Gmail, Google Docs Users Hit By Massive Email Phishing Scam (independent.co.uk) 60
New submitter reyahtbor warns of a "massive" phishing attack sweeping the web: Multiple media sources are now reporting on a massive Gmail/Google Docs phishing attack. The Independent is among the top publications reporting about it: "Huge numbers of people may have been compromised by the phishing scam that allows hackers to take over people's email accounts. It's not clear who is running the quickly spreading scam or why. But it gives people access to people's most personal details and information, and so the damage may be massive. The scam works by sending users an innocent looking Google Doc link, which appears to have come from someone you might know. But if it's clicked then it will give over access to your Gmail account -- and turn it into a tool for spreading the hack further. As such, experts have advised people to only click on Google Doc links they are absolutely sure about. If you have already clicked on such a link, or may have done, inform your workplace IT staff as the account may have been compromised. The hack doesn't only appear to be affecting Gmail accounts but a range of corporate and business ones that use Google's email service too. If you think you may have clicked on it, you should head to Google's My Account page. Head to the permissions option and remove the 'Google Doc' app, which appears the same as any other." UPDATE 5/3/17: Here's Google's official statement on today's phishing attack: "We have taken action to protect users against an email impersonating Google Docs & have disabled offending accounts. We've removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail."
How ? (Score:3)
How does clicking a link cause someone's account to be compromised? There is more to the story than clicking the link
Re: (Score:3, Informative)
Clicking the link doesn't hack the account. Adding permissions does. There is another "allow" button that actually causes the "hack" to work.
Change your passwords folks.
Re:How ? (Score:5, Informative)
Changing a password doesn't invalidate the given app permissions if a user falls victim to this. The user's password isn't given over to the attacker. Changing the user's password won't do anything.
Re:How ? (Score:5, Informative)
1) Phishing email appears to come from one of your associates (in the "from" name as the "hhh...@mailinator.com" is the address a dead giveaway to suspicious folks)
2) You click on the link and it bounces you through a Google Oauth request, with parameters that will ask you to authorize either googledocs.gdocs.pro or googledocs.docscloud.win (either way, an attack site)
3) You click "Yes, I'd like to authorize..."
4) You end up on the attack site, and it grabs your contacts (except those with "google", "keeper" or "unty" in the name) and sends a fresh phishing email to all of them in slightly staggered batches
Basically, it's an email worm that bounces through an attack site. Fortunately it uses an Oauth2 request, so Google probably spiked it by killing the client API ID, killing some domains, and also appears to have changed something else too. If the author had been a little more subtle, he would now have backdoors into the Gmail/Gdocs of hundreds of thousands of users. Instead, by scraping/spamming all contacts, he got detected and crushed.
Re:How ? (Score:4, Informative)
Re:How ? (Score:5, Informative)
This is what's happening:
1) You receive a convincing looking e-mail from a known contact, apparently sharing a Google Doc with you.
2) Following the "Open the Doc" link directs you to Google's real pages for logging in, followed up by being prompted to grant permission to "Google Docs" to read, send, delete, and manage your e-mail, as well as your contacts. Clicking on "Google Docs" reveals that it's not the real app, but rather an app with the same name that's linked to some random gmail address. Again, all of this is still via Google's real pages.
3) If you grant permission, you're compromised, because you've effectively given a rogue app full access to your account via the app API. They have full access to your e-mails and contacts, and will send e-mails to all of your contacts indicating that you shared a doc with them, thus perpetuating the scam.
Notably, resetting your password will not revoke the scammer's access. Because you've granted the fake "Google Docs" app full permission to access your account via the app API, they have no need for your password. The best way to remove their access is by going to this Google page [google.com] and removing access for the fake "Google Docs" app.
Re: (Score:1)
Ok, stupid question by someone who's never used Google Docs: why would you ever grant the permissions it was seeking? The screenshots I saw in the Ars Technica article showed that the app wanted full authority to read, send, delete, and manage your email as well as manage your contacts. Anyone who would grant an app those permissions is begging for trouble.
Re: (Score:1)
Re:Google Account (Score:5, Informative)
Story is wrong.. there is no Permissions section
The proper path is My Account, Sign-in & Security, Connected Apps and sites, Manage Apps. You'll see a list of Apps, just make sure that you haven't given permissions to the Google Docs app. If you have, click on the Google Docs app and click on Remove.
Just Hit (Score:3)
Re:Just Hit (Score:5, Insightful)
I wonder what percent of people actually click on these things?
Sadly, probably more than you'd think.
I mean, I get it. Application/computer security isn't always straightforward to the layperson, and it's sometimes hard to tell what's a vulnerability and what isn't. You get an email from someone you know (or that looks like it might have been from someone you know) and you're curious what they're sharing with you. If you're not familiar with phishing patterns and how they usually have to generalize their messages and hide reflected XSS links, it can be tricky to spot a clever phishing attempt.
I really wish there were an easy answer. So far, my best advice to less computer savvy friends and family has been to treat any unexpected or unprecedented links or attachments in their email with suspicion. But I know that sooner or later they'll find a legitimate email that they initially thought was suspicious and start to relax their guard. If anyone has better rules of thumb for less tech savvy family and friends, I'd love to hear it.
Re: (Score:2)
One of the hardest things is that, the interface trains the user into trusting it and even obeying it.
"Enter your password:"
The fact that malware can, in one way or another, get any influence over the interface, is what sinks most things.
Basically, your computer may be corrupted by anything it comes into contact with, so don't trust it.
And if you get caught out, well it is the fault of the technology and the developers.
So don't trust your computer with anything really important, because it is already flawed
Re: (Score:1, Insightful)
I wonder what percent of people actually click on these things?
A lot, when they're sent from someone the recipient knows. That's the beauty of this worm, I guess. If you got one of these emails:
1. It came from someone you've dealt with in the past.
2. It actually did originate from that person's Gmail account.
3. It was sent through Gmail's servers, there's no chain of 5 overseas bot IPs in the headers.
4. The link actually went to accounts.google.com (eventually redirecting elsewhere).
5. Clicking on the link brought up Google's real permissions page with information only
Re: (Score:2)
An email sent to hhhhhhhhhhhhhhhh@mailinator.com passes the smell test? There must be something wrong with your nose.
Re: (Score:2)
1) I had shared documents with the person before, so this wasn't out of the ordinary.
2) We had just got done planning an event, which we often use Google Docs for.
3) I get share requests just often enough to not think anything of them, but not so often that I have a perfect image in my head of what an invite is supposed to look like.
4) My work network is such that I'm used to my authentication not being saved for sites, so it was normal that I
Re: (Score:2)
Re: (Score:2)
We got hit really hard at work by this. 2 of these emails went around, and they appeared to be sent from 2 of our engineers who routinely DO send google docs. The app was setup reasonably convincingly, and because oauth and so called "single sign-on" are really more like "a million sign on" because they never work quite right or ask you for credentials way too often, people are just used to having to approve everything all the time.
So hundreds of people clicked the damn thing. Including a lot of pretty acco
Better Explanation (Score:5, Informative)
http://bgr.com/2017/05/03/goog... [bgr.com]
"It starts with an email from a known contact, which says that the person has shared a Google Doc with you. You’re invited to click the link to open, which redirects you to a legitimate Google sign-in page. You’re prompted to select one of your Google accounts (remember: this is all using Google’s normal sign-in system), and then authorize a legit-looking app called “Google Docs” to manage your emails."
"That’s how the scam works: the app called “Google Docs,” which requests permission to read, send and delete emails, isn’t really a Google app. Rather, it’s an app controlled by the hackers. It seems that once it has permission to manage your email, it secretly sends out a bunch of emails to all your contacts, with the same phishing link."
Re: (Score:2)
Yikes, it shouldn't be so easy to allow someone access to all your email or documents. I can see requesting permission to see one document though.
The thing is, innocuous apps ask all the time for access you wouldn't think they'd need, and users are used to granting permissions. MyFitnessPal, for example, needs access to your phone's camera for its UPC scanner. On the surface, it seems odd that a calorie counting app needs camera access, but it's easy to say, "Well, I want to use the app, so whatever, I guess."
And why wouldn't Google Docs (the legitimate one) need access to your email and other documents? That's pretty much its whole point, after
Only apps can app apps! (Score:2, Informative)
Apps!
Re: (Score:3)
So presumably Google could nip this in the bud by removing the OAUTH credentials for the third-party app named "Google Docs".
And they could avoid these problems in the future by denying registration of any app that claims to be called Google unless it's written by Google, and likewise Dropbox or Microsoft or Apple or Facebook.
already done (Score:2)
This was done by about noon PST yesterday (5/3). Sites hosting the phishing attack were off line and DNS for many/most simply vanished. Email addresses were harvested already, which seems to be the point of the campaign. That, and to validate massive scale manipulation of Google's OAUTH. To the bad guys, it was a big success.
The subject of many/most of these emails was "hhhhhhhhh" (maybe a few more "h"s), so quite honestly people should have known something was wrong. Still, it appears to come from som
Re: (Score:2)
Rules for the masses: Never open attachments you don't expect, even if you know the source.
This comes on the same day that we read news about a spear-phishing attempt which sends dodgy Word attachments to folks in the hospitality industry. The common comment I saw there was "If you see a document whose providence you don't trust, then open it in Google Docs or other online document viewer, so at least you'll be safe" ... :(
Re: (Score:2)
Opening a Word document in Google Docs is a "fix" for Word macro based viruses. LibreOffice works the same (and I recommend this over Google), because neither has the same macro language nor do they allow the same activities in Macros.
What you hint at, is making end users responsible for security. Not an easy task.
Re: (Score:1)
Google is on top of it (Score:5, Informative)
Cloud (Score:1)
Could you have submitted a worse link? (Score:5, Informative)
Comment to submitter... next time, please find an article that provides a much better summary without all the gratuitous clickbait links, please. Like this one [sans.edu], or this one [windowsitpro.com].
Anyways, in short, the doc makes an OAuth request for access to the user's e-mail and contacts. And since every user blindly accepts permissions such as these whenever they add an app to their phone, we had a lot of users at our district click "Accept".
Mod points to anyone who can parse the source code [pastebin.com] and summarize what it does, besides mass-email everyone in the contact list a copy of itself.
Re: (Score:3)
Comment to submitter... next time, please find an article that provides a much better summary without all the gratuitous clickbait links, please.
You must be new here.
How Did they Get that Name? (Score:4, Interesting)
Re: (Score:2)
Same way there's 1700 Android and iOS apps called Pokémon Go, Mario Run and so on?
Re: (Score:1)
Yes. (Score:3)
This is hitting school districts hard in my state. We invariably have people click on phishing scams and it only takes a couple per building to be a real problem.
What to tell the novices... (Score:1)
The question has been asked, here and elsewhere, what we possibly could have told the novices out there in order to immunize them against this sort of attack. The question is even more relevant now that this proof of concept has been a smashing success, which must surely have emboldened other bad guys to improve up on it.
Just tell them to deny any request, even from a trusted entity, to obtain permissions or passwords to another service they use, even if, as in this case, the service (Google Docs) is under