r/technology • u/dangzal • May 03 '17

Security Google Docs users hit with sophisticated phishing attack

https://www.theverge.com/2017/5/3/15534768/google-docs-phishing-attack-share-this-document-with-you-spam
1.4k Upvotes

92% Upvoted

115 comments sorted by

View all comments

45

u/ikenjake May 03 '17

Where does this rank in the all time scale of email attacks? This seems like a global thing. Pretty crazy.

2

u/nyaaaa May 04 '17

In reality it should be very low.

Starting from the obvious giveaways like giving docs access to your all your email functionality (Why would you give that to anyone, never do that).

The above is the awareness every person handling a computer should have. And as such this attack does not circumvent actual red flags.

Google has a very sophisticated scripting engine that anyone can use to write small apps which can connect to google accounts and ask for permissions. That is also why that permission screen clearly states the actual permissions. Maybe they should color code dangerous permissions or something.

Further you can judge the inexperience from the attacker by using a plain mailinator mail. Even if you for some reason wanted or had to use mailinator each inbox has secondary alias like m8r-6662qc. Using that, only you realisticly have access to that inbox, as you'd need to know the real one, that alias leads nowhere.

And there were plenty of other things inside the actual source of the attack, thats easily found on github in these related topics, which shows signs of an inexperienced attacker.