Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
Privacy Security Communications Google Network Networking The Internet IT

Gmail, Google Docs Users Hit By Massive Email Phishing Scam (independent.co.uk) 60

New submitter reyahtbor warns of a "massive" phishing attack sweeping the web: Multiple media sources are now reporting on a massive Gmail/Google Docs phishing attack. The Independent is among the top publications reporting about it: "Huge numbers of people may have been compromised by the phishing scam that allows hackers to take over people's email accounts. It's not clear who is running the quickly spreading scam or why. But it gives people access to people's most personal details and information, and so the damage may be massive. The scam works by sending users an innocent looking Google Doc link, which appears to have come from someone you might know. But if it's clicked then it will give over access to your Gmail account -- and turn it into a tool for spreading the hack further. As such, experts have advised people to only click on Google Doc links they are absolutely sure about. If you have already clicked on such a link, or may have done, inform your workplace IT staff as the account may have been compromised. The hack doesn't only appear to be affecting Gmail accounts but a range of corporate and business ones that use Google's email service too. If you think you may have clicked on it, you should head to Google's My Account page. Head to the permissions option and remove the 'Google Doc' app, which appears the same as any other." UPDATE 5/3/17: Here's Google's official statement on today's phishing attack: "We have taken action to protect users against an email impersonating Google Docs & have disabled offending accounts. We've removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail."
This discussion has been archived. No new comments can be posted.

Gmail, Google Docs Users Hit By Massive Email Phishing Scam

Comments Filter:
  • by Archangel Michael ( 180766 ) on Wednesday May 03, 2017 @03:42PM (#54350775) Journal

    How does clicking a link cause someone's account to be compromised? There is more to the story than clicking the link

    • Re: (Score:3, Informative)

      Clicking the link doesn't hack the account. Adding permissions does. There is another "allow" button that actually causes the "hack" to work.

      Change your passwords folks.

      • Re:How ? (Score:5, Informative)

        by Anonymous Coward on Wednesday May 03, 2017 @03:55PM (#54350863)

        Changing a password doesn't invalidate the given app permissions if a user falls victim to this. The user's password isn't given over to the attacker. Changing the user's password won't do anything.

    • Re:How ? (Score:5, Informative)

      by xxxJonBoyxxx ( 565205 ) on Wednesday May 03, 2017 @04:18PM (#54350967)
      Here's how it appears to work:
      1) Phishing email appears to come from one of your associates (in the "from" name as the "hhh...@mailinator.com" is the address a dead giveaway to suspicious folks)
      2) You click on the link and it bounces you through a Google Oauth request, with parameters that will ask you to authorize either googledocs.gdocs.pro or googledocs.docscloud.win (either way, an attack site)
      3) You click "Yes, I'd like to authorize..."
      4) You end up on the attack site, and it grabs your contacts (except those with "google", "keeper" or "unty" in the name) and sends a fresh phishing email to all of them in slightly staggered batches

      Basically, it's an email worm that bounces through an attack site. Fortunately it uses an Oauth2 request, so Google probably spiked it by killing the client API ID, killing some domains, and also appears to have changed something else too. If the author had been a little more subtle, he would now have backdoors into the Gmail/Gdocs of hundreds of thousands of users. Instead, by scraping/spamming all contacts, he got detected and crushed.
    • Re:How ? (Score:4, Informative)

      by fluffernutter ( 1411889 ) on Wednesday May 03, 2017 @04:21PM (#54350985)
      It looks like it is an OAuth confirmation. In that case all you need to do is say 'yes' and mystery website gets an access key for your account.
    • Re:How ? (Score:5, Informative)

      by Anubis IV ( 1279820 ) on Wednesday May 03, 2017 @04:36PM (#54351057)

      This is what's happening:
      1) You receive a convincing looking e-mail from a known contact, apparently sharing a Google Doc with you.

      2) Following the "Open the Doc" link directs you to Google's real pages for logging in, followed up by being prompted to grant permission to "Google Docs" to read, send, delete, and manage your e-mail, as well as your contacts. Clicking on "Google Docs" reveals that it's not the real app, but rather an app with the same name that's linked to some random gmail address. Again, all of this is still via Google's real pages.

      3) If you grant permission, you're compromised, because you've effectively given a rogue app full access to your account via the app API. They have full access to your e-mails and contacts, and will send e-mails to all of your contacts indicating that you shared a doc with them, thus perpetuating the scam.

      Notably, resetting your password will not revoke the scammer's access. Because you've granted the fake "Google Docs" app full permission to access your account via the app API, they have no need for your password. The best way to remove their access is by going to this Google page [google.com] and removing access for the fake "Google Docs" app.

      • by Anonymous Coward

        Ok, stupid question by someone who's never used Google Docs: why would you ever grant the permissions it was seeking? The screenshots I saw in the Ars Technica article showed that the app wanted full authority to read, send, delete, and manage your email as well as manage your contacts. Anyone who would grant an app those permissions is begging for trouble.

  • by jasnw ( 1913892 ) on Wednesday May 03, 2017 @04:01PM (#54350903)
    Dumped one of these into my mail trash just before I visited /. Suppsedly from 'office@metroroof.com' (a local vendor I used last year) to 'hhhhhhhhh@mailinator.com' with a bcc to my address. Told me that 'Jasmine Crews has shared a document on Google Docs with you." Had a button to click on reading 'Open in Docs'. I wonder what percent of people actually click on these things?
    • Re:Just Hit (Score:5, Insightful)

      by Sumus Semper Una ( 4203225 ) on Wednesday May 03, 2017 @04:33PM (#54351039)

      I wonder what percent of people actually click on these things?

      Sadly, probably more than you'd think.

      I mean, I get it. Application/computer security isn't always straightforward to the layperson, and it's sometimes hard to tell what's a vulnerability and what isn't. You get an email from someone you know (or that looks like it might have been from someone you know) and you're curious what they're sharing with you. If you're not familiar with phishing patterns and how they usually have to generalize their messages and hide reflected XSS links, it can be tricky to spot a clever phishing attempt.

      I really wish there were an easy answer. So far, my best advice to less computer savvy friends and family has been to treat any unexpected or unprecedented links or attachments in their email with suspicion. But I know that sooner or later they'll find a legitimate email that they initially thought was suspicious and start to relax their guard. If anyone has better rules of thumb for less tech savvy family and friends, I'd love to hear it.

      • by Bongo ( 13261 )

        One of the hardest things is that, the interface trains the user into trusting it and even obeying it.

        "Enter your password:"

        The fact that malware can, in one way or another, get any influence over the interface, is what sinks most things.

        Basically, your computer may be corrupted by anything it comes into contact with, so don't trust it.
        And if you get caught out, well it is the fault of the technology and the developers.
        So don't trust your computer with anything really important, because it is already flawed

    • Re: (Score:1, Insightful)

      by Anonymous Coward

      I wonder what percent of people actually click on these things?

      A lot, when they're sent from someone the recipient knows. That's the beauty of this worm, I guess. If you got one of these emails:

      1. It came from someone you've dealt with in the past.

      2. It actually did originate from that person's Gmail account.

      3. It was sent through Gmail's servers, there's no chain of 5 overseas bot IPs in the headers.

      4. The link actually went to accounts.google.com (eventually redirecting elsewhere).

      5. Clicking on the link brought up Google's real permissions page with information only

      • by barakn ( 641218 )

        An email sent to hhhhhhhhhhhhhhhh@mailinator.com passes the smell test? There must be something wrong with your nose.

      • For me, it was the perfect combination of several factors:

        1) I had shared documents with the person before, so this wasn't out of the ordinary.
        2) We had just got done planning an event, which we often use Google Docs for.
        3) I get share requests just often enough to not think anything of them, but not so often that I have a perfect image in my head of what an invite is supposed to look like.
        4) My work network is such that I'm used to my authentication not being saved for sites, so it was normal that I
        • If you use Google Docs that often, you'd already have granted it all needed permissions. So it should raise some eyebrows if "Google Docs" asks for "those" permissions again
    • by Shados ( 741919 )

      We got hit really hard at work by this. 2 of these emails went around, and they appeared to be sent from 2 of our engineers who routinely DO send google docs. The app was setup reasonably convincingly, and because oauth and so called "single sign-on" are really more like "a million sign on" because they never work quite right or ask you for credentials way too often, people are just used to having to approve everything all the time.

      So hundreds of people clicked the damn thing. Including a lot of pretty acco

  • Better Explanation (Score:5, Informative)

    by jetkust ( 596906 ) on Wednesday May 03, 2017 @04:06PM (#54350931)
    Also with a gif of the attack.
    http://bgr.com/2017/05/03/goog... [bgr.com]

    "It starts with an email from a known contact, which says that the person has shared a Google Doc with you. You’re invited to click the link to open, which redirects you to a legitimate Google sign-in page. You’re prompted to select one of your Google accounts (remember: this is all using Google’s normal sign-in system), and then authorize a legit-looking app called “Google Docs” to manage your emails."

    "That’s how the scam works: the app called “Google Docs,” which requests permission to read, send and delete emails, isn’t really a Google app. Rather, it’s an app controlled by the hackers. It seems that once it has permission to manage your email, it secretly sends out a bunch of emails to all your contacts, with the same phishing link."
    • by Anonymous Coward
      This is just an app doing what apps do: apping other apps! Only LUDDITES hate apps that app other apps!

      Apps!
    • by ljw1004 ( 764174 )

      So presumably Google could nip this in the bud by removing the OAUTH credentials for the third-party app named "Google Docs".

      And they could avoid these problems in the future by denying registration of any app that claims to be called Google unless it's written by Google, and likewise Dropbox or Microsoft or Apple or Facebook.

      • This was done by about noon PST yesterday (5/3). Sites hosting the phishing attack were off line and DNS for many/most simply vanished. Email addresses were harvested already, which seems to be the point of the campaign. That, and to validate massive scale manipulation of Google's OAUTH. To the bad guys, it was a big success.

        The subject of many/most of these emails was "hhhhhhhhh" (maybe a few more "h"s), so quite honestly people should have known something was wrong. Still, it appears to come from som

        • by ljw1004 ( 764174 )

          Rules for the masses: Never open attachments you don't expect, even if you know the source.

          This comes on the same day that we read news about a spear-phishing attempt which sends dodgy Word attachments to folks in the hospitality industry. The common comment I saw there was "If you see a document whose providence you don't trust, then open it in Google Docs or other online document viewer, so at least you'll be safe" ... :(

          • by s.petry ( 762400 )

            Opening a Word document in Google Docs is a "fix" for Word macro based viruses. LibreOffice works the same (and I recommend this over Google), because neither has the same macro language nor do they allow the same activities in Macros.

            What you hint at, is making end users responsible for security. Not an easy task.

        • The subject was "XXXX has shared a document on Google Docs with you". That is the exact subject format for legit use of Google Docs sharing. The To in the body was "hhhhhhhhhhhhhhhh@mailinator.com" - that should have been the giveaway. I believe most if not all email clients will display this string (my Outlook will) - however, if the phishing program had used the name from the address book (it already had the email address from the address book) then this would have fooled ever more people.
  • by Mr.Intel ( 165870 ) <mrintel173@@@yahoo...com> on Wednesday May 03, 2017 @04:14PM (#54350957) Homepage Journal
    Had an acquaintance get hit with this and received the phishing attempt. Didn't click the link because of the red flags (non-specific document name and the TO address) but sent him a warning and a link to this story. He replied telling me he knew about it and their IT department was handling it. I replied back but it bounced. I changed the subject, removed the phishing link in the quoted email thread and it went through. Looks like google is blocking these messages from being sent/received at all. Fairly recent change as well.
  • Wow, what's this thing called the cloud? Having all your files available on the internet all the time sounds like a GREAT IDEA!
  • by Pollux ( 102520 ) <speter&tedata,net,eg> on Wednesday May 03, 2017 @04:31PM (#54351019) Journal

    Comment to submitter... next time, please find an article that provides a much better summary without all the gratuitous clickbait links, please. Like this one [sans.edu], or this one [windowsitpro.com].

    Anyways, in short, the doc makes an OAuth request for access to the user's e-mail and contacts. And since every user blindly accepts permissions such as these whenever they add an app to their phone, we had a lot of users at our district click "Accept".

    Mod points to anyone who can parse the source code [pastebin.com] and summarize what it does, besides mass-email everyone in the contact list a copy of itself.

    • Comment to submitter... next time, please find an article that provides a much better summary without all the gratuitous clickbait links, please.

      You must be new here.

  • by Connor Boyle ( 4949923 ) on Wednesday May 03, 2017 @06:16PM (#54351427)
    Anyone have any ideas how the attacker was able to register the name "Google Docs" with Google? I assume you're not supposed to be able to do this or we would have seen this attack much earlier. My original guess was that the name was in non-Latin (Unicode) letters with the same appearance as Latin letters, but my primitive method of copying and pasting into Python and checking for equality with the plain Latin string indicated this wasn't the case.
    • by GNious ( 953874 )

      Same way there's 1700 Android and iOS apps called Pokémon Go, Mario Run and so on?

      • Is that true? Could you provide a link to an app in the iOS store other than Pokémon Go that is named "Pokémon Go"? Note that I'm not talking about apps with names like "Guide for Pokémon Go"; this attack involved being able to name the app "Google Docs"–seemingly identical to the name of the original app by Google. I'd assume they'd block even sort-of similar names, e.g. "GoogIe Docs" with a capital "i" instead of a lower-case "L".
  • by waspleg ( 316038 ) on Wednesday May 03, 2017 @06:59PM (#54351561) Journal

    This is hitting school districts hard in my state. We invariably have people click on phishing scams and it only takes a couple per building to be a real problem.

  • The question has been asked, here and elsewhere, what we possibly could have told the novices out there in order to immunize them against this sort of attack. The question is even more relevant now that this proof of concept has been a smashing success, which must surely have emboldened other bad guys to improve up on it.

    Just tell them to deny any request, even from a trusted entity, to obtain permissions or passwords to another service they use, even if, as in this case, the service (Google Docs) is under

Truly simple systems... require infinite testing. -- Norman Augustine

Working...