5 ms·

I'm sorry if this sounds like me being a jerk - that's not my goal. I just want to point out cold hard facts. > but this is happening right now to a friend of

by nadams 11y ago

I'm sorry if this sounds like me being a jerk - that's not my goal. I just want to point out cold hard facts. > but this is happening right now to a friend of mine's gmail account I can't stress this enough but please enable OTP on your accounts. Facebook, gmail, and even your Windows system if you are paranoid enough. Yeah it adds some hassle - but the value of increased security far outweighs the hassle. Also backup the OTP codes somewhere. > Scammer was able to social engineer the cell phone company to forward his number If they are in the US please tell us the name of the provider so we know not to ever use them. This isn't the first this kind of attack has happened [1] (shame on you DigitalOcean). I use Gandi and they state in their documentation that they will not reset it if you ask them [2]. > Its so disturbing that there is absolute nothing you can do to reach Google once this happens. It's a free service - what do you expect? I've heard this story many many times. Yes - google makes billions in profits and could in theory hire someone to handle gmail issues. But, they don't and it makes sense from a business point of view (why spend money on a guy who will support a service that doesn't make money?). > It could happen on anyone's cell phone as well, how many fortune 500 companies have higher up employees with cell phones and gmail accounts? If a Fortune 500 company uses gmail they would buy the google apps for work. If they buy google apps for work they get an 800 number to call if they have problems (and most likely a dedicated account rep because they are probably buying 1000s of accounts). > Imagine in the future trusting google with a self driving car and home automation Again - you would be giving money to google. And in return you will get support. I'm not saying Google is perfect but if self driving cars become a thing I'm sure (hope) there will be an 800 number you can call when your car becomes sentient. [1] - https://news.ycombinator.com/item?id=9596258 https://news.ycombinator.com/item?id=9596258 [2] - https://wiki.gandi.net/en/hosting/gandi-expert/change-root-passwd-in-expert-mode https://wiki.gandi.net/en/hosting/gandi-expert/change-root-p...

sorrythrowaway9 11y ago
The cellphone provider was sprint. My friend is a paid customer of Google Apps. In part of the process he called called Google Apps, and they immediately disabled his Apps account but -- but they couldn't or wouldn't do anything else including helping him escalate to the right people -- They said they did not know who to contact. Eventually after he called back several times, he got a manager/supervisor who was able to create a ticket. He called back the next day and the ticket was deleted! Meanwhile the scammer is making threats to his family and pretending to be him send out emergency BTC loan requests and resetting bank passwords. He could be SWAT'd at any moment. Apparently Google executives are in the mindset that it isn't cost effective for them to provide even the most minimalist crisis support -- a trivial 5 minute look at the account and seeing the ransom artist texting him (through his own gmail) would at least justify an account hold. Google couldn't be bothered-- even at a record 66 billion dollar profit to help him. Why? Because they can't make a profit helping him. Or maybe its that and they are still in the 2003 "beta" mindset. It truly is a real life THX 1138 nightmare for him.
- o87dv 11y ago
  He is a paying customer... wow unbelievable. Why can the police/FBI help in this case, given all the threads and demands? Were they contacted and informed of the situation?
  - sorrythrowaway9 11y ago
    Yes he has a FBI complaint id and met with them. Basically the FBI said there is nothing they can do. I'm going to get him to contact the journalist for this article and see if there is another FBI agent he can work with. Sprint wouldn't work with him at all and only after dozens of calls did they start to help him get his number back. (The entire number was in the process of being ported). We didn't even think about him being SWAT'd until I read this article. The threats were specifically towards his parents. If anybody has any suggestions please let me know.
- nadams 11y ago
  > My friend is a paid customer of Google Apps. In part of the process he called called Google Apps, and they immediately disabled his Apps account but -- but they couldn't or wouldn't do anything else including helping him escalate to the right people I would be calling sales and support until I got someone who could do something. I would call any number related to Google - including for services not even related to gmail. > Meanwhile the scammer is making threats to his family and pretending to be him send out emergency BTC loan requests and resetting bank passwords. But if his account is disabled how is the scammer sending out emails? > He could be SWAT'd at any moment. That is very unlikely and if it did it would have to churn through the legal system first. > a trivial 5 minute look at the account and seeing the ransom artist texting him That is a sticky situation - many would argue that Google shouldn't read another user's email. And that's probably why support is an issue.
  - sorrythrowaway9 11y ago
    the ransom artist is in full control of the account and sending out emails and text (through google voice) as him. His account is not disabled. The google Apps access account is not the same as his Gmail account, that is where you might be confused. The apps access is disabled. He is an active member of the bitcoin community just like the two bitcoin members mentioned in the article, where one of them got swatted, for about the same ransom amount. It could be related. Obviously he was targeted to some extent because the attacker knew he had BTC. Google Gmail end user license agreement specifically allows google to read your emails. My point is they could do a better job, they just don't care. You can't trust them, they don't have any financial incentive to treat you as a real human person. Right now Google ads is happily serving ads to right of my friend's gmail account while ransom artist is using the account, and google is making money off those clicks -- that's all they care about. Ultimately, there is no human dimension in their company vision.
chrisper 11y ago
The non-existent support problem exists also with other Google products, even when you pay. For example, I used to use Google Nearline. I pay the storage fees etc., but I cannot even contact some basic support without buying a support package which cost quite a lot. So for now I deleted all my data there.
rwallace 11y ago
> It's a free service - what do you expect? No reasonable person expects support for free, but relying heavily on a free service would be a lot less scary if there was an option to get customer support for $100, refundable if they can't solve your problem. At the moment there doesn't seem to be a middle ground between 'behave like a company and open a commercial account before you know there's going to be a problem' and 'if a problem does arise there's nothing you can do for any price'.
- ikeboy 11y ago
  Iirc you are able to get priority support for resetting a Google password if you pay.
  - rwallace 11y ago
    That would certainly be good news! I don't suppose you remember any references to how?
    - ikeboy 11y ago
      I can't find it now, but I seem to remember seeing some option to pay for priority in the account recovery options when resetting one of my accounts in the past.You could always try it on one of your accounts and see.
id_ris 11y ago
Is OTP one-time-password?
- bdcravens 11y ago
  Yes, typically synonymous with two-factor authentication.
  - gknoy 11y ago
    Google apps lets you generate a series of one-time use codes, which you can print out and keep in a safe/folder/notebook, so that if your 2-factor-auth device (phone, fob, etc) gets nuked, you can still log in. I find it interesting that he could log in without 2-factor auth. Those things I thought were keyed to phone hardware.
    - bdcravens 11y ago
      Many 2fa implementations offer SMS (which would be compromised given a social engineering cell redirect) as an alternative to TOTP. (What's commonly referred to as "Google Authenticator" - it's time-based, so if you capture the initial image or code, you can actually set it up on multiple devices, so it's not exactly device-based)
      - id_ris 11y ago
        This is a reason to not verify over SMS and to instead use the Google Authenticator app. It seems easier to socially engineer a SMS redirect than to obtain the mobile device and bypass its login authentication. If you are going to verify over SMS, don't have your SMS messages forwarded to email as that would render your 2fa pointless.
gabemart 11y ago
> I can't stress this enough but please enable OTP on your accounts. Facebook, gmail, and even your Windows system if you are paranoid enough. Yeah it adds some hassle - but the value of increased security far outweighs the hassle. Also backup the OTP codes somewhere. It seems like the specific attack vector in this case was linking the gmail account with a cell phone number. Surely the most secure option is simply a very strong password with no TFA, OTP or any other auxilliary recovery options?
- nadams 11y ago
  > It seems like the specific attack vector in this case was linking the gmail account with a cell phone number. The whole story seems kind of farfetched really. If the attacker did get forwarding to work - it would only forward calls not text messages (which gmail would send a recovery code via text message). According to the story it was in the process of being ported which MAY send texts to the new number - but on most accounts that I've read with dealing with porting that takes at least 24 hours for them to start receiving text messages on the new provider. To my knowledge no carrier has implemented text message forwarding. Also it seemed my posts were downvoted right around the time of his responses. There are certain holes in this story - first it was a gmail account, then it turned into a gmail + google apps account which are 2 completely different things. Regardless - enable OTP period. > Surely the most secure option is simply a very strong password Arguably using a different strong (12+ characters) password for every site and service is a good approach - but then you should probably be generating those passwords and storing them into a password manager. Then that password manager becomes a target[1]. Using OTP is just a good layer of security. [1] http://arstechnica.com/security/2015/06/hack-of-cloud-based-lastpass-exposes-encrypted-master-passwords/ http://arstechnica.com/security/2015/06/hack-of-cloud-based-...
  - makomk 11y ago
    Most services which use phone numbers for authentication helpfully offer to call you and read out the code using text-to-speech if they can't text you, including Google accounts. This is often exploited by attackers.

by nadams 11y ago

sorrythrowaway9 11y ago

The cellphone provider was sprint. My friend is a paid customer of Google Apps. In part of the process he called called Google Apps, and they immediately disabled his Apps account but -- but they couldn't or wouldn't do anything else including helping him escalate to the right people -- They said they did not know who to contact. Eventually after he called back several times, he got a manager/supervisor who was able to create a ticket. He called back the next day and the ticket was deleted! Meanwhile the scammer is making threats to his family and pretending to be him send out emergency BTC loan requests and resetting bank passwords. He could be SWAT'd at any moment. Apparently Google executives are in the mindset that it isn't cost effective for them to provide even the most minimalist crisis support -- a trivial 5 minute look at the account and seeing the ransom artist texting him (through his own gmail) would at least justify an account hold. Google couldn't be bothered-- even at a record 66 billion dollar profit to help him. Why? Because they can't make a profit helping him. Or maybe its that and they are still in the 2003 "beta" mindset. It truly is a real life THX 1138 nightmare for him.

o87dv 11y ago
He is a paying customer... wow unbelievable. Why can the police/FBI help in this case, given all the threads and demands? Were they contacted and informed of the situation?
- sorrythrowaway9 11y ago
  Yes he has a FBI complaint id and met with them. Basically the FBI said there is nothing they can do. I'm going to get him to contact the journalist for this article and see if there is another FBI agent he can work with. Sprint wouldn't work with him at all and only after dozens of calls did they start to help him get his number back. (The entire number was in the process of being ported). We didn't even think about him being SWAT'd until I read this article. The threats were specifically towards his parents. If anybody has any suggestions please let me know.
nadams 11y ago
> My friend is a paid customer of Google Apps. In part of the process he called called Google Apps, and they immediately disabled his Apps account but -- but they couldn't or wouldn't do anything else including helping him escalate to the right people I would be calling sales and support until I got someone who could do something. I would call any number related to Google - including for services not even related to gmail. > Meanwhile the scammer is making threats to his family and pretending to be him send out emergency BTC loan requests and resetting bank passwords. But if his account is disabled how is the scammer sending out emails? > He could be SWAT'd at any moment. That is very unlikely and if it did it would have to churn through the legal system first. > a trivial 5 minute look at the account and seeing the ransom artist texting him That is a sticky situation - many would argue that Google shouldn't read another user's email. And that's probably why support is an issue.
- sorrythrowaway9 11y ago
  the ransom artist is in full control of the account and sending out emails and text (through google voice) as him. His account is not disabled. The google Apps access account is not the same as his Gmail account, that is where you might be confused. The apps access is disabled. He is an active member of the bitcoin community just like the two bitcoin members mentioned in the article, where one of them got swatted, for about the same ransom amount. It could be related. Obviously he was targeted to some extent because the attacker knew he had BTC. Google Gmail end user license agreement specifically allows google to read your emails. My point is they could do a better job, they just don't care. You can't trust them, they don't have any financial incentive to treat you as a real human person. Right now Google ads is happily serving ads to right of my friend's gmail account while ransom artist is using the account, and google is making money off those clicks -- that's all they care about. Ultimately, there is no human dimension in their company vision.

chrisper 11y ago

The non-existent support problem exists also with other Google products, even when you pay. For example, I used to use Google Nearline. I pay the storage fees etc., but I cannot even contact some basic support without buying a support package which cost quite a lot. So for now I deleted all my data there.

rwallace 11y ago

> It's a free service - what do you expect? No reasonable person expects support for free, but relying heavily on a free service would be a lot less scary if there was an option to get customer support for $100, refundable if they can't solve your problem. At the moment there doesn't seem to be a middle ground between 'behave like a company and open a commercial account before you know there's going to be a problem' and 'if a problem does arise there's nothing you can do for any price'.

ikeboy 11y ago
Iirc you are able to get priority support for resetting a Google password if you pay.
- rwallace 11y ago
  That would certainly be good news! I don't suppose you remember any references to how?
  - ikeboy 11y ago
    I can't find it now, but I seem to remember seeing some option to pay for priority in the account recovery options when resetting one of my accounts in the past.You could always try it on one of your accounts and see.

id_ris 11y ago

Is OTP one-time-password?

bdcravens 11y ago
Yes, typically synonymous with two-factor authentication.
- gknoy 11y ago
  Google apps lets you generate a series of one-time use codes, which you can print out and keep in a safe/folder/notebook, so that if your 2-factor-auth device (phone, fob, etc) gets nuked, you can still log in. I find it interesting that he could log in without 2-factor auth. Those things I thought were keyed to phone hardware.
  - bdcravens 11y ago
    Many 2fa implementations offer SMS (which would be compromised given a social engineering cell redirect) as an alternative to TOTP. (What's commonly referred to as "Google Authenticator" - it's time-based, so if you capture the initial image or code, you can actually set it up on multiple devices, so it's not exactly device-based)
    - id_ris 11y ago
      This is a reason to not verify over SMS and to instead use the Google Authenticator app. It seems easier to socially engineer a SMS redirect than to obtain the mobile device and bypass its login authentication. If you are going to verify over SMS, don't have your SMS messages forwarded to email as that would render your 2fa pointless.

gabemart 11y ago

> I can't stress this enough but please enable OTP on your accounts. Facebook, gmail, and even your Windows system if you are paranoid enough. Yeah it adds some hassle - but the value of increased security far outweighs the hassle. Also backup the OTP codes somewhere. It seems like the specific attack vector in this case was linking the gmail account with a cell phone number. Surely the most secure option is simply a very strong password with no TFA, OTP or any other auxilliary recovery options?

nadams 11y ago
> It seems like the specific attack vector in this case was linking the gmail account with a cell phone number. The whole story seems kind of farfetched really. If the attacker did get forwarding to work - it would only forward calls not text messages (which gmail would send a recovery code via text message). According to the story it was in the process of being ported which MAY send texts to the new number - but on most accounts that I've read with dealing with porting that takes at least 24 hours for them to start receiving text messages on the new provider. To my knowledge no carrier has implemented text message forwarding. Also it seemed my posts were downvoted right around the time of his responses. There are certain holes in this story - first it was a gmail account, then it turned into a gmail + google apps account which are 2 completely different things. Regardless - enable OTP period. > Surely the most secure option is simply a very strong password Arguably using a different strong (12+ characters) password for every site and service is a good approach - but then you should probably be generating those passwords and storing them into a password manager. Then that password manager becomes a target[1]. Using OTP is just a good layer of security. [1] http://arstechnica.com/security/2015/06/hack-of-cloud-based-lastpass-exposes-encrypted-master-passwords/ http://arstechnica.com/security/2015/06/hack-of-cloud-based-...
- makomk 11y ago
  Most services which use phone numbers for authentication helpfully offer to call you and read out the code using text-to-speech if they can't text you, including Google accounts. This is often exploited by attackers.