Someone Mailed Me an Amazing Phishing Page of Google Login
9 comments
Unfortunately, some idiotic companies actually do use non-standard domain names.
For example, my Citi credit card uses "accountonline.com" as the login page. With things like that, "googledrive.com" seems less suspicious.
So to anyone building for the web: please use a single, canonical domain name!
For example, my Citi credit card uses "accountonline.com" as the login page. With things like that, "googledrive.com" seems less suspicious.
So to anyone building for the web: please use a single, canonical domain name!
https://googledrive.com is Google! It's hosted with Google drive (like dropbox can do). So this is one case where it would pay not to use the same domain, actually.
Edit: Also important because that way password autofill won't automatically fill in your details.
Edit: Also important because that way password autofill won't automatically fill in your details.
That's a major security flaw.
On the plus side, looks like your report worked. As of a few minutes after you posted, the link says it's a phishing scam.
On the plus side, looks like your report worked. As of a few minutes after you posted, the link says it's a phishing scam.
Actually that's a feature, now anyone can host a simple webpage without any hassle the fact that this dude figured out a way around it is kinda cool but I'd rather they not remove this bec of phishing attacks.
On the other hand I can see how THIS specific attack is very dangerous: people might assume that they need to login to google to see the content hosted by google....
On the other hand I can see how THIS specific attack is very dangerous: people might assume that they need to login to google to see the content hosted by google....
I very nearly entered my creds just by instinct it looks truly legit, just so you know now chrome stops you from going there (you need to admit to being an idiot before you can move forward)
Re: 2-factor auth:
Couldn't the app try to login, detect the 2-factor, and ask you for that in the response?
Couldn't the app try to login, detect the 2-factor, and ask you for that in the response?
Yes it could.
However it would only have 60 seconds (30 + 30 sec) to forward that to Google along with your credentials. It cannot be done via the user's browser due to forgery protection on Google's end, so a third party piece of software would have to grab the credentials including 2f code and log in using a "browser" (e.g. WebKit engine).
One challenging problem is for the site to know if it should prompt you for the 2f code. It won't know until it tries to login, and it won't be able to try and login until it forwards your credentials to a third party piece of software and then gets a reply back. Even assuming this is done very fast, it could still take a few seconds, in particular if Google starts to throttle their client's IP.
It would likely be easier just to target low hanging fruit (i.e. non-2F people) unless this is a targeted attack.
However it would only have 60 seconds (30 + 30 sec) to forward that to Google along with your credentials. It cannot be done via the user's browser due to forgery protection on Google's end, so a third party piece of software would have to grab the credentials including 2f code and log in using a "browser" (e.g. WebKit engine).
One challenging problem is for the site to know if it should prompt you for the 2f code. It won't know until it tries to login, and it won't be able to try and login until it forwards your credentials to a third party piece of software and then gets a reply back. Even assuming this is done very fast, it could still take a few seconds, in particular if Google starts to throttle their client's IP.
It would likely be easier just to target low hanging fruit (i.e. non-2F people) unless this is a targeted attack.
I don't know whether this will be possible or not. Would love to know that.
Holy Shit. It looks damm original
Goodness I'd have even gotten busted by that. That's quite clever.
I would love to know the technical details behind the creation of this page.
It's just a webpage hosted on Google Drive:
https://support.google.com/drive/answer/2881970?hl=en
Regarding the contents of the page itself:
first layer of obfuscation document.write's a script tag to include "aa.js" which document.write's the main phishing page itself, which sends contents directly to a hacked WordPress site ( cairngormsagainstpylons dot org ).
Reported via Google Drive abuse as a phishing page.
https://support.google.com/drive/answer/2881970?hl=en
Regarding the contents of the page itself:
first layer of obfuscation document.write's a script tag to include "aa.js" which document.write's the main phishing page itself, which sends contents directly to a hacked WordPress site ( cairngormsagainstpylons dot org ).
Reported via Google Drive abuse as a phishing page.
wow this is ridiculous
DON'T ENTER YOUR CREDENTIALS ON THE ABOVE PAGE. It is SPAM page which I got from one of my friend.
The above link is a great example how even informed people can get into phishing traps. It has HTTPS looks exactly like Google Login.
This supports my theory that everyone should enable 2 factor authentication.
EDIT - Checkout its source, the whole page is generated using JS ( I am not sure of this claim)
EDIT2 - I have reported it to Google as a phishing page. I am adding a screenshot for future if google takes down it somehow. Link - http://imgur.com/sTY1uRP
EDIT3 - It will send spam to all the emails in your contact book using your gmail id. Tried it with a dummy account.