https://blog.greggman.com/blog/getting-phished/ https://blog.greggman.com/blog/getting-phished/ Other people getting phished https://www.exploratorium.edu/blogs/tangents/we-got-phished-2 https://www.exploratorium.edu/blogs/tangents/we-got-phished-...
- Cthulhu_ 9y agoA simple policy to add would be 2-factor authentication, no single shared developer account, and (on Google's side), both another security challenge (2FA) and e-mail notification to both a primary and recovery e-mail address when an extension is moved. Pretty sure Google also raises a question when logging in from a new device, e.g. from Russia, or when certain information is changed. (I know Facebook did at least).
- crystaln 9y agoStating what happened is not blaming language. Characterizing the act as "unlucky" is excusing language, just as bad as blaming language. Assigning an error to mystical forces is unhelpful. Simply stating that the person entered the password into a phishing site is not blaming language, it is factual.
- IncRnd 9y agoI really wasn't calling to "fix the person." I agree with you. The email makes the situation appear as a process issue. Based upon the disclosure text, it seems quite possible the person wouldn't normally have clicked on an email text, but did so here based upon process. The disclosure displayed the attitude that they shouldn't have expected to get phished. It's 2017. Lots of people get phished. It's pretty straightforward to never click links that arrive in emails, to never enter passwords into webpages that open on their own. Of course there are technical ways to mitigate this specific attack, but it is more important not to excuse poor Internet hygiene after the fact.
- pryelluw 9y agoAccepting responsibility for being a victim of phishing? That could happen to the best of us.
- sillysaurus3 9y agoAnd it has. Part of my infosec career was spent phishing devs. Everyone scoffs at it until it happens to them. It's quite effective.
- 2muchcoffeeman 9y agoI find it strange the team member clicked on the link. For such high value accounts, always use google or type in the URL. Why would you click?
- cheez 9y agoI rely on my password manager: if it isn't filling in the password automatically, something is suspect. I wonder if I'm the only one who does this.
- sam_goody 9y agoI used to do that till lastpass had several vulns [1] in which passwords to all sites can be gotten by a malicious page or extension. If you use a password manager that auto fills in the paswords, it is open to an attack by a site or program that can fool it into thinking you have visited the site. Any malicious extension such as the one compromised her, has a good chance of being able to drain all your passwords. You are probably safer, even with phishing threats, to paste it in from another program each time. [1] http://thehackernews.com/2016/07/lastpass-password-manager.html http://thehackernews.com/2016/07/lastpass-password-manager.h...
- cheez 9y agoI am aware of that bug. However, Google wants to replace lastpass with Chrome sync, so no surprise that their employees are attacking it. Hopefully that made it better. I doubt even pasting it in is completely secure.
- codedokode 9y agoThe password login system is seriously flawed. I think people and websites should switch to physical keys. They are also easier to use because you don't have to remember complicated passwords.
- floatingatoll 9y agoIncorrect. They literally declared "we were phished", in plain words, describing how they were phished and the resulting attack. To say this does not "accept responsibility" is bullshit. You don't get to light the torches and grab the pitchforks to go chase some stranger who exposed you to vulnerability. They are human, they failed, and they're dealing it with professionally. I'm assuming from your tone of "I demand his head" that you were running the compromised extension, and wish to extract your pound of flesh from the person who compromised you. (EDIT: If not, what's your beef with them? Are you a competitor? Please explain!) This, too, is wrong. And here's why we don't play the blame game when it comes to human failures: You chose to run a Chrome extension, from an untrusted source, with only machine automation vetting its contents and auto-update ensuring that you get the latest attack. Of course you got compromised. What else did you expect? How could you place ultimate trust for all content in your browser in the hands of an OCR extension?! What on earth could compel you to accept such a ridiculous risk in exchange for this? Everyone's human, you included. They clearly stated and accepted responsibility for the incident. Now you need to stand up and accept responsibility for running unvetted code in your browser. (EDIT: Yes, it's machine-vetted. How's that working out for you?) There's more than enough blame to ensure you get an equal portion. Being human is bad enough without people coming to destroy you because they'd rather not confront their own failures of judgement. Get over your immature desire to get your vengeance for being compromised and build a better approach to your own personal security.
- lucaspiller 9y agoGiven it's a team account might have made usage a bit more complicated, but this sounds like something 2FA would have prevented, as even with the passsword the hackers wouldn't have been able to login.