10 ms·

Google Phishing Quiz

135 points by technion 8y ago

abtinf 8y ago
I had no idea google allows arbitrary redirects through its own https://google.com https://google.com domain. Why?
- edm0nd 8y ago
  open redirects have always been a thing.
- lol768 8y ago
  They don't seem to consider open redirects an issue worth mitigating (see https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect https://sites.google.com/site/bughunteruniversity/nonvuln/op...). Though in the example given, they have taken the sensible step of inserting an interstitial warning page, there are known URLs (e.g. https://vagmour.eu/google-open-url-redirection/ https://vagmour.eu/google-open-url-redirection/) that don't use such a page. Personally, I don't think it's particularly realistic to expect users to be able to work out when an open redirect is being abused in a phishing attack - particularly if e.g. other junk query string parameters are used to obfuscate the destination, or a domain is chosen that looks like it could legitimately be part of a site's URL structure. Checking the domain gets you some peace of mind (assuming it's not abusing lookalike Unicode characters!) but if there are "reflected" or even "stored" open redirects [1] on the domain then all bets are off. I don't think I could confidently make a decision regarding the safety of such a link except by following it (with e.g. curl -L) and seeing what happened. [1] I'm abusing XSS terminology here by applying it to redirects, but hopefully the meaning is clear. I consider a "stored open redirect" a page under a user-known-safe domain where an attacker can persist the final destination s.t. it's not visible in the original URL.
- AgentEpsilon 8y ago
  Actually, it looks like navigating to the link you're talking about https://google.com/amp/tinyurl.com/y7u8ewlr https://google.com/amp/tinyurl.com/y7u8ewlr, or any link beginning with https://google.com/amp/ https://google.com/amp/, will first bring you to a redirect confirmation, not immediately redirect you. (The shortlink above is actually safe - it redirects to https://jigsaw.google.com/ https://jigsaw.google.com/)
  - philcolbourn 8y ago
    does anyone know where google documents this?
orastor 8y ago
Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now
- ceejayoz 8y ago
  The inclusion of that one kinda baffled me. No way for me to tell whether the app that's connecting would be one I'd want reading emails (I wasn't familiar with it) and without an address bar, hard to tell if it's a spoof or the real thing.
  - wetpaste 8y ago
    Yeah, I mean it doesn't say the context very well, so I assumed it I clicked on a link. Like if it said you signed up for a service and clicked on a link to do something very specific. If I accidentally clicked on a link in my email and it brought that page up, could you call it phishing? Also the email from the person with the PDF. Like, why is that phishing? What if I trusted the sender? People send pdfs all the time. are there no secure ways to read pdfs?
    - rnotaro 8y ago
      I think it was mostly due to the fact that it was from a different TLD. The TLD of the context was .EDU and the one from the email was a .ORG.
- cbanek 8y ago
  Yeah, anyone asking for that, even if it's not a phishing attempt would never get the OK from me. That's just crazy.
  - jopsen 8y ago
    I suppose it might make sense if you were installing a 3rd party gmail application on your desktop. I'm no oauth expert, but I would imagine an app would go through a flow like this.
cbanek 8y ago
I missed two: the "allow some random person to read your email" which I would never click on, and the one that had a PDF, even though they don't allow you to do anything with it. Just because someone sends you a PDF doesn't mean it's an attack vector. It would have been more helpful to say something like "this is someone you do business with as well, or someone you've never heard of." (which I find to be more useful signal on if I want to look at an attachment, though even if they are someone I know, do they have a reason to send me that PDF is the second question). Unsolicited attachments are always suspect.
- justusthane 8y ago
  On the PDF one, it tells you in the "intro" blurb that the sender's email address is wrong. Should be .edu and it's .org.
  - cbanek 8y ago
    Ah thanks, I must have missed that. If it's the wrong address then definitely suspect.
  - verbify 8y ago
    I don't know if that would be enough in real life for me. I know some organisations use two different domains (e.g. they did a transition but they don't want to turn off .org just in case something still uses it, the IT team forgot that Sam has two Outlook profiles, one is on .org). And while pdfs can be attack vectors, they're not an especially strong one - it's not like running an exe with administrator privileges. Comparatively giving a third party access to your emails should definitely raise flags.
    - Zarel 8y ago
      They even had a legitimate example, of Dropbox sending an email from dropboxemail.com. I honestly think this should never be done because users shouldn't be expected to know which domains you do and don't own.
deleted 8y ago
[deleted]
tapland 8y ago
This works very similarly to HoxHunt: https://tech.eu/brief/finnish-startup-hoxhunt-secures-e2-5-million-for-its-cybersecurity-gamification-platform/ https://tech.eu/brief/finnish-startup-hoxhunt-secures-e2-5-m...
zulln 8y ago
A bit annoying that the fact that Dropbox used HTTPS-links are highlighted as a sign of it being legit. I have always suspected such advices makes people think HTTPS are actually somehow magically secure, while it has nothing to do with phishing related issues.
- LambdaComplex 8y ago
  I guess that depends on whether or not MITM is an attack vector that you're concerned about
jtokoph 8y ago
While the domain is a legit Google domain, I find it ironic that it’s hosted on “withgoogle.com”. If my parents followed my anti-phishing tips they would fail by clicking this link.
- bduerst 8y ago
  withgoogle.com is more of a 'sandbox' for Google one-off programs, labs, events, etc. which don't need to have the same branding guidelines as on google.com domain.
  - scarmig 8y ago
    ...so? It's still a phishing vector. Teaching users that sometimes Google throws together half-assed domains encourages them to trust any domain with "google" in it.
    - scarmig 8y ago
      Just for example, the following domains are all available: workingoogle.com labsgoogle.com labsatgoogle.com learngoogle.org learnatgoogle.com youatgoogle.com bygoogle.co securitywithgoogle.com mailatgoogle.com realgoogle.com etc.
    - bduerst 8y ago
      AFAIK they don't have any pages there that allow account login, for that and other security reasons.
      - owaty 8y ago
        Yes, but: > Create a name and email — neither need to be real — to make this quiz seem more realistic. Don’t worry, this information won’t leave your device. I'd trust this notice if I knew it came from Google, but since it was placed on a phishy-looking website, it really gave me pause.
      - zulln 8y ago
        https://www.google.com/search?q=site%3Awithgoogle.com+login https://www.google.com/search?q=site%3Awithgoogle.com+login
julianozen 8y ago
I wanted to point out one of the phishing schemes used a google amp link to disguise a URL as being from google..... sigh <insert regular complaint of google amp ruining the web>
- londons_explore 8y ago
  My bet is on this site being developed by a google security team to try to embarrass other teams around google to get their act together and close flaws like this. The concept of AMP for example should have been built into browsers, perhaps as a new protocol, for example: amp:https://newyorktimes.com https://newyorktimes.com Then the browser can go to any amp-provider to retrieve the amp page, which will be signed by the origin that it came from so the browser can still validate the amp-provider hasn't tampered anything. That model would also let any company be an amp provider with no trust required. The benefit of AMP is much reduced with QUIC zero-rtt resume anyway.
  - PaulBGD_ 8y ago
    Or just `amp://nytimes.com`, would make more sense even if it's being sent over https.
gregmac 8y ago
I dislike several aspects of this quiz, and think it's actively harmful to users. It's great to train on the URLs, but that's not the only warning sign with these. --- 1) "Hey there. Here is the doc you asked for." Did you ask for a doc? Do you know this person? If no, these facts alone should be giant warning signs. --- 2) Fax Message from efacks.com Do you have an account with this service, where you explicitly signed up to receive faxes? If not, obviously you shouldn't be getting faxes from them so it's not legitimate. --- 5) "Please find attached the 2019 financial activity report for your perusal." Aside from giving away the answer in the title [1], this isn't a good example. First line of defense, once again: Do you have an account with "Westmount Day School", and are you expecting a "financial activity report"? Also, spoofing "from" e-mail addresses is a thing, and completely trivial, so relying on that is not a way to verify authenticity. What's not mentioned is being aware of what PDF reader you're using: eg, do you regularly make sure it's up to date? Personally, I use Chrome as my PDF reader as I'm not a fan of Adobe products or their security track record in general. Also in my experience, these types of e-mails often come in with an attachment like "2019 F.A.R.pdf.exe" (or a zip file that contains an exe), and not an actual PDF file. This would have been a great way to train users on this point. --- 6) "Someone has your password" The two reasons that this isn't legitimate are listed as "We don't use google.support to send emails" and "This link points to a subdomain of ml-security.org, not Google." [2] So once again, spoofing "from" addresses is trivial -- so that is not a security measure. Secondly, how should I know what mail comes from? There was an earlier example of a legitimate message from Dropbox coming from a non-dropbox.com address (dropboxmail.com). Also, the best defense against this is not mentioned: Never log into sites by clicking on links in e-mails! This includes changing your password. The only exception to this is a password reset mail when you explicitly just asked for a password reset. --- 7) "Government-backed attackers may be trying to steal your password" Once again, "Change password" link in e-mail. Don't click it. --- 8) Tripit Security prompt [3] Sorry, but this is a terrible example. First of all, am I trying to perform some action with Tripit that this prompt is expected? If no, don't allow (in fact, just close the window) Secondly, what does my browser window show? If you're on google.com (or gmail.com) and this appears, that's one thing, but if your browser is showing google.security-check.se then no, don't click anything and just close the window. Third, even assuming this is all okay, do you want Tripit to have access to view email messages and settings? If all you were trying to do is use your Google account to authenticate, the fact it wants access to view all your messages is highly suspicious. In this particular case (because it's Tripit, a service that parses your email), this is probably your intention, but if it also asked for other permissions -- such as ability to manage contacts and send messages on your behalf -- you might want to think twice. --- Training like this is good, but phishing e-mails can be very devious and training users on the wrong things -- such as trusting "from" addresses, not considering context, and not looking at actual attachment types -- is extremely dangerous. In the worst case, it can train users to click on things they otherwise wouldn't have, due to false confidence obtained by (inadequate) training. [1] https://i.imgur.com/8mNePZS.png https://i.imgur.com/8mNePZS.png [2] https://i.imgur.com/tpJMb5n.png https://i.imgur.com/tpJMb5n.png [3] https://i.imgur.com/KfNDuZI.png https://i.imgur.com/KfNDuZI.png
ken 8y ago
It says PDF is a potential attack vector. Have there been any attacks on Preview.app, since it became sandboxed?
- baroffoos 8y ago
  I think its referring to adobe reader which allows PDFs to run arbitrary code as well as 100000 other anti-features.
- underwater 8y ago
  We'll thankfully they gave us the actionable advice to ”be careful”. What does that even mean?
jimhefferon 8y ago
It says: Incorrect! Not everything is bad. I think that is mistaken.
technion 8y ago
Hi All, I posted this here because I think it's great there's some effort being put into free training in this region. I do however agree with some of the comments here. I had been hunting for something like this to use as our own training, but it won't be this because I don't agree with the TripIt example. Edit: Maybe there should be a "maybe" or "consider" answer. "This is a legitimate company. However, their desire to access your email is something you should carefully consider".
- bargl 8y ago
  100% this. I think sometimes people miss the target demographic for something like this. My 70s+ year old dad and mom got phished. This might help them understand why they shouldn't have clicked the link. A technical solution to security should be sought out as well. This doesn't remove ANY responsibility from companies for having good security. It does help to empower the less technical users.
scarmig 8y ago
Phishing, especially the targeted type, is impossible to combat at scale, and expecting users to know the ins and outs of what's a safe domain (withgoogle.com? Is it safe or not?) or to try to identify legitimate communications is a stupid waste of time. Long term the solution is ubiquitous hardware-based 2FA, ideally incorporated into the physical devices themselves.
- bargl 8y ago
  True, but a solution doesn't have to be single sided. I can easily send this link to my parents and then they know a little more. Expecting users to know is ridiculous, but offering tools for people to help educate their less tech savvy loved ones is awesome. That's kinda how I see this. It helps me empower my parents a little more.
  - scarmig 8y ago
    I agree that it doesn't have to be single-sided, and we need multiple angles to protect against phishing. This quiz isn't it, though. You and I know what domains are; we know what's possible; we can sense when somethings off. It's our bread and butter. The average user knows none of these things, and giving them a dozen rules to follow that will work a lot of the time is in the end confusing. A better set of rules to link your parents to is this: 1) Trust nothing over email. If your bank sends you a notification, don't click on the link in your email: just go directly to your bank's website and log in. 2) That's about it.
    - ptoomey3 8y ago
      I’m not even convinced “don’t click links” is the best guidance. That message has been pushed so hard that people immediately think their machine has been compromised once they have clicked a shady link. That is nearly never the case. Clicking links isn’t something that should cause fear. Nobody is burning a modern browser vuln in a spam email. I think the message should be more focused on not manually entering credentials into a site. Lean on your browser to validate domains and know which sites are associated with which credential. I say that somewhat aspirationaly , as I still think there is lots of room for how well browsers and password managers work for novice users.
iambateman 8y ago
Cool idea confounded by the reality that many many people notice phishing on a quiz who would not notice in ordinary life.
Phishing 8y ago
Phishing.
invalidusernam3 8y ago
Funny considering Google still has a UX vulnerability in their gmail interface: https://eligrey.com/blog/google-inbox-spoofing-vulnerability/ https://eligrey.com/blog/google-inbox-spoofing-vulnerability... "The link mailto:”support@paypal.com”<scam@phisher.example> shows up as “support@paypal.com” in the Google Inbox composition window, visually identical to any email actually sent to PayPal." It has been fixed in the web version, but apparently the Android app still has this issue
SalimoS 8y ago
I missed only the .org instead of .edu (was thinking the establishment have the two domain name) As for the TripIt we may don’t have the same definition of fishing As the mail was a ligitime mail from google to request access to my account from an app (and that’s what’s about the quizz) as for if did I used that app or now that’s another story
Angostura 8y ago
withgoogle.com is clearly a phishing domain.
SimeVidas 8y ago
LOL One of the phishing examples is a page hosted on Google AMP Cache.
- aboutruby 8y ago
  Same as people using goo.gl URLs
- underwater 8y ago
  ”This one is a little tricky”. No, it's a complete security trainwreck that Google have opted into for no good reason.
yellowapple 8y ago
I missed the one with the PDF attachment, for multiple reasons: * To my knowledge, there are no extant PDF-based viruses that would affect me (on either Linux or OpenBSD), and just because something's infected with malware doesn't mean it's a phishing attempt (it could be that it's a legitimate email from a sender whose computer is infected with some malware that spreads itself through PDFs). * The PDF is actually attached, so if this were a real email it would pop up in Gmail's built-in attachment viewer (and any errors occurring there would be more cause for alarm). * Not all schools use .edu domains at all, let alone exclusively. All things considered, the question's wrong. It's not conclusively a phishing attempt. It might be some other kind of malicious email, but phishing emails are a subset of malicious emails, not the other way around (just like how all carrots are vegetables but not all vegetables are carrots).
dustinevan 8y ago
Wait. So why didn't google just put this on a subdomain? It's a phishing quiz at a phishy domain, and the first thing that happens on iphone is it asks for your name and email (instructions are covered up)
amayne 8y ago
The Tripit one is very problematic. They don’t say that you installed TripIt. I’m supposed to allow any Google third-party access to my email? Even if I didn’t initiate that? Hovering over the “allow” button doesn’t show anything. They need to reword that one.
rsaraceni 8y ago
I was really surprise that they could embed a tinyurl inside a google url. Got 6 / 8.
Leace 8y ago
What happened with the Gmail's Authenticated Senders key icon for e-mails from certain high profile sites that properly validate through DMARC? (described e.g. here [0]) [0]: https://www.pcworld.com/article/2921383/software/4-gmail-labs-features-you-should-be-using.html https://www.pcworld.com/article/2921383/software/4-gmail-lab...
alex_young 8y ago
Anyone else think the domain for this seems suspect? Why not just use google.com? This is pretty meta.

135 points by technion 8y ago

abtinf 8y ago

I had no idea google allows arbitrary redirects through its own https://google.com https://google.com domain. Why?

edm0nd 8y ago
open redirects have always been a thing.
lol768 8y ago
They don't seem to consider open redirects an issue worth mitigating (see https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect https://sites.google.com/site/bughunteruniversity/nonvuln/op...). Though in the example given, they have taken the sensible step of inserting an interstitial warning page, there are known URLs (e.g. https://vagmour.eu/google-open-url-redirection/ https://vagmour.eu/google-open-url-redirection/) that don't use such a page. Personally, I don't think it's particularly realistic to expect users to be able to work out when an open redirect is being abused in a phishing attack - particularly if e.g. other junk query string parameters are used to obfuscate the destination, or a domain is chosen that looks like it could legitimately be part of a site's URL structure. Checking the domain gets you some peace of mind (assuming it's not abusing lookalike Unicode characters!) but if there are "reflected" or even "stored" open redirects [1] on the domain then all bets are off. I don't think I could confidently make a decision regarding the safety of such a link except by following it (with e.g. curl -L) and seeing what happened. [1] I'm abusing XSS terminology here by applying it to redirects, but hopefully the meaning is clear. I consider a "stored open redirect" a page under a user-known-safe domain where an attacker can persist the final destination s.t. it's not visible in the original URL.
AgentEpsilon 8y ago
Actually, it looks like navigating to the link you're talking about https://google.com/amp/tinyurl.com/y7u8ewlr https://google.com/amp/tinyurl.com/y7u8ewlr, or any link beginning with https://google.com/amp/ https://google.com/amp/, will first bring you to a redirect confirmation, not immediately redirect you. (The shortlink above is actually safe - it redirects to https://jigsaw.google.com/ https://jigsaw.google.com/)
- philcolbourn 8y ago
  does anyone know where google documents this?

orastor 8y ago

Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now

ceejayoz 8y ago
The inclusion of that one kinda baffled me. No way for me to tell whether the app that's connecting would be one I'd want reading emails (I wasn't familiar with it) and without an address bar, hard to tell if it's a spoof or the real thing.
- wetpaste 8y ago
  Yeah, I mean it doesn't say the context very well, so I assumed it I clicked on a link. Like if it said you signed up for a service and clicked on a link to do something very specific. If I accidentally clicked on a link in my email and it brought that page up, could you call it phishing? Also the email from the person with the PDF. Like, why is that phishing? What if I trusted the sender? People send pdfs all the time. are there no secure ways to read pdfs?
  - rnotaro 8y ago
    I think it was mostly due to the fact that it was from a different TLD. The TLD of the context was .EDU and the one from the email was a .ORG.
cbanek 8y ago
Yeah, anyone asking for that, even if it's not a phishing attempt would never get the OK from me. That's just crazy.
- jopsen 8y ago
  I suppose it might make sense if you were installing a 3rd party gmail application on your desktop. I'm no oauth expert, but I would imagine an app would go through a flow like this.

cbanek 8y ago

I missed two: the "allow some random person to read your email" which I would never click on, and the one that had a PDF, even though they don't allow you to do anything with it. Just because someone sends you a PDF doesn't mean it's an attack vector. It would have been more helpful to say something like "this is someone you do business with as well, or someone you've never heard of." (which I find to be more useful signal on if I want to look at an attachment, though even if they are someone I know, do they have a reason to send me that PDF is the second question). Unsolicited attachments are always suspect.

justusthane 8y ago
On the PDF one, it tells you in the "intro" blurb that the sender's email address is wrong. Should be .edu and it's .org.
- cbanek 8y ago
  Ah thanks, I must have missed that. If it's the wrong address then definitely suspect.
- verbify 8y ago
  I don't know if that would be enough in real life for me. I know some organisations use two different domains (e.g. they did a transition but they don't want to turn off .org just in case something still uses it, the IT team forgot that Sam has two Outlook profiles, one is on .org). And while pdfs can be attack vectors, they're not an especially strong one - it's not like running an exe with administrator privileges. Comparatively giving a third party access to your emails should definitely raise flags.
  - Zarel 8y ago
    They even had a legitimate example, of Dropbox sending an email from dropboxemail.com. I honestly think this should never be done because users shouldn't be expected to know which domains you do and don't own.

deleted 8y ago

[deleted]

tapland 8y ago

This works very similarly to HoxHunt: https://tech.eu/brief/finnish-startup-hoxhunt-secures-e2-5-million-for-its-cybersecurity-gamification-platform/ https://tech.eu/brief/finnish-startup-hoxhunt-secures-e2-5-m...

zulln 8y ago

A bit annoying that the fact that Dropbox used HTTPS-links are highlighted as a sign of it being legit. I have always suspected such advices makes people think HTTPS are actually somehow magically secure, while it has nothing to do with phishing related issues.

LambdaComplex 8y ago
I guess that depends on whether or not MITM is an attack vector that you're concerned about

jtokoph 8y ago

While the domain is a legit Google domain, I find it ironic that it’s hosted on “withgoogle.com”. If my parents followed my anti-phishing tips they would fail by clicking this link.

bduerst 8y ago
withgoogle.com is more of a 'sandbox' for Google one-off programs, labs, events, etc. which don't need to have the same branding guidelines as on google.com domain.
- scarmig 8y ago
  ...so? It's still a phishing vector. Teaching users that sometimes Google throws together half-assed domains encourages them to trust any domain with "google" in it.
  - scarmig 8y ago
    Just for example, the following domains are all available: workingoogle.com labsgoogle.com labsatgoogle.com learngoogle.org learnatgoogle.com youatgoogle.com bygoogle.co securitywithgoogle.com mailatgoogle.com realgoogle.com etc.
  - bduerst 8y ago
    AFAIK they don't have any pages there that allow account login, for that and other security reasons.
    - owaty 8y ago
      Yes, but: > Create a name and email — neither need to be real — to make this quiz seem more realistic. Don’t worry, this information won’t leave your device. I'd trust this notice if I knew it came from Google, but since it was placed on a phishy-looking website, it really gave me pause.
    - zulln 8y ago
      https://www.google.com/search?q=site%3Awithgoogle.com+login https://www.google.com/search?q=site%3Awithgoogle.com+login

julianozen 8y ago

I wanted to point out one of the phishing schemes used a google amp link to disguise a URL as being from google..... sigh <insert regular complaint of google amp ruining the web>

londons_explore 8y ago
My bet is on this site being developed by a google security team to try to embarrass other teams around google to get their act together and close flaws like this. The concept of AMP for example should have been built into browsers, perhaps as a new protocol, for example: amp:https://newyorktimes.com https://newyorktimes.com Then the browser can go to any amp-provider to retrieve the amp page, which will be signed by the origin that it came from so the browser can still validate the amp-provider hasn't tampered anything. That model would also let any company be an amp provider with no trust required. The benefit of AMP is much reduced with QUIC zero-rtt resume anyway.
- PaulBGD_ 8y ago
  Or just `amp://nytimes.com`, would make more sense even if it's being sent over https.

gregmac 8y ago

I dislike several aspects of this quiz, and think it's actively harmful to users. It's great to train on the URLs, but that's not the only warning sign with these. --- 1) "Hey there. Here is the doc you asked for." Did you ask for a doc? Do you know this person? If no, these facts alone should be giant warning signs. --- 2) Fax Message from efacks.com Do you have an account with this service, where you explicitly signed up to receive faxes? If not, obviously you shouldn't be getting faxes from them so it's not legitimate. --- 5) "Please find attached the 2019 financial activity report for your perusal." Aside from giving away the answer in the title [1], this isn't a good example. First line of defense, once again: Do you have an account with "Westmount Day School", and are you expecting a "financial activity report"? Also, spoofing "from" e-mail addresses is a thing, and completely trivial, so relying on that is not a way to verify authenticity. What's not mentioned is being aware of what PDF reader you're using: eg, do you regularly make sure it's up to date? Personally, I use Chrome as my PDF reader as I'm not a fan of Adobe products or their security track record in general. Also in my experience, these types of e-mails often come in with an attachment like "2019 F.A.R.pdf.exe" (or a zip file that contains an exe), and not an actual PDF file. This would have been a great way to train users on this point. --- 6) "Someone has your password" The two reasons that this isn't legitimate are listed as "We don't use google.support to send emails" and "This link points to a subdomain of ml-security.org, not Google." [2] So once again, spoofing "from" addresses is trivial -- so that is not a security measure. Secondly, how should I know what mail comes from? There was an earlier example of a legitimate message from Dropbox coming from a non-dropbox.com address (dropboxmail.com). Also, the best defense against this is not mentioned: Never log into sites by clicking on links in e-mails! This includes changing your password. The only exception to this is a password reset mail when you explicitly just asked for a password reset. --- 7) "Government-backed attackers may be trying to steal your password" Once again, "Change password" link in e-mail. Don't click it. --- 8) Tripit Security prompt [3] Sorry, but this is a terrible example. First of all, am I trying to perform some action with Tripit that this prompt is expected? If no, don't allow (in fact, just close the window) Secondly, what does my browser window show? If you're on google.com (or gmail.com) and this appears, that's one thing, but if your browser is showing google.security-check.se then no, don't click anything and just close the window. Third, even assuming this is all okay, do you want Tripit to have access to view email messages and settings? If all you were trying to do is use your Google account to authenticate, the fact it wants access to view all your messages is highly suspicious. In this particular case (because it's Tripit, a service that parses your email), this is probably your intention, but if it also asked for other permissions -- such as ability to manage contacts and send messages on your behalf -- you might want to think twice. --- Training like this is good, but phishing e-mails can be very devious and training users on the wrong things -- such as trusting "from" addresses, not considering context, and not looking at actual attachment types -- is extremely dangerous. In the worst case, it can train users to click on things they otherwise wouldn't have, due to false confidence obtained by (inadequate) training. [1] https://i.imgur.com/8mNePZS.png https://i.imgur.com/8mNePZS.png [2] https://i.imgur.com/tpJMb5n.png https://i.imgur.com/tpJMb5n.png [3] https://i.imgur.com/KfNDuZI.png https://i.imgur.com/KfNDuZI.png

ken 8y ago

It says PDF is a potential attack vector. Have there been any attacks on Preview.app, since it became sandboxed?

baroffoos 8y ago
I think its referring to adobe reader which allows PDFs to run arbitrary code as well as 100000 other anti-features.
underwater 8y ago
We'll thankfully they gave us the actionable advice to ”be careful”. What does that even mean?

jimhefferon 8y ago

It says: Incorrect! Not everything is bad. I think that is mistaken.

technion 8y ago

Hi All, I posted this here because I think it's great there's some effort being put into free training in this region. I do however agree with some of the comments here. I had been hunting for something like this to use as our own training, but it won't be this because I don't agree with the TripIt example. Edit: Maybe there should be a "maybe" or "consider" answer. "This is a legitimate company. However, their desire to access your email is something you should carefully consider".

bargl 8y ago
100% this. I think sometimes people miss the target demographic for something like this. My 70s+ year old dad and mom got phished. This might help them understand why they shouldn't have clicked the link. A technical solution to security should be sought out as well. This doesn't remove ANY responsibility from companies for having good security. It does help to empower the less technical users.

scarmig 8y ago

Phishing, especially the targeted type, is impossible to combat at scale, and expecting users to know the ins and outs of what's a safe domain (withgoogle.com? Is it safe or not?) or to try to identify legitimate communications is a stupid waste of time. Long term the solution is ubiquitous hardware-based 2FA, ideally incorporated into the physical devices themselves.

bargl 8y ago
True, but a solution doesn't have to be single sided. I can easily send this link to my parents and then they know a little more. Expecting users to know is ridiculous, but offering tools for people to help educate their less tech savvy loved ones is awesome. That's kinda how I see this. It helps me empower my parents a little more.
- scarmig 8y ago
  I agree that it doesn't have to be single-sided, and we need multiple angles to protect against phishing. This quiz isn't it, though. You and I know what domains are; we know what's possible; we can sense when somethings off. It's our bread and butter. The average user knows none of these things, and giving them a dozen rules to follow that will work a lot of the time is in the end confusing. A better set of rules to link your parents to is this: 1) Trust nothing over email. If your bank sends you a notification, don't click on the link in your email: just go directly to your bank's website and log in. 2) That's about it.
  - ptoomey3 8y ago
    I’m not even convinced “don’t click links” is the best guidance. That message has been pushed so hard that people immediately think their machine has been compromised once they have clicked a shady link. That is nearly never the case. Clicking links isn’t something that should cause fear. Nobody is burning a modern browser vuln in a spam email. I think the message should be more focused on not manually entering credentials into a site. Lean on your browser to validate domains and know which sites are associated with which credential. I say that somewhat aspirationaly , as I still think there is lots of room for how well browsers and password managers work for novice users.

iambateman 8y ago

Cool idea confounded by the reality that many many people notice phishing on a quiz who would not notice in ordinary life.

Phishing 8y ago

Phishing.

invalidusernam3 8y ago

Funny considering Google still has a UX vulnerability in their gmail interface: https://eligrey.com/blog/google-inbox-spoofing-vulnerability/ https://eligrey.com/blog/google-inbox-spoofing-vulnerability... "The link mailto:”support@paypal.com”<scam@phisher.example> shows up as “support@paypal.com” in the Google Inbox composition window, visually identical to any email actually sent to PayPal." It has been fixed in the web version, but apparently the Android app still has this issue

SalimoS 8y ago

I missed only the .org instead of .edu (was thinking the establishment have the two domain name) As for the TripIt we may don’t have the same definition of fishing As the mail was a ligitime mail from google to request access to my account from an app (and that’s what’s about the quizz) as for if did I used that app or now that’s another story

Angostura 8y ago

withgoogle.com is clearly a phishing domain.

SimeVidas 8y ago

LOL One of the phishing examples is a page hosted on Google AMP Cache.

aboutruby 8y ago
Same as people using goo.gl URLs
underwater 8y ago
”This one is a little tricky”. No, it's a complete security trainwreck that Google have opted into for no good reason.

yellowapple 8y ago

I missed the one with the PDF attachment, for multiple reasons: * To my knowledge, there are no extant PDF-based viruses that would affect me (on either Linux or OpenBSD), and just because something's infected with malware doesn't mean it's a phishing attempt (it could be that it's a legitimate email from a sender whose computer is infected with some malware that spreads itself through PDFs). * The PDF is actually attached, so if this were a real email it would pop up in Gmail's built-in attachment viewer (and any errors occurring there would be more cause for alarm). * Not all schools use .edu domains at all, let alone exclusively. All things considered, the question's wrong. It's not conclusively a phishing attempt. It might be some other kind of malicious email, but phishing emails are a subset of malicious emails, not the other way around (just like how all carrots are vegetables but not all vegetables are carrots).

dustinevan 8y ago

Wait. So why didn't google just put this on a subdomain? It's a phishing quiz at a phishy domain, and the first thing that happens on iphone is it asks for your name and email (instructions are covered up)

amayne 8y ago

The Tripit one is very problematic. They don’t say that you installed TripIt. I’m supposed to allow any Google third-party access to my email? Even if I didn’t initiate that? Hovering over the “allow” button doesn’t show anything. They need to reword that one.

rsaraceni 8y ago

I was really surprise that they could embed a tinyurl inside a google url. Got 6 / 8.

Leace 8y ago

What happened with the Gmail's Authenticated Senders key icon for e-mails from certain high profile sites that properly validate through DMARC? (described e.g. here [0]) [0]: https://www.pcworld.com/article/2921383/software/4-gmail-labs-features-you-should-be-using.html https://www.pcworld.com/article/2921383/software/4-gmail-lab...

alex_young 8y ago

Anyone else think the domain for this seems suspect? Why not just use google.com? This is pretty meta.