10 ms·

A phishing attack involving g.co, Google's URL shortener

372 points by zachlatta 2y ago

internetter 2y ago
To all the people criticizing OP, 5 million people are victims of phishing attacks every year. This attack is more sophisticated than 99.99% of them. Cut OP some slack.
- quickthrowman 2y ago
  > I asked if I could call back a phone number listed on Google.com and she said sure - this number is listed on google.com and you can call back with your case number, but there may be a wait on hold and I might get a different agent. I googled it and sure enough, it was listed on google.com pages. I didn't call back though. Emphasis mine. Also, if a human called me and claimed to be working for Google, I would laugh heartily and hang up the phone. Google doesn’t even have call in tech support, why would they call you for something as banal as a compromised account?
  - superq 2y ago
    Admitting one mistake doesn't moot the whole incident, nor does it take Google off the hook.
  - internetter 2y ago
    Again, 5 million people fall for phishing. This attack was magnitudes more sophisticated than most. I still get the occasional Nigerian prince scam. They still send them because it still works. Not all of the people who fall for this are stupid. Surely you’ve made mistakes before.
  - sodality2 2y ago
    This is about Google Workspace, a higher tier paid account which does include phone support. Equivalent to if someone like your business ISP called you (or someone else who you are a paying customer of, with real phone lines). That being said, it is mentioned that OP doesn't pay for that or Google One.
    - zachlatta 2y ago
      I am a paying user of Google Workspace, and also run a charity that is a user of Google Workspace with thousands of accounts. The account they were trying to phish was a paid Google Workspace email.
- nejsjsjsbsb 2y ago
  I agree. Easy to Monday morning quarterback opsec but we're human and the best fall for stuff all the time. A non tech person wouldn't know Google has bad support and is unlikely to call you, that a number and email can be spoofed, etc. And even if 99% didn't fall for it, just 100 calls gets the scammer a victim on average.
deleted 2y ago
[deleted]
aramsh 2y ago
What's even more interesting is there is no DNS records for important.g.co, which means they have found a way to create an Google Workspace without verifying the domain but still able to send emails like password resets. It's definitely a glitch where you can send emails/transactional emails from an unverified Google Workspace. My guess is that their are protections for google.com and google domains but they forgot to add the g.co domain, which allows unverified sending to g.co and creation of workspaces.
deleted 2y ago
[deleted]
gm678 2y ago
What I'm most curious about is how they were able to spoof the email being sent from `workspace-noreply@google.com`. Given the odd phrasing of 'password for important.g.co', perhaps this is some strategy involving creating a 'parallel' account with the same email and making use of it to send an official-looking email as part of the scam?
- zerocrates 2y ago
  Most likely they did something like sign up for "important.g.co" in Workspace, then added the target as a user, then reset that user's password, causing Google to send a real, verified, from-Google message. They can't control the contents of the message, but they used the gmail "+" feature to cram the "case ID" onto the target email they created the Workspace account for, making that seem real.
  - markerz 2y ago
    But how did they MITM the verification code? Was the first two presented to the attacker, and the rest was presented to the email? Or were they able to MITM the whole email/code and just shared the first two to gain trust?
    - renewiltord 2y ago
      When you use a device to do 2FA, Google will display one code on the logging in device screen and three on the 2FA screen. This is so that the user doesn't just blindly hit accept on the Gmail/YouTube app that hosts the 2FA prompt.
      - valleyer 2y ago
        A one in three risk of hitting the wrong button still seems insanely high to me. Why is this 2FA method deployed instead of things like "enter the code here"? (I know it wouldn't necessarily have stopped this phishing attempt.)
        2y ago
rekabis 2y ago
> I asked if I could call back a phone number listed on Google.com and she said sure - this number is listed on google.com and you can call back with your case number, but there may be a wait on hold and I might get a different agent. I googled it and sure enough, it was listed on google.com pages. I didn't call back though. This is where a big mistake is. Always, ALWAYS phone or contact back using the company’s official channels. Because if they have sufficient info about you, scammers can make a call sound hella legitimate, but one thing they still cannot do is pick up the company’s phone for them when you phone in. Especially if you call from a hardline, which requires compromising the phone company’s switching equipment. Even my father, nearly 86 with a 5th grade education and slowly sliding into dementia, knows better than to uncritically accept being directly contacted. He’s already short-circuited several scams (of various types) in the last few years by hanging up and phoning back in himself.
- jrochkind1 2y ago
  > Especially if you call from a hardline, I have no idea where I'd find one of those.
- philipwhiuk 2y ago
  Yeah. In reality the number your phone carrier provides is basically a guess. It does in no way guarantee who is calling you.
- pests 2y ago
  This used to not be safe though, in the age of landlines. I forget the details, but most of the country was wired in a manner that both parties of a call had to hang up to end the connection. You might hang up, go find the official phone number, but when you pick the phone off the cradle you would still be in the previous call. They could fake the dial tone and you would be none the wiser. I remember pranking friends with this back when I was young. Harmless stuff.
  - quesera 2y ago
    I think this was in crossbar switches. The initiator of the call had to hang up for something like 8 seconds. This was useful if they called you and you answered in the kitchen, but wanted to run to another room to talk. Not that I think it was designed to be a feature! But I used it that way. If you didn't trust the caller, you could hang up, wait 10 seconds, then get a good clean real dial tone. Remember dial tones? Anyway none of this is relevant in modern switching systems, much less cellular networks.
pavel_lishin 2y ago
I know it's easy to second-guess someone after they've explained that they're describing a scam, but: > The thing that's crazy is that if I followed the 2 "best practices" of verifying the phone number + getting them to send an email to you from a legit domain, I would have been compromised. He didn't follow the first of those best practices. He just looked up a phone number that the caller also read out to him, and didn't call it. And "Solomon" also explicitly told him he couldn't call. I honestly think that at this point, no incoming phone call can ever be trusted.
- ksala_ 2y ago
  I'd argue the second one was not followed either. Maybe I'm misunderstanding the article, but I would not take a random "your password has changed" as proof. I would need the caller to send me an actual email from their personal work email address (or ticket system?) with some actual, human communications in it.
- numbsafari 2y ago
  > no incoming phone call can ever be trusted. They can't. And they haven't been for a while. Spoofing phone calls is simply too easy, and nothing is being done to fix that, despite the fact that it puts so many of us at risk. It's not an insurmountable problem, technologically. It is literally a lack of will and outcry from ordinary people, despite how often this fact is used to abuse so many. Credit Card companies have known this for a long time. My credit card company will call and say "do not call back to this number, call the number on the back of your card and use this reference number". That should absolutely be the norm at this point.
  - BobaFloutist 2y ago
    Telecoms know if a number is spoofed or not. All I want is for them to wholesale steal the original Twitter "verified" check, and use it to confirm that a call is not spoofed.
    - School-Cotton 2y ago
blevinstein 2y ago
Sounds really similar to my experience a few months ago. I commented here about it. https://www.reddit.com/r/googleworkspace/s/NtJpputXtg https://www.reddit.com/r/googleworkspace/s/NtJpputXtg There was something in Google workspace that allowed the scanners to have an email sent to them, AND an additional and of their choice. But when I asked about calling them back, I was told that wasn't possible, which made me suspicious.
philfreo 2y ago
Can someone explain point #9 in the gist? How’d they know part of the two factor code?
- jonas21 2y ago
  The attacker was going through the sign in flow on their own computer. In the MFA step, it shows you a number and asks to you press the same number on your phone. There's a screenshot of what this looks like here: https://gist.github.com/zachlatta/f86317493654b550c689dc6509973aa4?permalink_comment_id=5406994#gistcomment-5406994 https://gist.github.com/zachlatta/f86317493654b550c689dc6509...
- jsnell 2y ago
  It's not a two-factor code like you're thinking of. That code is shown on the sign-in / account recovery page, to whoever making that attempt. Then the same value has to be chosen on the mobile device that's being used to authenticate that sign-in. The goal isn't to protect against phishing or social engineering, but against people accidentally approving a sign-in they didn't initiate.
  - joshuamorton 2y ago
    (specifically, there are "credential stuffing" style sign-in attacks where an attacker logs in "suspiciously" at the same time as a legit log in, possibly after forcing a log-out, hoping you approve both your log in and theirs when you get two, or ten pop-ups)
- ekimekim 2y ago
  What I'm confused by is how they got that far, to the point that 2FA was the only thing in their way. Did they already have this user's password?
rvnx 2y ago
It would be better if Google would react more strongly to such attacks. -> There is a sophisticated one where you can take over an account via the Account Recovery flow, that is still actively abused; tried to report, got "not a bug, triaging as abuse risk"
arccy 2y ago
unless thinks they own important.g.co, they've just walked past some glaring red flags, it doesn't even mention their domain in the email.
deleted 2y ago
[deleted]
do_not_redeem 2y ago
As usual this started with an incoming phone call. If you ever receive a phone call from a tech company, it's a scam. The caller ID doesn't matter. The caller's accent (wtf) doesn't matter either. It's a scam.
- ripped_britches 2y ago
  Not if you’re an app developer on their platform, they make outbound calls to you. I’m sure there are other situations as well.
  - do_not_redeem 2y ago
    If the consequences for letting that call go to voicemail are any less severe than full account takeover by a script kiddie, you're still better off never picking up. Google in particular is famous for making it impossible to contact a human. If Google calls you, before picking up, consider whether you truly believe you're lucky enough to be one of a handful of people in the world to ever get human support from them.
    - teractiveodular 2y ago
      I've spoken on the phone with humans in Google support. (You, too, can do this, just pay them enough.) However, they called me after I filed a support case and specifically requested a call, and they started off by mentioning the number of the case I had filed. If you ever get a cold call from "Google Support", it's basically guaranteed to be a scam.
      - bookofjoe 2y ago
        After I got Google Glass in 2013 as one of 8,000 "Explorers" I was given a support telephone number that was always quickly answered by a Google employee knowledgeable about Glass.
        psd1 2y ago
nemothekid 2y ago
I'm not sure if it's good thing or not but I've come to consider that any notification about a password being reset or a fraudulent charge is phishing unless I initiate some action. I always verify that I'm actually fucked and then take action. This seems counter-intuitive but the deluge of phishing emails makes me feel this is the safest option. I'd rather wait to notice a fraudulent charge and dispute it, than leak info to a random SMS number that claims (possibly truthfully) that someone in Japan spent $9000 at the gucci store.
- ronnier 2y ago
  Agreed. I do not follow any links, accept calls, etc. I go to the site of origin and do what I need. Also be careful if you search for the sites name on Google, still might click a fraud site!
sethops1 2y ago
> Someone named "Chloe" called me from 650-203-0000 Nope. Rule #1 in today's environment is never pick up the phone. If you're not expecting the call they can leave a message. And if it's something you think is legitimate, get the authentic number from a reputable source.
renewiltord 2y ago
That's not verifying the phone number. I received a call from Chase about a wire. I asked them for a code so I could continue the conversation and then looked up the phone number on their website and called that and talked through reps till I got to the right department. Caller ID being spoofed is the wrong way to think about this. It's just that if someone walks up to you and says "Hey, I'm Jean d'Eau and I'm President of the US" you don't think to yourself "oh yeah he's definitely President and that's his name". People can always tell you they're whoever they want to be. You can either believe it or go find out if they are.
adrr 2y ago
How did they send an email from google.com that passed DKIM and SPF? Thats a huge concern.
- jorams 2y ago
  It's specifically a password reset email. A Google Workspace admin can send a password reset to any of their users, and it will pass DKIM and SPF. The trick here is that apparently you can sign up for Workspace with a g.co subdomain and, without verifying the domain, can trigger a password reset to be sent.
  - layman51 2y ago
    I’m still a bit confused around how they sent him the email. Maybe they added him to the Google Workspace as a member?
    - jorams 2y ago
      Yeah they did. They added his email as a secondary email to a Google Workspace user account, with the plus-address-suffix including a "Case ID". Then they reset the password of the user account, triggering this notification.
layman51 2y ago
This is the same type of phishing attack described here[1]. It’s still surprising to me how the SPF, DKIM, and DMARC all pass. If I remember correctly, it’s because they actually have a clever way od getting Google to send an email to you by sharing a Google Form with you or something like that. [1]: https://news.ycombinator.com/item?id=42450221 https://news.ycombinator.com/item?id=42450221
- 0xDEAFBEAD 2y ago
  Yep. Look at the screenshot. It seems they managed to trigger one of Google's standard password reset emails.
- ArkaneMoose 2y ago
  Based on the text at the bottom of the gist: > Hack Clubbers have determined that this is almost definitely a bug in Google Workspace where you can create a new Workspace with any g.co subdomain and get it to send some emails without verifying that you own the domain. Seems like this is the flow: 1. Create a Google Workspace with a g.co subdomain. Apparently this is not verified, or verifying the domain is not necessary for the next steps. 2. Create an account for the victim under this Google Workspace. 3. Reset that account's password. The victim gets an email from Google Workspace informing them that their password was reset. And this email is a real, legitimate (not spoofed) email from Google because it's just a result of the normal password reset process for a Google Workspace account.
- ElijahLynn 2y ago
  We have all this verification on the Web, but not the phone. Why do telcos allow for spoofing? We wouldn't allow that with email. Is this a technical limitation that allows for spoofing?
  - fn-mote 2y ago
    We have had phone company employees here explaining that their company makes a lot of money from scammers/spammers/etc so they do not have an incentive to stop it. How about a law with teeth?
yread 2y ago
The business/answers page with the number is about calls from Google Assistant and (now?) explicitly says it's not about calls from the support. That would be this page https://support.google.com/business/answer/6212928?hl=en https://support.google.com/business/answer/6212928?hl=en Disappointingly, it only says how to identify automated calls from Google, it doesn't offer a protocol for verifying actual humans from Google calling you. Perhaps it happens so rarely you can just assume it's not Google.
throwpoaster 2y ago
URL shorteners are a massive security hazard.
- gruez 2y ago
  Maybe, but in this particular case the attack has nothing to do with url shortening. The essential elements were google assistant (to spoof caller ID), and google workspace (to send the "case" email).
hombre_fatal 2y ago
The biggest scare I've gotten is somehow ending up on "colnbase.com" (instead of "coinbase.com"). It's defunct now, but at the time it was a 1:1 replica of Coinbase. And the only reason I noticed was because 1Password didn't offer to fill in my credentials. While knowing someone's email/password combo might not be enough for an attacker to do anything malicious on Coinbase itself (due to email re-verification maybe), the point is that even the smartest of us Hacker News users can fall for it. And that should scare the rest of us.
- gleenn 2y ago
  So so true. 1Password refusing to auto fill a password has saved me multiple times in the past! Also, one of my friends has a PhD in literally rocket science (aeronautical engineering from MIT) and got scammed by someone who stole his brother's SIM card and did some shenanigans. No one is safe, no matter how smart or tech savvy you think you are! For the less tech savvy folks, I understand why they are scared, it's hard to give them even general tips to not lose the farm to fraudsters.
  - paranoidrobot 2y ago
    The general advice I give is: Don't trust incoming calls, text messages or emails. Don't trust caller ID on your phone. If someone calls you asking for information or to do something, ask for a case id or reference number. Hang up, call back on a number you get from a previous bill, back of your credit card, or by googling the company. If anyone is pushing for something to be done urgently, stop. Hang up, don't take any action. Call a trusted other person and talk to them about it.
    - snypher 2y ago
      >by googling the company And remember it's going to be the 4th or 5th link down, not the first.
      - btown 2y ago
        This is one of many reasons why ad blocking isn't just cosmetic: it's a best practice for security too!
ElijahLynn 2y ago
How is call spoofing allowed by telcos? Is it a technical limitation that let's this happen?
- MathMonkeyMan 2y ago
  My understanding is that it's a technical limitation. I read somewhere (maybe a post here on Hacker News) that back in the good old days of telephone monopoly, there was nobody to abuse a zero-security feature like "spoof the number" except the phone company itself, and it was useful for large local corporate phone networks.
kilroy123 2y ago
Extremely scary. This is way above and beyond most phishing attacks. Obviously, this guy is being targeted for some reason or another. I worry about such attacks being automated at scale with AI tools.
llm_nerd 2y ago
Totally unrelated, beyond being another Google service, but what's with Google's AppSheet being used for so many phishing emails? How does Google not predict this abuse and prevent it? Now to be fair they all end up in the spam folder, but these are emails sent from noreply@appsheet.com (SPF passing and originating from a Google IP), albeit with a phishing FROM name like "Meta for Business". I have hundreds of these in my spam folder, telling me that my Meta campaigns (I don't have any Meta campaigns and don't interact with that business at all) have been suspended, etc, clearly hoping to takeover someone's Meta business account. Like when Google's Calendar invites were massively used for spam, I just don't understand how that company rolls out services and doesn't foresee the malusage.
throwaway48476 2y ago
Like with the recent homebrew attack Google Google has shown itself to be a malware services company.
gsuuon 2y ago
I'm confused, is he saying that the other voice on the call is google assistant voice ai? Or the assistant just routed the call through the google number?
jostmey 2y ago
Someone tried something very similar on me last month to steal my google account. Honestly, I almost fell for it. The giveaway was how desperate the caller was for me to complete the last step
idlephysicist 2y ago
Anyone that get’s a telephone call from “Google” should be immediately suspicious. I used to work for a company that paid GCP about as much as my annual salary _every_ month, and we still struggled to get GCP on the phone when we needed assistance.
- ravetcofx 2y ago
  what's wild is when Google Play Music came to Canada where you could upload your music to the cloud, I was able to get phone support for a bug it had with Linux, and they were very helpful
vednig 2y ago
This is becoming a growing cause of cyberattacks recently, the domain expiry being used by malicious entities to gain access to systems
ebilgenius 2y ago
You can tell it's a scam call immediately because Google has no such thing as "support", let alone an actual "support engineer"
- braiamp 2y ago
  But you don't know that. Nor I would expect most people to know the internal structure of Google.
  - grumple 2y ago
    I can’t get ahold of google support while paying them hundreds of thousands per year. I’m not convinced they do support.
    - MyFedora 2y ago
      They do support if you spend enough money with them. At least with GCP. Access to in-house cloud architects level of support, even.
berkes 2y ago
I have been using a catchall mailbox with hostname type names for over a decade now¹ So, com.example.shop@example.org for https://shop.example.com https://shop.example.com account(s). I've recently switched to a randomized username part, as bitwarden supports this well. This has saved me numerous times from scams². Because scammers would email me on the wrong address. Either they'd mail me on an adress listed on my website, when the actual company would've mailed on the unique address I gave them (more targeted phishing). Or they'll mail me on an address that I know to be leaked (these are redirected to spam in filters). I am convinced there's an actual solution to a lot of scamming here, if the UX and UI are carefully designed. To be used by "muggles", not just the crowd that knows things like filters and catch-alls and plus-appended etc. It's a pity Google, Microsoft or even proton aren't actively promoting such a "unique mail for every service". But I guess there's little in it for them. ¹ used to self host, but now that's near impossible with the monopolies on mailserves at big tech and moved to mailbox.org. big shoutout! ² aside from the other great benefit. I'm often one of the first to know some service or site was compromised by receiving scam, spam etc. A few times I was even the one to report a breach to such an org via this.
- noname120 2y ago
  Apple has that with their Hide My Email service (included in the iCloud+ subscription at $0.99/month). It nudges you to create a new alias on every form that contains an email field. The good part is the that aliases are inconspicuous @icloud.com email addresses that don't follow a specific pattern and are thus: 1) Accepted everywhere (contrary to custom domains — which I also have). 2) Are pretty much impossible to detect ahead of time. ———— For illustrative purposes I just clicked several times on the generate new Hide My Email button and it returned those: pie.tall9x@icloud.com drivels_eras4x@icloud.com showier.sizzle-7y@icloud.com I have around 160 aliases so far, I'm not sure what the limit is (if there is one).
  - upcoming-sesame 2y ago
    Congrats, you're now married to Apple forever
beshrkayali 2y ago
> The thing that's crazy is that if I followed the 2 "best practices" of verifying the phone number + getting them to send an email to you from a legit domain, I would have been compromised. The best practice I live by is always call them back yourself. Looking up the phone number is not the same.
croemer 2y ago
This is the LinkedIn profile the attacker referred to as his: https://www.linkedin.com/in/solomon-aborbie-jr-6b0a32155/ https://www.linkedin.com/in/solomon-aborbie-jr-6b0a32155/ (Solomon Aborbie Jr) - the CV seems to check out with this Bowdoin video: https://www.youtube.com/watch?v=0n_vHGLDMtM https://www.youtube.com/watch?v=0n_vHGLDMtM - so likely real and the attackers did "identity theft". Starting at 1:58 here: https://cloud-3s03ljpcy-hack-club-bot.vercel.app/0call_recording.m4a https://cloud-3s03ljpcy-hack-club-bot.vercel.app/0call_recor...
- zachlatta 2y ago
  I think he just found a random engineer from Google on LinkedIn and is pretending to be him.
charlieruben999 2y ago
[dead]
thomas4151 2y ago
[dead]
rosiesophia10 2y ago
[dead]
Ruckerpatsy57 2y ago
[dead]
james4151 2y ago
I appreciate Spyrecovery36 for making me realise the truth to a certified hacke r who knows a lot about what his doing. I strongly recommend you hire him because his the best out there and always delivers. I have referred over 10 people to him and all had positive results. He can help you hack into any devices, social networks including – Facebook, Hangout, iMessages, Twitter accounts, Snap chat , Instagram, Whatsapp, wechat, text messages ,smartphones cloning ,tracking emails and also any other social media messenger or sites. It’s advisable to hire a professional hacker. Thank me later. Contact him here.spyrecovery36 @ gm ail c o m
timsharon 2y ago
[dead]

372 points by zachlatta 2y ago

To all the people criticizing OP, 5 million people are victims of phishing attacks every year. This attack is more sophisticated than 99.99% of them. Cut OP some slack.

quickthrowman 2y ago
> I asked if I could call back a phone number listed on Google.com and she said sure - this number is listed on google.com and you can call back with your case number, but there may be a wait on hold and I might get a different agent. I googled it and sure enough, it was listed on google.com pages. I didn't call back though. Emphasis mine. Also, if a human called me and claimed to be working for Google, I would laugh heartily and hang up the phone. Google doesn’t even have call in tech support, why would they call you for something as banal as a compromised account?
- superq 2y ago
  Admitting one mistake doesn't moot the whole incident, nor does it take Google off the hook.
- internetter 2y ago
  Again, 5 million people fall for phishing. This attack was magnitudes more sophisticated than most. I still get the occasional Nigerian prince scam. They still send them because it still works. Not all of the people who fall for this are stupid. Surely you’ve made mistakes before.
- sodality2 2y ago
  This is about Google Workspace, a higher tier paid account which does include phone support. Equivalent to if someone like your business ISP called you (or someone else who you are a paying customer of, with real phone lines). That being said, it is mentioned that OP doesn't pay for that or Google One.
  - zachlatta 2y ago
    I am a paying user of Google Workspace, and also run a charity that is a user of Google Workspace with thousands of accounts. The account they were trying to phish was a paid Google Workspace email.
nejsjsjsbsb 2y ago
I agree. Easy to Monday morning quarterback opsec but we're human and the best fall for stuff all the time. A non tech person wouldn't know Google has bad support and is unlikely to call you, that a number and email can be spoofed, etc. And even if 99% didn't fall for it, just 100 calls gets the scammer a victim on average.

deleted 2y ago

[deleted]

aramsh 2y ago

What's even more interesting is there is no DNS records for important.g.co, which means they have found a way to create an Google Workspace without verifying the domain but still able to send emails like password resets. It's definitely a glitch where you can send emails/transactional emails from an unverified Google Workspace. My guess is that their are protections for google.com and google domains but they forgot to add the g.co domain, which allows unverified sending to g.co and creation of workspaces.

deleted 2y ago

[deleted]

gm678 2y ago

What I'm most curious about is how they were able to spoof the email being sent from `workspace-noreply@google.com`. Given the odd phrasing of 'password for important.g.co', perhaps this is some strategy involving creating a 'parallel' account with the same email and making use of it to send an official-looking email as part of the scam?

zerocrates 2y ago
Most likely they did something like sign up for "important.g.co" in Workspace, then added the target as a user, then reset that user's password, causing Google to send a real, verified, from-Google message. They can't control the contents of the message, but they used the gmail "+" feature to cram the "case ID" onto the target email they created the Workspace account for, making that seem real.
- markerz 2y ago
  But how did they MITM the verification code? Was the first two presented to the attacker, and the rest was presented to the email? Or were they able to MITM the whole email/code and just shared the first two to gain trust?
  - renewiltord 2y ago
    When you use a device to do 2FA, Google will display one code on the logging in device screen and three on the 2FA screen. This is so that the user doesn't just blindly hit accept on the Gmail/YouTube app that hosts the 2FA prompt.
    - valleyer 2y ago
      A one in three risk of hitting the wrong button still seems insanely high to me. Why is this 2FA method deployed instead of things like "enter the code here"? (I know it wouldn't necessarily have stopped this phishing attempt.)
      - 2y ago

rekabis 2y ago

> I asked if I could call back a phone number listed on Google.com and she said sure - this number is listed on google.com and you can call back with your case number, but there may be a wait on hold and I might get a different agent. I googled it and sure enough, it was listed on google.com pages. I didn't call back though. This is where a big mistake is. Always, ALWAYS phone or contact back using the company’s official channels. Because if they have sufficient info about you, scammers can make a call sound hella legitimate, but one thing they still cannot do is pick up the company’s phone for them when you phone in. Especially if you call from a hardline, which requires compromising the phone company’s switching equipment. Even my father, nearly 86 with a 5th grade education and slowly sliding into dementia, knows better than to uncritically accept being directly contacted. He’s already short-circuited several scams (of various types) in the last few years by hanging up and phoning back in himself.

jrochkind1 2y ago
> Especially if you call from a hardline, I have no idea where I'd find one of those.
philipwhiuk 2y ago
Yeah. In reality the number your phone carrier provides is basically a guess. It does in no way guarantee who is calling you.
pests 2y ago
This used to not be safe though, in the age of landlines. I forget the details, but most of the country was wired in a manner that both parties of a call had to hang up to end the connection. You might hang up, go find the official phone number, but when you pick the phone off the cradle you would still be in the previous call. They could fake the dial tone and you would be none the wiser. I remember pranking friends with this back when I was young. Harmless stuff.
- quesera 2y ago
  I think this was in crossbar switches. The initiator of the call had to hang up for something like 8 seconds. This was useful if they called you and you answered in the kitchen, but wanted to run to another room to talk. Not that I think it was designed to be a feature! But I used it that way. If you didn't trust the caller, you could hang up, wait 10 seconds, then get a good clean real dial tone. Remember dial tones? Anyway none of this is relevant in modern switching systems, much less cellular networks.

pavel_lishin 2y ago

I know it's easy to second-guess someone after they've explained that they're describing a scam, but: > The thing that's crazy is that if I followed the 2 "best practices" of verifying the phone number + getting them to send an email to you from a legit domain, I would have been compromised. He didn't follow the first of those best practices. He just looked up a phone number that the caller also read out to him, and didn't call it. And "Solomon" also explicitly told him he couldn't call. I honestly think that at this point, no incoming phone call can ever be trusted.

ksala_ 2y ago
I'd argue the second one was not followed either. Maybe I'm misunderstanding the article, but I would not take a random "your password has changed" as proof. I would need the caller to send me an actual email from their personal work email address (or ticket system?) with some actual, human communications in it.
numbsafari 2y ago
> no incoming phone call can ever be trusted. They can't. And they haven't been for a while. Spoofing phone calls is simply too easy, and nothing is being done to fix that, despite the fact that it puts so many of us at risk. It's not an insurmountable problem, technologically. It is literally a lack of will and outcry from ordinary people, despite how often this fact is used to abuse so many. Credit Card companies have known this for a long time. My credit card company will call and say "do not call back to this number, call the number on the back of your card and use this reference number". That should absolutely be the norm at this point.
- BobaFloutist 2y ago
  Telecoms know if a number is spoofed or not. All I want is for them to wholesale steal the original Twitter "verified" check, and use it to confirm that a call is not spoofed.
  - School-Cotton 2y ago

blevinstein 2y ago

Sounds really similar to my experience a few months ago. I commented here about it. https://www.reddit.com/r/googleworkspace/s/NtJpputXtg https://www.reddit.com/r/googleworkspace/s/NtJpputXtg There was something in Google workspace that allowed the scanners to have an email sent to them, AND an additional and of their choice. But when I asked about calling them back, I was told that wasn't possible, which made me suspicious.

philfreo 2y ago

Can someone explain point #9 in the gist? How’d they know part of the two factor code?

jonas21 2y ago
The attacker was going through the sign in flow on their own computer. In the MFA step, it shows you a number and asks to you press the same number on your phone. There's a screenshot of what this looks like here: https://gist.github.com/zachlatta/f86317493654b550c689dc6509973aa4?permalink_comment_id=5406994#gistcomment-5406994 https://gist.github.com/zachlatta/f86317493654b550c689dc6509...
jsnell 2y ago
It's not a two-factor code like you're thinking of. That code is shown on the sign-in / account recovery page, to whoever making that attempt. Then the same value has to be chosen on the mobile device that's being used to authenticate that sign-in. The goal isn't to protect against phishing or social engineering, but against people accidentally approving a sign-in they didn't initiate.
- joshuamorton 2y ago
  (specifically, there are "credential stuffing" style sign-in attacks where an attacker logs in "suspiciously" at the same time as a legit log in, possibly after forcing a log-out, hoping you approve both your log in and theirs when you get two, or ten pop-ups)
ekimekim 2y ago
What I'm confused by is how they got that far, to the point that 2FA was the only thing in their way. Did they already have this user's password?

rvnx 2y ago

It would be better if Google would react more strongly to such attacks. -> There is a sophisticated one where you can take over an account via the Account Recovery flow, that is still actively abused; tried to report, got "not a bug, triaging as abuse risk"

arccy 2y ago

unless thinks they own important.g.co, they've just walked past some glaring red flags, it doesn't even mention their domain in the email.

deleted 2y ago

[deleted]

do_not_redeem 2y ago

As usual this started with an incoming phone call. If you ever receive a phone call from a tech company, it's a scam. The caller ID doesn't matter. The caller's accent (wtf) doesn't matter either. It's a scam.

ripped_britches 2y ago
Not if you’re an app developer on their platform, they make outbound calls to you. I’m sure there are other situations as well.
- do_not_redeem 2y ago
  If the consequences for letting that call go to voicemail are any less severe than full account takeover by a script kiddie, you're still better off never picking up. Google in particular is famous for making it impossible to contact a human. If Google calls you, before picking up, consider whether you truly believe you're lucky enough to be one of a handful of people in the world to ever get human support from them.
  - teractiveodular 2y ago
    I've spoken on the phone with humans in Google support. (You, too, can do this, just pay them enough.) However, they called me after I filed a support case and specifically requested a call, and they started off by mentioning the number of the case I had filed. If you ever get a cold call from "Google Support", it's basically guaranteed to be a scam.
    - bookofjoe 2y ago
      After I got Google Glass in 2013 as one of 8,000 "Explorers" I was given a support telephone number that was always quickly answered by a Google employee knowledgeable about Glass.
      - psd1 2y ago

nemothekid 2y ago

I'm not sure if it's good thing or not but I've come to consider that any notification about a password being reset or a fraudulent charge is phishing unless I initiate some action. I always verify that I'm actually fucked and then take action. This seems counter-intuitive but the deluge of phishing emails makes me feel this is the safest option. I'd rather wait to notice a fraudulent charge and dispute it, than leak info to a random SMS number that claims (possibly truthfully) that someone in Japan spent $9000 at the gucci store.

ronnier 2y ago
Agreed. I do not follow any links, accept calls, etc. I go to the site of origin and do what I need. Also be careful if you search for the sites name on Google, still might click a fraud site!

sethops1 2y ago

> Someone named "Chloe" called me from 650-203-0000 Nope. Rule #1 in today's environment is never pick up the phone. If you're not expecting the call they can leave a message. And if it's something you think is legitimate, get the authentic number from a reputable source.

renewiltord 2y ago

That's not verifying the phone number. I received a call from Chase about a wire. I asked them for a code so I could continue the conversation and then looked up the phone number on their website and called that and talked through reps till I got to the right department. Caller ID being spoofed is the wrong way to think about this. It's just that if someone walks up to you and says "Hey, I'm Jean d'Eau and I'm President of the US" you don't think to yourself "oh yeah he's definitely President and that's his name". People can always tell you they're whoever they want to be. You can either believe it or go find out if they are.

adrr 2y ago

How did they send an email from google.com that passed DKIM and SPF? Thats a huge concern.

jorams 2y ago
It's specifically a password reset email. A Google Workspace admin can send a password reset to any of their users, and it will pass DKIM and SPF. The trick here is that apparently you can sign up for Workspace with a g.co subdomain and, without verifying the domain, can trigger a password reset to be sent.
- layman51 2y ago
  I’m still a bit confused around how they sent him the email. Maybe they added him to the Google Workspace as a member?
  - jorams 2y ago
    Yeah they did. They added his email as a secondary email to a Google Workspace user account, with the plus-address-suffix including a "Case ID". Then they reset the password of the user account, triggering this notification.

layman51 2y ago

This is the same type of phishing attack described here[1]. It’s still surprising to me how the SPF, DKIM, and DMARC all pass. If I remember correctly, it’s because they actually have a clever way od getting Google to send an email to you by sharing a Google Form with you or something like that. [1]: https://news.ycombinator.com/item?id=42450221 https://news.ycombinator.com/item?id=42450221

0xDEAFBEAD 2y ago
Yep. Look at the screenshot. It seems they managed to trigger one of Google's standard password reset emails.
ArkaneMoose 2y ago
Based on the text at the bottom of the gist: > Hack Clubbers have determined that this is almost definitely a bug in Google Workspace where you can create a new Workspace with any g.co subdomain and get it to send some emails without verifying that you own the domain. Seems like this is the flow: 1. Create a Google Workspace with a g.co subdomain. Apparently this is not verified, or verifying the domain is not necessary for the next steps. 2. Create an account for the victim under this Google Workspace. 3. Reset that account's password. The victim gets an email from Google Workspace informing them that their password was reset. And this email is a real, legitimate (not spoofed) email from Google because it's just a result of the normal password reset process for a Google Workspace account.
ElijahLynn 2y ago
We have all this verification on the Web, but not the phone. Why do telcos allow for spoofing? We wouldn't allow that with email. Is this a technical limitation that allows for spoofing?
- fn-mote 2y ago
  We have had phone company employees here explaining that their company makes a lot of money from scammers/spammers/etc so they do not have an incentive to stop it. How about a law with teeth?

yread 2y ago

The business/answers page with the number is about calls from Google Assistant and (now?) explicitly says it's not about calls from the support. That would be this page https://support.google.com/business/answer/6212928?hl=en https://support.google.com/business/answer/6212928?hl=en Disappointingly, it only says how to identify automated calls from Google, it doesn't offer a protocol for verifying actual humans from Google calling you. Perhaps it happens so rarely you can just assume it's not Google.

throwpoaster 2y ago

URL shorteners are a massive security hazard.

gruez 2y ago
Maybe, but in this particular case the attack has nothing to do with url shortening. The essential elements were google assistant (to spoof caller ID), and google workspace (to send the "case" email).

hombre_fatal 2y ago

The biggest scare I've gotten is somehow ending up on "colnbase.com" (instead of "coinbase.com"). It's defunct now, but at the time it was a 1:1 replica of Coinbase. And the only reason I noticed was because 1Password didn't offer to fill in my credentials. While knowing someone's email/password combo might not be enough for an attacker to do anything malicious on Coinbase itself (due to email re-verification maybe), the point is that even the smartest of us Hacker News users can fall for it. And that should scare the rest of us.

gleenn 2y ago
So so true. 1Password refusing to auto fill a password has saved me multiple times in the past! Also, one of my friends has a PhD in literally rocket science (aeronautical engineering from MIT) and got scammed by someone who stole his brother's SIM card and did some shenanigans. No one is safe, no matter how smart or tech savvy you think you are! For the less tech savvy folks, I understand why they are scared, it's hard to give them even general tips to not lose the farm to fraudsters.
- paranoidrobot 2y ago
  The general advice I give is: Don't trust incoming calls, text messages or emails. Don't trust caller ID on your phone. If someone calls you asking for information or to do something, ask for a case id or reference number. Hang up, call back on a number you get from a previous bill, back of your credit card, or by googling the company. If anyone is pushing for something to be done urgently, stop. Hang up, don't take any action. Call a trusted other person and talk to them about it.
  - snypher 2y ago
    >by googling the company And remember it's going to be the 4th or 5th link down, not the first.
    - btown 2y ago
      This is one of many reasons why ad blocking isn't just cosmetic: it's a best practice for security too!

ElijahLynn 2y ago

How is call spoofing allowed by telcos? Is it a technical limitation that let's this happen?

MathMonkeyMan 2y ago
My understanding is that it's a technical limitation. I read somewhere (maybe a post here on Hacker News) that back in the good old days of telephone monopoly, there was nobody to abuse a zero-security feature like "spoof the number" except the phone company itself, and it was useful for large local corporate phone networks.

kilroy123 2y ago

Extremely scary. This is way above and beyond most phishing attacks. Obviously, this guy is being targeted for some reason or another. I worry about such attacks being automated at scale with AI tools.

llm_nerd 2y ago

Totally unrelated, beyond being another Google service, but what's with Google's AppSheet being used for so many phishing emails? How does Google not predict this abuse and prevent it? Now to be fair they all end up in the spam folder, but these are emails sent from noreply@appsheet.com (SPF passing and originating from a Google IP), albeit with a phishing FROM name like "Meta for Business". I have hundreds of these in my spam folder, telling me that my Meta campaigns (I don't have any Meta campaigns and don't interact with that business at all) have been suspended, etc, clearly hoping to takeover someone's Meta business account. Like when Google's Calendar invites were massively used for spam, I just don't understand how that company rolls out services and doesn't foresee the malusage.

throwaway48476 2y ago

Like with the recent homebrew attack Google Google has shown itself to be a malware services company.

gsuuon 2y ago

I'm confused, is he saying that the other voice on the call is google assistant voice ai? Or the assistant just routed the call through the google number?

jostmey 2y ago

Someone tried something very similar on me last month to steal my google account. Honestly, I almost fell for it. The giveaway was how desperate the caller was for me to complete the last step

idlephysicist 2y ago

Anyone that get’s a telephone call from “Google” should be immediately suspicious. I used to work for a company that paid GCP about as much as my annual salary _every_ month, and we still struggled to get GCP on the phone when we needed assistance.

ravetcofx 2y ago
what's wild is when Google Play Music came to Canada where you could upload your music to the cloud, I was able to get phone support for a bug it had with Linux, and they were very helpful

vednig 2y ago

This is becoming a growing cause of cyberattacks recently, the domain expiry being used by malicious entities to gain access to systems

ebilgenius 2y ago

You can tell it's a scam call immediately because Google has no such thing as "support", let alone an actual "support engineer"

braiamp 2y ago
But you don't know that. Nor I would expect most people to know the internal structure of Google.
- grumple 2y ago
  I can’t get ahold of google support while paying them hundreds of thousands per year. I’m not convinced they do support.
  - MyFedora 2y ago
    They do support if you spend enough money with them. At least with GCP. Access to in-house cloud architects level of support, even.

berkes 2y ago

I have been using a catchall mailbox with hostname type names for over a decade now¹ So, com.example.shop@example.org for https://shop.example.com https://shop.example.com account(s). I've recently switched to a randomized username part, as bitwarden supports this well. This has saved me numerous times from scams². Because scammers would email me on the wrong address. Either they'd mail me on an adress listed on my website, when the actual company would've mailed on the unique address I gave them (more targeted phishing). Or they'll mail me on an address that I know to be leaked (these are redirected to spam in filters). I am convinced there's an actual solution to a lot of scamming here, if the UX and UI are carefully designed. To be used by "muggles", not just the crowd that knows things like filters and catch-alls and plus-appended etc. It's a pity Google, Microsoft or even proton aren't actively promoting such a "unique mail for every service". But I guess there's little in it for them. ¹ used to self host, but now that's near impossible with the monopolies on mailserves at big tech and moved to mailbox.org. big shoutout! ² aside from the other great benefit. I'm often one of the first to know some service or site was compromised by receiving scam, spam etc. A few times I was even the one to report a breach to such an org via this.

noname120 2y ago
Apple has that with their Hide My Email service (included in the iCloud+ subscription at $0.99/month). It nudges you to create a new alias on every form that contains an email field. The good part is the that aliases are inconspicuous @icloud.com email addresses that don't follow a specific pattern and are thus: 1) Accepted everywhere (contrary to custom domains — which I also have). 2) Are pretty much impossible to detect ahead of time. ———— For illustrative purposes I just clicked several times on the generate new Hide My Email button and it returned those: pie.tall9x@icloud.com drivels_eras4x@icloud.com showier.sizzle-7y@icloud.com I have around 160 aliases so far, I'm not sure what the limit is (if there is one).
- upcoming-sesame 2y ago
  Congrats, you're now married to Apple forever

beshrkayali 2y ago

> The thing that's crazy is that if I followed the 2 "best practices" of verifying the phone number + getting them to send an email to you from a legit domain, I would have been compromised. The best practice I live by is always call them back yourself. Looking up the phone number is not the same.

croemer 2y ago

This is the LinkedIn profile the attacker referred to as his: https://www.linkedin.com/in/solomon-aborbie-jr-6b0a32155/ https://www.linkedin.com/in/solomon-aborbie-jr-6b0a32155/ (Solomon Aborbie Jr) - the CV seems to check out with this Bowdoin video: https://www.youtube.com/watch?v=0n_vHGLDMtM https://www.youtube.com/watch?v=0n_vHGLDMtM - so likely real and the attackers did "identity theft". Starting at 1:58 here: https://cloud-3s03ljpcy-hack-club-bot.vercel.app/0call_recording.m4a https://cloud-3s03ljpcy-hack-club-bot.vercel.app/0call_recor...

zachlatta 2y ago
I think he just found a random engineer from Google on LinkedIn and is pretending to be him.

charlieruben999 2y ago

[dead]

thomas4151 2y ago

[dead]

rosiesophia10 2y ago

[dead]

Ruckerpatsy57 2y ago

[dead]

james4151 2y ago

I appreciate Spyrecovery36 for making me realise the truth to a certified hacke r who knows a lot about what his doing. I strongly recommend you hire him because his the best out there and always delivers. I have referred over 10 people to him and all had positive results. He can help you hack into any devices, social networks including – Facebook, Hangout, iMessages, Twitter accounts, Snap chat , Instagram, Whatsapp, wechat, text messages ,smartphones cloning ,tracking emails and also any other social media messenger or sites. It’s advisable to hire a professional hacker. Thank me later. Contact him here.spyrecovery36 @ gm ail c o m

timsharon 2y ago

[dead]