Reply to thread

Message

<blockquote data-quote="Wrecker4923" data-source="post: 1116491" data-attributes="member: 110877">The original news I saw was from Cybersecurity news, but the content source, by the original author, has more details.[URL unfurl=&quot;true&quot;]https://cybersecuritynews.com/googles-subdomain-g-co-hacked/[/URL]Summary:Zach Latta recounts a phishing attempt targeting his Google account. He received a call from &quot;Chloe,&quot; who claimed to be from Google Workspace, alerting him to unauthorized access from Frankfurt, Germany. To verify her identity, she sent an email from a &quot;<a href="mailto:workspace-noreply@google.com">workspace-noreply@google.com</a>&quot; address, which included a legitimate-looking subdomain, &quot;important.g.co,&quot; with &quot;g.co&quot; being an official Google domain. Throughout the conversation, &quot;Chloe&quot; and her &quot;manager,&quot; &quot;Solomon,&quot; provided plausible explanations and guidance. The attackers aimed to obtain a one-time authorization from Zach, possibly to gain access to his account. The attacker eventually hung up after Zach became suspicious. Later, Zach discovered that the attackers had exploited a vulnerability in Google Workspace&#039;s domain verification, allowing them to send official-looking emails that appeared to come from Google&#039;s official address. This incident underscores the increasing sophistication of phishing attacks and the importance of vigilance, even when interactions seem legitimate.Interesting points:<ol>
<li data-xf-list-type="ol">They spoofed a Google Assistant&#039;s phone number to call Zach</li>
<li data-xf-list-type="ol">They exploited Google Workspace&#039;s “weakness” to get Google to send Zach a password reset notification email from a Google official address.&nbsp; SPF/DKIM/DMARC tests were useless.&nbsp; The email body has a Google official domain &quot;g.co&quot; in it.</li>
<li data-xf-list-type="ol">They sent him an Authorization notification that shows 3 numbers that he could have selected, telling him to push a specific number that they had.&nbsp; Zach didn&#039;t show this screen.</li>
<li data-xf-list-type="ol">They eventually sent him an SMS, that for the first time in the conversation, is “obviously” a scam, i.e., using a domain that isn&#039;t Google&#039;s.</li>
<li data-xf-list-type="ol">They exploited Google&#039;s processes and workflows that are unfamiliar to people</li>
</ol>Ways you could have caught this scam:<ol>
<li data-xf-list-type="ol">Google doesn&#039;t call people on account&#039;s breach (???)</li>
<li data-xf-list-type="ol">10 digit US phone number is commonly spoofed.</li>
<li data-xf-list-type="ol">The sent email subject and body were not relevant to the conversation they were having, even if this may not be obvious in real-time</li>
<li data-xf-list-type="ol">They put personal information into the email address used to send Google&#039;s official email; they couldn&#039;t arbitrarily change the subject line or the email body.</li>
<li data-xf-list-type="ol">Selecting a number to authorize transactions should result from your initiating the transaction; otherwise, you can&#039;t know what it&#039;s for.</li>
<li data-xf-list-type="ol">They didn&#039;t have detailed info on him, except commonly available info including his name, email address, phone number, and having a Google account</li>
</ol>I would love to hear more about how you could have spotted this scam.</blockquote>

[QUOTE="Wrecker4923, post: 1116491, member: 110877"] The original news I saw was from Cybersecurity news, but the content source, by the original author, has more details. [URL unfurl="true"]https://cybersecuritynews.com/googles-subdomain-g-co-hacked/[/URL] [SIZE=5][B]Summary:[/B][/SIZE] Zach Latta recounts a phishing attempt targeting his Google account. He received a call from "Chloe," who claimed to be from Google Workspace, alerting him to unauthorized access from Frankfurt, Germany. To verify her identity, she sent an email from a "[EMAIL]workspace-noreply@google.com[/EMAIL]" address, which included a legitimate-looking subdomain, "important.g.co," with "g.co" being an official Google domain. Throughout the conversation, "Chloe" and her "manager," "Solomon," provided plausible explanations and guidance. The attackers aimed to obtain a one-time authorization from Zach, possibly to gain access to his account. The attacker eventually hung up after Zach became suspicious. Later, Zach discovered that the attackers had exploited a vulnerability in Google Workspace's domain verification, allowing them to send official-looking emails that appeared to come from Google's official address. This incident underscores the increasing sophistication of phishing attacks and the importance of vigilance, even when interactions seem legitimate. [SIZE=5][B]Interesting points:[/B][/SIZE] [LIST=1] [*]They spoofed a Google Assistant's phone number to call Zach [*]They exploited Google Workspace's “weakness” to get Google to send Zach a password reset notification email from a Google official address. SPF/DKIM/DMARC tests were useless. The email body has a Google official domain "g.co" in it. [*]They sent him an Authorization notification that shows 3 numbers that he could have selected, telling him to push a specific number that they had. Zach didn't show this screen. [*]They eventually sent him an SMS, that for the first time in the conversation, is “obviously” a scam, i.e., using a domain that isn't Google's. [*]They exploited Google's processes and workflows that are unfamiliar to people [/LIST] [B][SIZE=5]Ways you could have caught this scam:[/SIZE][/B] [LIST=1] [*]Google doesn't call people on account's breach (???) [*]10 digit US phone number is commonly spoofed. [*]The sent email subject and body were not relevant to the conversation they were having, even if this may not be obvious in real-time [*]They put personal information into the email address used to send Google's official email; they couldn't arbitrarily change the subject line or the email body. [*]Selecting a number to authorize transactions should result from your initiating the transaction; otherwise, you can't know what it's for. [*]They didn't have detailed info on him, except commonly available info including his name, email address, phone number, and having a Google account [/LIST] I would love to hear more about how you could have spotted this scam. [/QUOTE]

Verification