4 ms·
The fact that this happens doesn't have to do with any particular brand. Every company, Google included, is susceptible to this kind of social engineering attac
by wklauss 14y ago
The fact that this happens doesn't have to do with any particular brand. Every company, Google included, is susceptible to this kind of social engineering attacks. Nothing is 100% safe. You can take every precaution possible and there will always be a weak link in the chain.
Apple will double down in security now, especially regarding iCloud, but even doing so there is a chance that this will happen again. Same for Microsoft, Sony and, yes, Google.
There's no magic solution other than being careful. And even with that security is always an illusion. Your door lock is easily opened, no matter how much money you put in it, the only thing preventing you from being robbed is that are more houses in your neighbourhood and that some of those could seem like an easier target.
- cwisecarver 14y agoIf I got veeti's joke then I think what he was trying to say was that it's nearly impossible to get Google on the phone unless you're a corporate customer. If I didn't get his joke then I'm making it now. joke
- wklauss 14y agojoke's on me then :) But back to my point social engineering doesn't require voice. you can do it via email just as easily.
- chmars 14y agoAgain there is no Google mail support to speak of (even with Google Apps for Business in my experience).
- ThePherocity 14y agoSure there is. if you pay for your Google Apps account: http://support.google.com/a/bin/request.py http://support.google.com/a/bin/request.py
- chmars 14y agoThat's why I mentioned Google Apps for Business, that's the paid service you are referring too. There's support but it's still very difficult to get in contact with an actual human being. Social engineering via Google Apps support seems therefore highly unlikely to me. (I am a Google Apps for Business user and have had to contact Google Apps support a few times … the process has never been really pleasant.)
- swdunlop 14y agoIt was the first thing I thought. "Hah! Good luck getting Google to answer a phone.." Then I thought, "wait, was that a joke?"
- steve8918 14y agoI agree. If it's a random attack, then the probability is relatively low to get attacked. But if you're targeted, quite frankly it's probably very easy to attack you, either virtually or physically. One thing I do know, though, is that like you said, security is likely going to get tightened across the board, and that means that it's going to get a lot more inconvenient for all of us. I guess that's a good thing, but it will definitely impact the usability of these services. If it means that all vendors will tie their services to a two-factor authentication scheme linked to our phone, well that might just stop me from using the services altogether.
- wklauss 14y agoI think the services can be improved without becoming too annoying. Someone in this thread suggested a 24 hour delay, which seems reasonable. You could also send a "last call" email and text message to make sure the right user is the one that has requested the password change. Apple could easily separate Find my Mac from "wiping", or add a second password for that. None of these will be 100% effective, but it will make things more difficult for attackers and not too uncomfortable for users.
- ralfn 14y agoGoogle isnt susceptible to this kind of social engineering attack. It requires the existence of a customer service in the first place. Good luck trying to call Google. There is no "magic" solution, there are just solutions. But to suggests its all the same... Thats just lazy. Apple is more vulnerable, because they do do customer support. Sony was more vulnerable, because they just dint give a shit, and didnt bother anything to secure it. Microsoft and Google still have a zero incident record. After all this time. They even went beyond their own responsibility many times, getting police involved because they suspected targetted (political) malware. And no, in the world of formal discrete systems (computers) there are provable correct, and provably incorrect solutions. For example: DRM can always be hacked, but we can secure ourselves from the middlemen. Any analog with a "door" deserves only ridicule.
- siglesias 14y agoFrom the article: The backup email address on my Gmail account is that same .mac email address. At 4:52 PM, they sent a Gmail password recovery email to the .mac account. Here Gmail was only as strong as the weakest password recovery email service it was linked to. I consider this a failure on Google's part.