A phishing attack involving g.co, Google's URL shortener

So so true. 1Password refusing to auto fill a password has saved me multiple times in the past! Also, one of my friends has a PhD in literally rocket science (aeronautical engineering from MIT) and got scammed by someone who stole his brother's SIM card and did some shenanigans. No one is safe, no matter how smart or tech savvy you think you are! For the less tech savvy folks, I understand why they are scared, it's hard to give them even general tips to not lose the farm to fraudsters.

I nearly lost an account because I assumed that 1Password was just being dumb not offering to auto-fill credentials. Turns out I'm the dumb one for doubting it.

Now if 1Password shows nothing to auto-fill I make damn sure I'm on the right site.

> the only reason I noticed was because 1Password didn't offer to fill in my credentials.

Nice, I always hope this will save me but I never landed on such a phishing site. How did it happen for you?

About domain-based autofills, perhaps less so now than 5-10 years ago: it always seemed weird that the whole security industry seemed to say these plugins, or the browser's built-in password store, are dangerous because there were past vulnerabilities and any website you visit can exploit it. The way I see it: vulns get fixed, I just need to not be in the 1st wave of persons they target (risk type: plane crash, very small odds but sucks to be you); receiving phishing emails or messages happens constantly and apparently it works well enough to continue doing it and evading filters constantly (risk type: car crash, can happen and they get only the creds for the website being autofilled). Would recommend to anyone who then realises something is up when the autofill doesn't work, but ideally would have more evidence to back that up

> that even the smartest of us Hacker News users

Well, ok then.

> 1Password didn't offer to fill in my credentials. > the point is that even the smartest of us Hacker News users can fall for it.

But you didn't fall for it, a simple password manager technique worked as advertised?

One of the worst parts of using a oassword manager is that apps and websites don’t by default share their credentials. I could totally see me getting caught by a shady link to a website of an app that I use but because I’ve never logged into the website, 1Password makes me search for it.

My friend was not smart as you, and religiously typed password on a fake Amazon website link clicked from an SMS promising a refund on recent purchase. Stopped only when it asked for 2FA code because there was no 2FA setup.

https://www.merklemap.com/search?query=coinbase.com&page=0&t...

There’s indeed a lot of them :)

But you don't know that. Nor I would expect most people to know the internal structure of Google.

Not if you’re an app developer on their platform, they make outbound calls to you. I’m sure there are other situations as well.

> The caller's accent (wtf)

You don't have to pretend to be confused.

The industry of Indian scam call centers is not a crazy conspiracy invented by racists.

I do this for any inbound call, unless the caller id is someone in my contacts it can go to voicemail. If it's important they either leave a voicemail or keep trying, for repeated calls I will answer but with skepticism.

If they are in my contacts I will recognise their voice.

I regularly get phone calls from Google because I helped a friend with their ad account once. No matter how many times I tell them not to call they eventually find a new number to call me from. They are legit calls. Google just won't take no for an answer.

Based on the text at the bottom of the gist:

> Hack Clubbers have determined that this is almost definitely a bug in Google Workspace where you can create a new Workspace with any g.co subdomain and get it to send some emails without verifying that you own the domain.

Seems like this is the flow:

1. Create a Google Workspace with a g.co subdomain. Apparently this is not verified, or verifying the domain is not necessary for the next steps.

2. Create an account for the victim under this Google Workspace.

3. Reset that account's password.

The victim gets an email from Google Workspace informing them that their password was reset. And this email is a real, legitimate (not spoofed) email from Google because it's just a result of the normal password reset process for a Google Workspace account.

We have all this verification on the Web, but not the phone. Why do telcos allow for spoofing? We wouldn't allow that with email. Is this a technical limitation that allows for spoofing?

Yep. Look at the screenshot. It seems they managed to trigger one of Google's standard password reset emails.

Agreed. I do not follow any links, accept calls, etc. I go to the site of origin and do what I need. Also be careful if you search for the sites name on Google, still might click a fraud site!

I don't even know where the idea that those are the best practices came from.

The phone number best practice has always been constructed as "call them back at a known good number, preferably one written on paper or on your card". You certainly don't ask them to show you where on the company website the phone number is listed.

And asking the person on the phone with you to send you an email from a specific domain is likewise not something I've ever seen recommended: that's one of several things you check to see if an email is phishing (And only one of several! A good domain isn't enough to clear an email!) But if you're already on the phone with someone suspicious, the best practice has always been to get off the phone with them immediately and call a known number, not to ask the caller to prove themselves.

None of this is to blame OP for misunderstanding, it's just very clear that we need to do better at communicating these rules out to the world.

> no incoming phone call can ever be trusted.

They can't. And they haven't been for a while. Spoofing phone calls is simply too easy, and nothing is being done to fix that, despite the fact that it puts so many of us at risk. It's not an insurmountable problem, technologically. It is literally a lack of will and outcry from ordinary people, despite how often this fact is used to abuse so many.

Credit Card companies have known this for a long time. My credit card company will call and say "do not call back to this number, call the number on the back of your card and use this reference number".

That should absolutely be the norm at this point.

I'd argue the second one was not followed either. Maybe I'm misunderstanding the article, but I would not take a random "your password has changed" as proof. I would need the caller to send me an actual email from their personal work email address (or ticket system?) with some actual, human communications in it.

This used to not be safe though, in the age of landlines.

I forget the details, but most of the country was wired in a manner that both parties of a call had to hang up to end the connection.

You might hang up, go find the official phone number, but when you pick the phone off the cradle you would still be in the previous call. They could fake the dial tone and you would be none the wiser.

I remember pranking friends with this back when I was young. Harmless stuff.

> Especially if you call from a hardline,

I have no idea where I'd find one of those.

> This is where a big mistake is. Always, ALWAYS phone or contact back using the company’s official channels.

The problem, and the reason why that scam approach works half the time, is that calling back is a huge PITA these days between 1) endless routing menus or some "smart" AI bot that is f*ing useless (seriously, I have never been helped to my satisfaction by one of those), 2) long long long hold times to get to a human, if you ever do, because every single company is always "expecting greater than usual call volumes" -- wtf? call volume distributions are Gaussian, ok? so adjust accordingly.

Yeah.

In reality the number your phone carrier provides is basically a guess. It does in no way guarantee who is calling you.

Most likely they did something like sign up for "important.g.co" in Workspace, then added the target as a user, then reset that user's password, causing Google to send a real, verified, from-Google message.

They can't control the contents of the message, but they used the gmail "+" feature to cram the "case ID" onto the target email they created the Workspace account for, making that seem real.