4 ms·

This is the same type of phishing attack described here[1]. It’s still surprising to me how the SPF, DKIM, and DMARC all pass. If I remember correctly, it’s bec

This is the same type of phishing attack described here[1]. It’s still surprising to me how the SPF, DKIM, and DMARC all pass. If I remember correctly, it’s because they actually have a clever way od getting Google to send an email to you by sharing a Google Form with you or something like that. [1]: https://news.ycombinator.com/item?id=42450221 https://news.ycombinator.com/item?id=42450221

0xDEAFBEAD 2y ago
Yep. Look at the screenshot. It seems they managed to trigger one of Google's standard password reset emails.
ArkaneMoose 2y ago
Based on the text at the bottom of the gist: > Hack Clubbers have determined that this is almost definitely a bug in Google Workspace where you can create a new Workspace with any g.co subdomain and get it to send some emails without verifying that you own the domain. Seems like this is the flow: 1. Create a Google Workspace with a g.co subdomain. Apparently this is not verified, or verifying the domain is not necessary for the next steps. 2. Create an account for the victim under this Google Workspace. 3. Reset that account's password. The victim gets an email from Google Workspace informing them that their password was reset. And this email is a real, legitimate (not spoofed) email from Google because it's just a result of the normal password reset process for a Google Workspace account.
ElijahLynn 2y ago
We have all this verification on the Web, but not the phone. Why do telcos allow for spoofing? We wouldn't allow that with email. Is this a technical limitation that allows for spoofing?
- fn-mote 2y ago
  We have had phone company employees here explaining that their company makes a lot of money from scammers/spammers/etc so they do not have an incentive to stop it. How about a law with teeth?
- drdec 2y ago
  > We wouldn't allow that with email. We allowed email to be the wild west for years and I'm not sure it's better than telephony now
- philipwhiuk 2y ago
  SPF is so bad we basically do allow it

0xDEAFBEAD 2y ago

Yep. Look at the screenshot. It seems they managed to trigger one of Google's standard password reset emails.

ArkaneMoose 2y ago

Based on the text at the bottom of the gist: > Hack Clubbers have determined that this is almost definitely a bug in Google Workspace where you can create a new Workspace with any g.co subdomain and get it to send some emails without verifying that you own the domain. Seems like this is the flow: 1. Create a Google Workspace with a g.co subdomain. Apparently this is not verified, or verifying the domain is not necessary for the next steps. 2. Create an account for the victim under this Google Workspace. 3. Reset that account's password. The victim gets an email from Google Workspace informing them that their password was reset. And this email is a real, legitimate (not spoofed) email from Google because it's just a result of the normal password reset process for a Google Workspace account.

ElijahLynn 2y ago

We have all this verification on the Web, but not the phone. Why do telcos allow for spoofing? We wouldn't allow that with email. Is this a technical limitation that allows for spoofing?

fn-mote 2y ago
We have had phone company employees here explaining that their company makes a lot of money from scammers/spammers/etc so they do not have an incentive to stop it. How about a law with teeth?
drdec 2y ago
> We wouldn't allow that with email. We allowed email to be the wild west for years and I'm not sure it's better than telephony now
philipwhiuk 2y ago
SPF is so bad we basically do allow it