[HN Gopher] A phishing attack involving g.co, Google's URL short...
       ___________________________________________________________________
        
       A phishing attack involving g.co, Google's URL shortener
        
       Author : zachlatta
       Score  : 353 points
       Date   : 2025-01-24 03:38 UTC (1 days ago)
        
 (HTM) web link (gist.github.com)
 (TXT) w3m dump (gist.github.com)
        
       | aramsh wrote:
       | What's even more interesting is there is no DNS records for
       | important.g.co, which means they have found a way to create an
       | Google Workspace without verifying the domain but still able to
       | send emails like password resets.
       | 
       | It's definitely a glitch where you can send emails/transactional
       | emails from an unverified Google Workspace. My guess is that
       | their are protections for google.com and google domains but they
       | forgot to add the g.co domain, which allows unverified sending to
       | g.co and creation of workspaces.
        
       | gm678 wrote:
       | What I'm most curious about is how they were able to spoof the
       | email being sent from `workspace-noreply@google.com`. Given the
       | odd phrasing of 'password for important.g.co', perhaps this is
       | some strategy involving creating a 'parallel' account with the
       | same email and making use of it to send an official-looking email
       | as part of the scam?
        
         | zerocrates wrote:
         | Most likely they did something like sign up for
         | "important.g.co" in Workspace, then added the target as a user,
         | then reset that user's password, causing Google to send a real,
         | verified, from-Google message.
         | 
         | They can't control the contents of the message, but they used
         | the gmail "+" feature to cram the "case ID" onto the target
         | email they created the Workspace account for, making that seem
         | real.
        
           | markerz wrote:
           | But how did they MITM the verification code? Was the first
           | two presented to the attacker, and the rest was presented to
           | the email? Or were they able to MITM the whole email/code and
           | just shared the first two to gain trust?
        
             | Spoom wrote:
             | This sounds like they were using the "tap a button on your
             | device" 2FA method (see
             | https://support.google.com/accounts/answer/7026266). Not
             | sure of the details as to how they got to that page in the
             | first place, though the docs say that you can potentially
             | use it to recover your account.
             | 
             | Never trust an incoming call, especially if it's talking
             | about authentication problems you didn't know you had.
             | 
             | Googler, opinions my own (and I'm not an expert in this
             | particular space).
        
             | renewiltord wrote:
             | When you use a device to do 2FA, Google will display one
             | code on the logging in device screen and three on the 2FA
             | screen. This is so that the user doesn't just blindly hit
             | accept on the Gmail/YouTube app that hosts the 2FA prompt.
        
               | valleyer wrote:
               | A one in three risk of hitting the wrong button still
               | seems insanely high to me. Why is this 2FA method
               | deployed instead of things like "enter the code here"?
               | 
               | (I know it wouldn't necessarily have stopped this
               | phishing attempt.)
        
               | renewiltord wrote:
               | Unclear why. You have to hit a prompt that says "Yes,
               | this was me" and then pick a button. The approach airplay
               | takes to pair: type in 6 digit code. That seems better to
               | me.
        
               | dmurray wrote:
               | It should be much less than one in three, because the
               | user doesn't get conditioned to "just tap one of the
               | numbers and it goes away". The way to consistently
               | dismiss the interruption is to tap the fourth button
               | labelled something like "what, no, that wasn't me".
        
               | valleyer wrote:
               | Yeah, good point. But I still think it's too much risk to
               | place on a potential errant click.
               | 
               | (I have to admit I haven't used the UI in question, and I
               | can't find a screenshot of it on Google Images. Maybe
               | this is a lot safer than I'm imagining.)
        
               | dmurray wrote:
               | I had it just today, it's slightly worse than I was
               | remembering! The "Cancel" button is way less prominent.
               | 
               | Still, remember this is MFA - at least I'm pretty sure
               | you can't have this as the only way to access your
               | account. An attacker typically needs your password plus
               | you to misclick here.
        
       | rekabis wrote:
       | > I asked if I could call back a phone number listed on
       | Google.com and she said sure - this number is listed on
       | google.com and you can call back with your case number, but there
       | may be a wait on hold and I might get a different agent. I
       | googled it and sure enough, it was listed on google.com pages. I
       | didn't call back though.
       | 
       | This is where a big mistake is. Always, _ALWAYS_ phone or contact
       | back using the company's official channels. Because if they have
       | sufficient info about you, scammers can make a call sound hella
       | legitimate, but one thing they still cannot do is pick up the
       | company's phone for them when you phone in. Especially if you
       | call from a hardline, which requires compromising the phone
       | company's switching equipment.
       | 
       | Even my father, nearly 86 with a 5th grade education and slowly
       | sliding into dementia, knows better than to uncritically accept
       | being directly contacted. He's already short-circuited several
       | scams (of various types) in the last few years by hanging up and
       | phoning back in himself.
        
         | jrochkind1 wrote:
         | > Especially if you call from a hardline,
         | 
         | I have no idea where I'd find one of those.
        
         | philipwhiuk wrote:
         | Yeah.
         | 
         | In reality the number your phone carrier provides is basically
         | a guess. It does in no way guarantee who is calling you.
        
         | pests wrote:
         | This used to not be safe though, in the age of landlines.
         | 
         | I forget the details, but most of the country was wired in a
         | manner that both parties of a call had to hang up to end the
         | connection.
         | 
         | You might hang up, go find the official phone number, but when
         | you pick the phone off the cradle you would still be in the
         | previous call. They could fake the dial tone and you would be
         | none the wiser.
         | 
         | I remember pranking friends with this back when I was young.
         | Harmless stuff.
        
           | quesera wrote:
           | I think this was in crossbar switches. The initiator of the
           | call had to hang up for something like 8 seconds.
           | 
           | This was useful if they called you and you answered in the
           | kitchen, but wanted to run to another room to talk. Not that
           | I think it was designed to be a feature! But I used it that
           | way.
           | 
           | If you didn't trust the caller, you could hang up, wait 10
           | seconds, then get a good clean real dial tone. Remember dial
           | tones?
           | 
           | Anyway none of this is relevant in modern switching systems,
           | much less cellular networks.
        
             | quesera wrote:
             | > _The initiator of the call had to hang up for something
             | like 8 seconds_
             | 
             | Sorry, correcting myself:
             | 
             | If the initiator of the call hung up, the call would be
             | ended immediately.
             | 
             | If _only_ the receiver hung up, the call would remain
             | "live" and resumable for about 8 seconds.
        
         | insane_dreamer wrote:
         | > This is where a big mistake is. Always, ALWAYS phone or
         | contact back using the company's official channels.
         | 
         | The problem, and the reason why that scam approach works half
         | the time, is that calling back is a huge PITA these days
         | between 1) endless routing menus or some "smart" AI bot that is
         | f*ing useless (seriously, I have never been helped to my
         | satisfaction by one of those), 2) long long long hold times to
         | get to a human, if you ever do, because every single company is
         | always "expecting greater than usual call volumes" -- wtf? call
         | volume distributions are Gaussian, ok? so adjust accordingly.
        
           | naniwaduni wrote:
           | Calls are also just inherently more likely to arrive when
           | call volumes are above average. There are more calls then.
        
       | pavel_lishin wrote:
       | I know it's easy to second-guess someone after they've explained
       | that they're describing a scam, but:
       | 
       | > _The thing that 's crazy is that if I followed the 2 "best
       | practices" of verifying the phone number + getting them to send
       | an email to you from a legit domain, I would have been
       | compromised._
       | 
       | He _didn 't_ follow the first of those best practices. He just
       | looked up a phone number that the caller also read out to him,
       | _and didn 't call it_. And "Solomon" also explicitly told him he
       | _couldn 't_ call.
       | 
       | I honestly think that at this point, no incoming phone call can
       | ever be trusted.
        
         | ksala_ wrote:
         | I'd argue the second one was not followed either. Maybe I'm
         | misunderstanding the article, but I would not take a random
         | "your password has changed" as proof. I would need the caller
         | to send me an actual email from their personal work email
         | address (or ticket system?) with some actual, human
         | communications in it.
        
         | numbsafari wrote:
         | > no incoming phone call can ever be trusted.
         | 
         | They can't. And they haven't been for a while. Spoofing phone
         | calls is simply too easy, and nothing is being done to fix
         | that, despite the fact that it puts so many of us at risk. It's
         | not an insurmountable problem, technologically. It is literally
         | a lack of will and outcry from ordinary people, despite how
         | often this fact is used to abuse so many.
         | 
         | Credit Card companies have known this for a long time. My
         | credit card company will call and say "do not call back to this
         | number, call the number on the back of your card and use this
         | reference number".
         | 
         | That should absolutely be the norm at this point.
        
           | BobaFloutist wrote:
           | Telecoms know if a number is spoofed or not. All I want is
           | for them to wholesale steal the original Twitter "verified"
           | check, and use it to confirm that a call is not spoofed.
        
             | umanwizard wrote:
             | My iPhone (on Verizon) already does this.
        
             | HeatrayEnjoyer wrote:
             | The originating provider knows, but do providers downstream
             | know? If AT&T receives a call from $MadagascarPhoneCorp who
             | indicates the call is officially from $IndiaPhoneCorp, can
             | AT&T trust that?
        
               | BobaFloutist wrote:
               | >The STIR system aims to add information to the SIP
               | headers that allow the endpoints along the system to
               | positively identify the origin of the data. This does not
               | directly prevent the ability for a robocaller to spoof a
               | caller ID, but it does allow upstream points to decide
               | whether or not to trust that ID
               | 
               | https://en.wikipedia.org/wiki/STIR/SHAKEN#STIR
               | 
               | It's not all the way there, I guess.
        
             | jrib wrote:
             | They should also display something indicating it is _not_
             | verified when it is not
        
             | numbsafari wrote:
             | I don't need a "verified" tag. No spoofed call should ever
             | get through. Ever. When would I ever want a spoofed caller
             | ID? Never.
        
         | lolinder wrote:
         | I don't even know where the idea that those are the best
         | practices came from.
         | 
         | The phone number best practice has always been constructed as
         | "call them back at a known good number, preferably one written
         | on paper or on your card". You certainly don't ask them to show
         | you where on the company website the phone number is listed.
         | 
         | And asking the person on the phone with you to send you an
         | email from a specific domain is likewise not something I've
         | ever seen recommended: that's one of several things you check
         | to see if an email is phishing (And only one of several! A good
         | domain isn't enough to clear an email!) But if you're already
         | on the phone with someone suspicious, the best practice has
         | always been to get off the phone with them immediately and call
         | a known number, not to ask the caller to prove themselves.
         | 
         | None of this is to blame OP for misunderstanding, it's just
         | very clear that we need to do better at communicating these
         | rules out to the world.
        
           | superq wrote:
           | But, if it _is_ listed on the company website, then..
           | 
           | But you're right: simply say "given that this is a sensitive
           | security matter, thank you for the heads up. Don't call me,
           | I'll call _you_ (click) "
        
             | bryanrasmussen wrote:
             | >But, if it is listed on the company website, then..
             | 
             | I'm sorry I'm going to have to call you, instead of you
             | calling me
             | 
             | Of course, the company phone number is right in the footer
             | of the website.
             | 
             | -- goes to open website from last email sent from company,
             | goes to colnbase.com.
        
             | lolinder wrote:
             | Yeah, even if it is listed on the website you still hang up
             | and call that number right back. Caller ID spoofing is
             | still not solved.
        
       | blevinstein wrote:
       | Sounds really similar to my experience a few months ago. I
       | commented here about it.
       | 
       | https://www.reddit.com/r/googleworkspace/s/NtJpputXtg
       | 
       | There was something in Google workspace that allowed the scanners
       | to have an email sent to them, AND an additional and of their
       | choice. But when I asked about calling them back, I was told that
       | wasn't possible, which made me suspicious.
        
       | philfreo wrote:
       | Can someone explain point #9 in the gist? How'd they know part of
       | the two factor code?
        
         | jonas21 wrote:
         | The attacker was going through the sign in flow on their own
         | computer. In the MFA step, it shows you a number and asks to
         | you press the same number on your phone.
         | 
         | There's a screenshot of what this looks like here:
         | https://gist.github.com/zachlatta/f86317493654b550c689dc6509...
        
         | jsnell wrote:
         | It's not a two-factor code like you're thinking of. That code
         | is shown on the sign-in / account recovery page, to whoever
         | making that attempt. Then the same value has to be chosen on
         | the mobile device that's being used to authenticate that sign-
         | in.
         | 
         | The goal isn't to protect against phishing or social
         | engineering, but against people accidentally approving a sign-
         | in they didn't initiate.
        
           | joshuamorton wrote:
           | (specifically, there are "credential stuffing" style sign-in
           | attacks where an attacker logs in "suspiciously" at the same
           | time as a legit log in, possibly after forcing a log-out,
           | hoping you approve both your log in and theirs when you get
           | two, or ten pop-ups)
        
         | ekimekim wrote:
         | What I'm confused by is how they got that far, to the point
         | that 2FA was the only thing in their way. Did they already have
         | this user's password?
        
       | rvnx wrote:
       | It would be better if Google would react more strongly to such
       | attacks.
       | 
       | -> There is a sophisticated one where you can take over an
       | account via the Account Recovery flow, that is still actively
       | abused; tried to report, got "not a bug, triaging as abuse risk"
        
       | arccy wrote:
       | unless thinks they own important.g.co, they've just walked past
       | some glaring red flags, it doesn't even mention their domain in
       | the email.
        
       | do_not_redeem wrote:
       | As usual this started with an incoming phone call. If you ever
       | receive a phone call from a tech company, it's a scam. The caller
       | ID doesn't matter. The caller's accent (wtf) doesn't matter
       | either. It's a scam.
        
         | ripped_britches wrote:
         | Not if you're an app developer on their platform, they make
         | outbound calls to you. I'm sure there are other situations as
         | well.
        
           | do_not_redeem wrote:
           | If the consequences for letting that call go to voicemail are
           | any less severe than full account takeover by a script
           | kiddie, you're still better off never picking up.
           | 
           | Google in particular is famous for making it impossible to
           | contact a human. If Google calls you, before picking up,
           | consider whether you truly believe you're lucky enough to be
           | one of a handful of people in the world to ever get human
           | support from them.
        
             | teractiveodular wrote:
             | I've spoken on the phone with humans in Google support.
             | (You, too, can do this, just pay them enough.) However,
             | they called me _after_ I filed a support case _and_
             | specifically requested a call, and they started off by
             | mentioning the number of the case I had filed.
             | 
             | If you ever get a _cold call_ from  "Google Support", it's
             | basically guaranteed to be a scam.
        
               | bookofjoe wrote:
               | After I got Google Glass in 2013 as one of 8,000
               | "Explorers" I was given a support telephone number that
               | was always quickly answered by a Google employee
               | knowledgeable about Glass.
        
           | lolinder wrote:
           | You still always assume an incoming call is a scam no matter
           | what. Hang up, look up, call back, in that order.
           | 
           | Very occasionally you might be making some poor customer
           | support person's job harder, but the vast majority of the
           | time you'll be hanging up on a scammer. You can be polite
           | about it, but firm and brief. "It's my policy to always call
           | back no matter what, nothing personal."
        
             | dawnerd wrote:
             | The problem is verifying which number is correct. In most
             | cases it's pretty easy. Bank? Call the number on a debit
             | card. Google? Good luck even finding their number.
             | 
             | But I do agree with you. They can leave a message and a way
             | to contact back if its important and I can take my time
             | doing research. The urgency part is what's caught so many
             | high profile people off guard.
        
           | nodamage wrote:
           | For what purpose do they make these calls?
        
         | hbn wrote:
         | > The caller's accent (wtf)
         | 
         | You don't have to pretend to be confused.
         | 
         | The industry of Indian scam call centers is not a crazy
         | conspiracy invented by racists.
        
           | quesera wrote:
           | > _The industry of Indian scam call centers was not invented
           | by crazy racists._
           | 
           | Nor was the industry of Indian legitimate call centers.
           | 
           | You cannot glean any useful signal of legitimacy from the
           | caller's accent.
           | 
           | That's the WTF.
        
             | moi2388 wrote:
             | As if official Indian tech support is not a scam..
        
               | quesera wrote:
               | Support quality is a function of cost, which is a
               | function of customer value.
               | 
               | Low-margin businesses will hire low-cost support on
               | whatever continent it's available.
        
               | silisili wrote:
               | So worst case, it's a scam. Best case, it's some useless
               | cutrate support or sales call. Sounds like this is
               | absolutely an indicator not to bother.
        
               | quesera wrote:
               | The best indication not to bother answering is that they
               | called you.
               | 
               | Doesn't matter how familiar their accent sounds.
               | 
               | They are not calling for your benefit.
               | 
               | No need to get xenophobic about it.
        
               | ruszki wrote:
               | High-margin businesses too. Useless, powerless customer
               | support is the default. Most of the time, even in person.
        
               | quesera wrote:
               | Low-margin businesses always have bad support, and
               | there's nothing you can do about it.
               | 
               | High-margin businesses usually have passable or good
               | support. If your vendor of choice does not, you have
               | chosen the wrong vendor and should switch. There are
               | other options that do a better job.
        
               | paulryanrogers wrote:
               | I've talked to some terribly unqualified Indian support
               | folks. And I talked to some really talented ones who
               | saved me a lot of time and headaches.
        
             | TheRealSteel wrote:
             | Almost all scam calls originate in India. It's absolutely
             | an indicator.
        
               | do_not_redeem wrote:
               | Your second sentence doesn't follow from the first, for
               | the same reason as the Bayes medical test paradox.
        
               | Vampiero wrote:
               | I don't care if it's a scam or a call center, I hate
               | both.
        
               | quesera wrote:
               | Agreed, but irrelevant to the thread at hand.
               | 
               | The accent of the caller is not a useful signal.
               | 
               | The very fact that _they_ called _you_ is a pretty good
               | indication that you do not want to talk to them. 99%
               | strength.
        
               | brookst wrote:
               | Almost all murderers are men, therefore if you see a man
               | he's probably a murderer.
               | 
               | It's not an indicator.
        
               | encom wrote:
               | Good morning, sir.
        
           | zb3 wrote:
           | However, now we have AI, so you shouldn't assume the call is
           | safe if the accent matches either...
        
         | qingcharles wrote:
         | I regularly get phone calls from Google because I helped a
         | friend with their ad account once. No matter how many times I
         | tell them not to call they eventually find a new number to call
         | me from. They are legit calls. Google just won't take no for an
         | answer.
        
         | goguy wrote:
         | I do this for any inbound call, unless the caller id is someone
         | in my contacts it can go to voicemail. If it's important they
         | either leave a voicemail or keep trying, for repeated calls I
         | will answer but with skepticism.
         | 
         | If they are in my contacts I will recognise their voice.
        
       | nemothekid wrote:
       | I'm not sure if it's good thing or not but I've come to consider
       | that _any_ notification about a password being reset or a
       | fraudulent charge is phishing unless I initiate some action.
       | 
       | I always verify that I'm actually fucked and then take action.
       | This seems counter-intuitive but the deluge of phishing emails
       | makes me feel this is the safest option. I'd rather wait to
       | notice a fraudulent charge and dispute it, than leak info to a
       | random SMS number that claims (possibly truthfully) that someone
       | in Japan spent $9000 at the gucci store.
        
         | ronnier wrote:
         | Agreed. I do not follow any links, accept calls, etc. I go to
         | the site of origin and do what I need. Also be careful if you
         | search for the sites name on Google, still might click a fraud
         | site!
        
       | sethops1 wrote:
       | > Someone named "Chloe" called me from 650-203-0000
       | 
       | Nope. Rule #1 in today's environment is never pick up the phone.
       | If you're not expecting the call they can leave a message. And if
       | it's something you think is legitimate, get the authentic number
       | from a reputable source.
        
       | renewiltord wrote:
       | That's not verifying the phone number. I received a call from
       | Chase about a wire. I asked them for a code so I could continue
       | the conversation and then looked up the phone number on their
       | website and called that and talked through reps till I got to the
       | right department.
       | 
       | Caller ID being spoofed is the wrong way to think about this.
       | It's just that if someone walks up to you and says "Hey, I'm Jean
       | d'Eau and I'm President of the US" you don't think to yourself
       | "oh yeah he's definitely President and that's his name".
       | 
       | People can always tell you they're whoever they want to be. You
       | can either believe it or go find out if they are.
        
       | adrr wrote:
       | How did they send an email from google.com that passed DKIM and
       | SPF? Thats a huge concern.
        
         | jorams wrote:
         | It's specifically a password reset email. A Google Workspace
         | admin can send a password reset to any of their users, and it
         | will pass DKIM and SPF. The trick here is that apparently you
         | can sign up for Workspace with a g.co subdomain and, without
         | verifying the domain, can trigger a password reset to be sent.
        
           | layman51 wrote:
           | I'm still a bit confused around how they sent him the email.
           | Maybe they added him to the Google Workspace as a member?
        
             | jorams wrote:
             | Yeah they did. They added his email as a secondary email to
             | a Google Workspace user account, with the plus-address-
             | suffix including a "Case ID". Then they reset the password
             | of the user account, triggering this notification.
        
       | layman51 wrote:
       | This is the same type of phishing attack described here[1]. It's
       | still surprising to me how the SPF, DKIM, and DMARC all pass. If
       | I remember correctly, it's because they actually have a clever
       | way od getting Google to send an email to you by sharing a Google
       | Form with you or something like that.
       | 
       | [1]: https://news.ycombinator.com/item?id=42450221
        
         | 0xDEAFBEAD wrote:
         | Yep. Look at the screenshot. It seems they managed to trigger
         | one of Google's standard password reset emails.
        
         | ArkaneMoose wrote:
         | Based on the text at the bottom of the gist:
         | 
         | > Hack Clubbers have determined that this is almost definitely
         | a bug in Google Workspace where you can create a new Workspace
         | with any g.co subdomain and get it to send some emails without
         | verifying that you own the domain.
         | 
         | Seems like this is the flow:
         | 
         | 1. Create a Google Workspace with a g.co subdomain. Apparently
         | this is not verified, or verifying the domain is not necessary
         | for the next steps.
         | 
         | 2. Create an account for the victim under this Google
         | Workspace.
         | 
         | 3. Reset that account's password.
         | 
         | The victim gets an email from Google Workspace informing them
         | that their password was reset. And this email is a real,
         | legitimate (not spoofed) email from Google because it's just a
         | result of the normal password reset process for a Google
         | Workspace account.
        
         | ElijahLynn wrote:
         | We have all this verification on the Web, but not the phone.
         | Why do telcos allow for spoofing? We wouldn't allow that with
         | email. Is this a technical limitation that allows for spoofing?
        
           | fn-mote wrote:
           | We have had phone company employees here explaining that
           | their company makes a lot of money from scammers/spammers/etc
           | so they do not have an incentive to stop it.
           | 
           | How about a law with teeth?
        
           | drdec wrote:
           | > We wouldn't allow that with email.
           | 
           | We allowed email to be the wild west for years and I'm not
           | sure it's better than telephony now
        
           | philipwhiuk wrote:
           | SPF is so bad we basically do allow it
        
       | yread wrote:
       | The business/answers page with the number is about calls from
       | Google Assistant and (now?) explicitly says it's not about calls
       | from the support. That would be this page
       | 
       | https://support.google.com/business/answer/6212928?hl=en
       | 
       | Disappointingly, it only says how to identify automated calls
       | from Google, it doesn't offer a protocol for verifying actual
       | humans from Google calling you. Perhaps it happens so rarely you
       | can just assume it's not Google.
        
       | internetter wrote:
       | To all the people criticizing OP, 5 million people are victims of
       | phishing attacks every year. This attack is more sophisticated
       | than 99.99% of them. Cut OP some slack.
        
         | quickthrowman wrote:
         | > I asked if I could call back a phone number listed on
         | Google.com and she said sure - this number is listed on
         | google.com and you can call back with your case number, but
         | there may be a wait on hold and I might get a different agent.
         | I googled it and sure enough, it was listed on google.com
         | pages. _I didn 't call back though._
         | 
         | Emphasis mine.
         | 
         | Also, if a human called me and claimed to be working for
         | Google, I would laugh heartily and hang up the phone. Google
         | doesn't even have call in tech support, why would they call
         | _you_ for something as banal as a compromised account?
        
           | superq wrote:
           | Admitting one mistake doesn't moot the whole incident, nor
           | does it take Google off the hook.
        
           | internetter wrote:
           | Again, 5 million people fall for phishing. This attack was
           | magnitudes more sophisticated than most. I still get the
           | occasional Nigerian prince scam. They still send them because
           | it still works. Not all of the people who fall for this are
           | stupid. Surely you've made mistakes before.
        
           | sodality2 wrote:
           | This is about Google Workspace, a higher tier paid account
           | which does include phone support. Equivalent to if someone
           | like your business ISP called you (or someone else who you
           | are a paying customer of, with real phone lines). That being
           | said, it is mentioned that OP doesn't pay for that or Google
           | One.
        
             | zachlatta wrote:
             | I am a paying user of Google Workspace, and also run a
             | charity that is a user of Google Workspace with thousands
             | of accounts. The account they were trying to phish was a
             | paid Google Workspace email.
        
         | nejsjsjsbsb wrote:
         | I agree. Easy to Monday morning quarterback opsec but we're
         | human and the best fall for stuff all the time.
         | 
         | A non tech person wouldn't know Google has bad support and is
         | unlikely to call you, that a number and email can be spoofed,
         | etc. And even if 99% didn't fall for it, just 100 calls gets
         | the scammer a victim on average.
        
       | throwpoaster wrote:
       | URL shorteners are a massive security hazard.
        
         | gruez wrote:
         | Maybe, but in this particular case the attack has nothing to do
         | with url shortening. The essential elements were google
         | assistant (to spoof caller ID), and google workspace (to send
         | the "case" email).
        
       | hombre_fatal wrote:
       | The biggest scare I've gotten is somehow ending up on
       | "colnbase.com" (instead of "coinbase.com").
       | 
       | It's defunct now, but at the time it was a 1:1 replica of
       | Coinbase. And the only reason I noticed was because 1Password
       | didn't offer to fill in my credentials.
       | 
       | While knowing someone's email/password combo might not be enough
       | for an attacker to do anything malicious on Coinbase itself (due
       | to email re-verification maybe), the point is that even the
       | smartest of us Hacker News users can fall for it. And that should
       | scare the rest of us.
        
         | gleenn wrote:
         | So so true. 1Password refusing to auto fill a password has
         | saved me multiple times in the past! Also, one of my friends
         | has a PhD in literally rocket science (aeronautical engineering
         | from MIT) and got scammed by someone who stole his brother's
         | SIM card and did some shenanigans. No one is safe, no matter
         | how smart or tech savvy you think you are! For the less tech
         | savvy folks, I understand why they are scared, it's hard to
         | give them even general tips to not lose the farm to fraudsters.
        
           | paranoidrobot wrote:
           | The general advice I give is:
           | 
           | Don't trust incoming calls, text messages or emails.
           | 
           | Don't trust caller ID on your phone.
           | 
           | If someone calls you asking for information or to do
           | something, ask for a case id or reference number. Hang up,
           | call back on a number you get from a previous bill, back of
           | your credit card, or by googling the company.
           | 
           | If anyone is pushing for something to be done urgently, stop.
           | Hang up, don't take any action. Call a trusted other person
           | and talk to them about it.
        
             | snypher wrote:
             | >by googling the company
             | 
             | And remember it's going to be the 4th or 5th link down, not
             | the first.
        
               | brookst wrote:
               | Yeah the first will be the scammers with a highly
               | targeted ad buy, and who can even tell the difference
               | between ads and search results these days?
        
               | jmb99 wrote:
               | All of my search results are search results, because of
               | ad blockers.
               | 
               | Now, many of my search results suck due to SEO and
               | whatnot, but that's a different story.
        
               | btown wrote:
               | This is one of many reasons why ad blocking isn't just
               | cosmetic: it's a best practice for security too!
        
               | miki123211 wrote:
               | So much this.
               | 
               | I recently saved a friend from getting scammed when she
               | wanted to buy an audiobook, we wanted to avoid Audible
               | because of the DRM and limited device selection.
               | 
               | The first few results she got were some shady services
               | offering really good deals. I looked them up on
               | trustpilot and they weren't outright scams, but they
               | aggressively pushed you into getting an expensive monthly
               | subscription that was basically impossible to cancel.
        
             | jrib wrote:
             | I really wish phones would change the UI to make it more
             | obvious that caller ID shouldn't be trusted.
        
             | bennettnate5 wrote:
             | > Don't trust incoming calls, text messages or emails.
             | 
             | > Don't trust caller ID on your phone.
             | 
             | And if you're anyone of moderate fame, importance or
             | cryptocurrency holdings, call back using a phone other than
             | the one you received the call from. SS7 attacks remain
             | relatively cheap , and redirecting an outgoing phone call
             | placed to a phone number they know you're likely to call
             | next is within the realm of feasible attacks.
        
             | ethbr1 wrote:
             | > _If anyone is pushing for something to be done urgently,
             | stop. Hang up, don 't take any action. Call a trusted other
             | person and talk to them about it._
             | 
             | This is honestly the #1 piece of advice to give friends and
             | family.
             | 
             | Almost every scam is predicated on urgency.
        
             | throwawaymobule wrote:
             | I have an entirely seperate phone and SIM for any service I
             | think is important which demands a phone number. (prepay, I
             | top it up by EUR5 every few months. Sadly I can't automate
             | that)
             | 
             | I generally refuse to give any number if I can help it. I
             | can count on one hand the number of unsolicited calls/texts
             | I've gotten.
        
           | hn_acc1 wrote:
           | I know that "rocket scientist" has been a standin for "smart
           | person" or "genius", but in this case, I would be more
           | surprised if a computer security expert (various job titles)
           | had been scammed, because it's their job to be up on this
           | stuff.
           | 
           | How often does a rocket scientist deal with computer viruses,
           | or phishing emails, etc compared to a security expert? Most
           | of the time, their IT security expert (ideally) stops it
           | before it gets to them..
        
             | gleenn wrote:
             | I may be more qualified then, I work in fraud. I
             | accidentally called a fake airline number to get a refund
             | for a Delta ticket and happily gave the guy my credit card
             | for some such fee. If requiring a credit card fee to get a
             | refund isn't a red flag, I don't know a better one. To be
             | fair, my sister had found the number and three way joined
             | me in because I was helping her buy the ticket. So an extra
             | rule: don't even trust a phone number someone you know
             | found because /they/ might have been the first victim and
             | passing compromised information to you.
        
             | throwawaymobule wrote:
             | Rocket science is surprisingly straightforward, it's rocket
             | engineering that's the tricky one.
        
               | patmorgan23 wrote:
               | Yeah projectile motion is high school physics.
               | 
               | Engineering the thing to not rip itself apart, melt, or
               | explode is the hard part.
        
           | noname120 wrote:
           | Physical SIM cards should _always_ have a strong PIN set. It
           | baffles me how many people either don't have a PIN or it's
           | just set to 0000. You're basically handing over your whole
           | digital life away to anyone who gets their hand on your SIM
           | card.
        
             | e40 wrote:
             | I didn't even know that existed until now.
        
           | tonyedgecombe wrote:
           | Smart people often have blind spots. The confidence you get
           | from knowing one subject really well can leave you vulnerable
           | in other areas.
           | 
           | This is one of the reasons scammers like to target doctors.
        
           | jorvi wrote:
           | > Also, one of my friends has a PhD in literally rocket
           | science (aeronautical engineering from MIT)
           | 
           | One of my friends is a nuclear physicist from TU Delft and
           | they somehow managed to install a fake clone of Chrome haha.
           | Somehow never got their accounts broken into or money stolen.
        
         | megablast wrote:
         | > that even the smartest of us Hacker News users
         | 
         | Well, ok then.
        
         | ziml77 wrote:
         | I nearly lost an account because I assumed that 1Password was
         | just being dumb not offering to auto-fill credentials. Turns
         | out I'm the dumb one for doubting it.
         | 
         | Now if 1Password shows nothing to auto-fill I make damn sure
         | I'm on the right site.
        
         | perryh2 wrote:
         | mvspace.com was a really good phishing site back in the day
         | when MySpace was an actual thing.
        
         | Aachen wrote:
         | > the only reason I noticed was because 1Password didn't offer
         | to fill in my credentials.
         | 
         | Nice, I always hope this will save me but I never landed on
         | such a phishing site. How did it happen for you?
         | 
         | About domain-based autofills, perhaps less so now than 5-10
         | years ago: it always seemed weird that the whole security
         | industry seemed to say these plugins, or the browser's built-in
         | password store, are dangerous because there were past
         | vulnerabilities and any website you visit can exploit it. The
         | way I see it: vulns get fixed, I just need to not be in the 1st
         | wave of persons they target (risk type: plane crash, very small
         | odds but sucks to be you); receiving phishing emails or
         | messages happens constantly and apparently it works well enough
         | to continue doing it and evading filters constantly (risk type:
         | car crash, can happen and they get only the creds for the
         | website being autofilled). Would recommend to anyone who then
         | realises something is up when the autofill doesn't work, but
         | ideally would have more evidence to back that up
        
           | hombre_fatal wrote:
           | I don't remember how I ended up there but I'm sure it was a
           | fake email.
           | 
           | Just copy one of Coinbase's legit emails for something like
           | "A withdrawal of $1,200 USD has been started" and you have
           | the perfect bait.
        
         | inetknght wrote:
         | > _The biggest scare I 've gotten is somehow ending up on
         | "colnbase.com" (instead of "coinbase.com")._
         | 
         | You might want to install some browser extensions to block
         | content. Then block _all_ content (set to whitelist) and
         | selectively add the sites you know.
         | 
         | If you end up on a new site with some amalgamation of letters
         | that look familiar, the extension will rightfully block it and
         | prompt you whether you want to whitelist or not. Big ole' red
         | flag right there.
         | 
         | Of course it's not foolproof. It is just another layer in the
         | strategy of defense-in-depth.
        
           | eviks wrote:
           | This is such a waste of time to do this for every single
           | site! Especially when it's easier to rely on the password
           | manager in cases like this
        
             | omoikane wrote:
             | What I do is a greater waste of time -- I have a separate
             | browser profile for each individual site that I might log
             | into, and javascript is only whitelisted for that one site
             | in that profile. It's a real pain because whenever my
             | browser adds a new config option, I have to update the
             | settings in each of the ~20 profiles.
             | 
             | It has saved me a few times where some rogue javascript
             | tries to redirect me to some unexpected site, and the
             | destination site simply doesn't load.
        
               | devsda wrote:
               | I think there's a Firefox extension for this usecase.
               | 
               | Combining that with Multi-account container should make
               | it easier to manage ?
        
               | LordGrignard wrote:
               | dude what how do you have so much free time my lazy ass
               | just has ublock origin with some lists enabled that my
               | even more techbro help me set up and it automatically
               | stops me from visiting suspicious websites this feels
               | like way too much work
        
         | Eikon wrote:
         | https://www.merklemap.com/search?query=coinbase.com&page=0&t...
         | 
         | There's indeed a lot of them :)
        
         | eviks wrote:
         | > 1Password didn't offer to fill in my credentials. > the point
         | is that even the smartest of us Hacker News users can fall for
         | it.
         | 
         | But you didn't fall for it, a simple password manager technique
         | worked as advertised?
        
         | davchana wrote:
         | My friend was not smart as you, and religiously typed password
         | on a fake Amazon website link clicked from an SMS promising a
         | refund on recent purchase. Stopped only when it asked for 2FA
         | code because there was no 2FA setup.
        
         | maccard wrote:
         | One of the worst parts of using a oassword manager is that apps
         | and websites don't by default share their credentials. I could
         | totally see me getting caught by a shady link to a website of
         | an app that I use but because I've never logged into the
         | website, 1Password makes me search for it.
        
       | ElijahLynn wrote:
       | How is call spoofing allowed by telcos? Is it a technical
       | limitation that let's this happen?
        
         | MathMonkeyMan wrote:
         | My understanding is that it's a technical limitation. I read
         | somewhere (maybe a post here on Hacker News) that back in the
         | good old days of telephone monopoly, there was nobody to abuse
         | a zero-security feature like "spoof the number" except the
         | phone company itself, and it was useful for large local
         | corporate phone networks.
        
       | kilroy123 wrote:
       | Extremely scary. This is way above and beyond most phishing
       | attacks. Obviously, this guy is being targeted for some reason or
       | another. I worry about such attacks being automated at scale with
       | AI tools.
        
       | llm_nerd wrote:
       | Totally unrelated, beyond being another Google service, but
       | what's with Google's AppSheet being used for so many phishing
       | emails? How does Google not predict this abuse and prevent it?
       | 
       | Now to be fair they all end up in the spam folder, but these are
       | emails sent from noreply@appsheet.com (SPF passing and
       | originating from a Google IP), albeit with a phishing FROM name
       | like "Meta for Business". I have hundreds of these in my spam
       | folder, telling me that my Meta campaigns (I don't have any Meta
       | campaigns and don't interact with that business at all) have been
       | suspended, etc, clearly hoping to takeover someone's Meta
       | business account.
       | 
       | Like when Google's Calendar invites were massively used for spam,
       | I just don't understand how that company rolls out services and
       | doesn't foresee the malusage.
        
       | throwaway48476 wrote:
       | Like with the recent homebrew attack Google Google has shown
       | itself to be a malware services company.
        
       | gsuuon wrote:
       | I'm confused, is he saying that the other voice on the call is
       | google assistant voice ai? Or the assistant just routed the call
       | through the google number?
        
       | jostmey wrote:
       | Someone tried something very similar on me last month to steal my
       | google account. Honestly, I almost fell for it. The giveaway was
       | how desperate the caller was for me to complete the last step
        
       | idlephysicist wrote:
       | Anyone that get's a telephone call from "Google" should be
       | immediately suspicious. I used to work for a company that paid
       | GCP about as much as my annual salary _every_ month, and we still
       | struggled to get GCP on the phone when we needed assistance.
        
         | ravetcofx wrote:
         | what's wild is when Google Play Music came to Canada where you
         | could upload your music to the cloud, I was able to get phone
         | support for a bug it had with Linux, and they were very helpful
        
       | vednig wrote:
       | This is becoming a growing cause of cyberattacks recently, the
       | domain expiry being used by malicious entities to gain access to
       | systems
        
       | ebilgenius wrote:
       | You can tell it's a scam call immediately because Google has no
       | such thing as "support", let alone an actual "support engineer"
        
         | braiamp wrote:
         | But you don't know that. Nor I would expect most people to know
         | the internal structure of Google.
        
           | grumple wrote:
           | I can't get ahold of google support while paying them
           | hundreds of thousands per year. I'm not convinced they do
           | support.
        
       | berkes wrote:
       | I have been using a catchall mailbox with hostname type names for
       | over a decade now1
       | 
       | So, com.example.shop@example.org for https://shop.example.com
       | account(s). I've recently switched to a randomized username part,
       | as bitwarden supports this well.
       | 
       | This has saved me numerous times from scams2. Because scammers
       | would email me on the wrong address. Either they'd mail me on an
       | adress listed on my website, when the actual company would've
       | mailed on the unique address I gave them (more targeted
       | phishing). Or they'll mail me on an address that I know to be
       | leaked (these are redirected to spam in filters).
       | 
       | I am convinced there's an actual solution to a lot of scamming
       | here, if the UX and UI are carefully designed. To be used by
       | "muggles", not just the crowd that knows things like filters and
       | catch-alls and plus-appended etc. It's a pity Google, Microsoft
       | or even proton aren't actively promoting such a "unique mail for
       | every service". But I guess there's little in it for them.
       | 
       | 1 used to self host, but now that's near impossible with the
       | monopolies on mailserves at big tech and moved to mailbox.org.
       | big shoutout!
       | 
       | 2 aside from the other great benefit. I'm often one of the first
       | to know some service or site was compromised by receiving scam,
       | spam etc. A few times I was even the one to report a breach to
       | such an org via this.
        
         | noname120 wrote:
         | Apple has that with their Hide My Email service (included in
         | the iCloud+ subscription at $0.99/month). It nudges you to
         | create a new alias on every form that contains an email field.
         | 
         | The good part is the that aliases are inconspicuous @icloud.com
         | email addresses that don't follow a specific pattern and are
         | thus:
         | 
         | 1) Accepted everywhere (contrary to custom domains -- which I
         | also have).
         | 
         | 2) Are pretty much impossible to detect ahead of time.
         | 
         | --------
         | 
         | For illustrative purposes I just clicked several times on the
         | generate new Hide My Email button and it returned those:
         | pie.tall9x@icloud.com              drivels_eras4x@icloud.com
         | showier.sizzle-7y@icloud.com
         | 
         | I have around 160 aliases so far, I'm not sure what the limit
         | is (if there is one).
        
           | upcoming-sesame wrote:
           | Congrats, you're now married to Apple forever
        
             | tonyedgecombe wrote:
             | I'm resigned to that now, Apple would have to do something
             | particularly egregious to move me away.
        
             | js2 wrote:
             | These are burner addresses, the vast majority of which I
             | don't care about. If I ever wanted to move away, iCloud
             | conveniently can show me each address, when I created it,
             | and for what site. I could then change my address on the
             | few sites I wanted to retain the account on.
             | 
             | I actually have a domain I setup with Fastmail just for
             | burner addresses, but Apple offers enough additional
             | functionality (easier to use, tracks the site I created it
             | for and when) that I keep using Apple's offering.
        
           | tonyedgecombe wrote:
           | EBay refuses these addresses for new accounts.
        
       | beshrkayali wrote:
       | > The thing that's crazy is that if I followed the 2 "best
       | practices" of verifying the phone number + getting them to send
       | an email to you from a legit domain, I would have been
       | compromised.
       | 
       | The best practice I live by is always call them back yourself.
       | Looking up the phone number is not the same.
        
       | croemer wrote:
       | This is the LinkedIn profile the attacker referred to as his:
       | https://www.linkedin.com/in/solomon-aborbie-jr-6b0a32155/
       | (Solomon Aborbie Jr) - the CV seems to check out with this
       | Bowdoin video: https://www.youtube.com/watch?v=0n_vHGLDMtM - so
       | likely real and the attackers did "identity theft".
       | 
       | Starting at 1:58 here: https://cloud-3s03ljpcy-hack-club-
       | bot.vercel.app/0call_recor...
        
         | zachlatta wrote:
         | I think he just found a random engineer from Google on LinkedIn
         | and is pretending to be him.
        
       ___________________________________________________________________
       (page generated 2025-01-25 23:01 UTC)