<story><title>The closest I&apos;ve ever come to falling for a Gmail phishing attack</title><url>https://twitter.com/tomscott/status/812265182646927361</url></story><parent_chain><item><author>Jarwain</author><text>My school is actually rolling out optional 2-factor auth. I&amp;#x27;m not a fan of the system they use^, but it&amp;#x27;s neat that a University is taking advantage of some security best practices.&lt;p&gt;^Instead of using &amp;quot;standard&amp;quot; 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used in that order (0 code on first login, 1 code on second, etc.), and the page informs the user which number they&amp;#x27;re on.</text></item><item><author>colinbartlett</author><text>Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.</text></item><item><author>jhardcastle</author><text>Sysadmin at a school: we use GMail for our students and faculty, and we got hit by this hard right before the holiday break.  Three employees and a handful of students all got hit by the attack within a two hour period.  It&amp;#x27;s the most sophisticated attack I&amp;#x27;ve seen.  The attackers log in to your account immediately once they get the credentials, and they use one of your actual attachments, along with one of your actual subject lines, and send it to people in your contact list.&lt;p&gt;For example, they went into one student&amp;#x27;s account, pulled an attachment with an athletic team practice schedule, generated the screenshot, and then paired that with a subject line that was tangentially related, and emailed it to the other members of the athletic team.&lt;p&gt;They were using bit.ly to obscure the address (in Russia).  We had to take our whole mail system down for a few hours while we cleaned it up.</text></item></parent_chain><comment><author>jonoberheide</author><text>Sorry to hear about your experience, Jarwain!&lt;p&gt;Duo offers a choice of authentication methods, depending on the usability and security requirements of your application or organization.&lt;p&gt;Duo Push is actually one of the easiest (and most secure) authentication methods, as one of the commenters pointed out:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=tPLxe9HUDjY&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=tPLxe9HUDjY&lt;/a&gt;&lt;p&gt;It might be worth pinging your IT&amp;#x2F;security dept to ask about enabling Duo Push as an option or to change the policy for SMS passcodes (eg. you can just have one passcode sent instead of ten).&lt;p&gt;- Jon Oberheide, Co-Founder &amp;amp; CTO @ Duo</text></comment>
<story><title>The closest I&apos;ve ever come to falling for a Gmail phishing attack</title><url>https://twitter.com/tomscott/status/812265182646927361</url></story><parent_chain><item><author>Jarwain</author><text>My school is actually rolling out optional 2-factor auth. I&amp;#x27;m not a fan of the system they use^, but it&amp;#x27;s neat that a University is taking advantage of some security best practices.&lt;p&gt;^Instead of using &amp;quot;standard&amp;quot; 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used in that order (0 code on first login, 1 code on second, etc.), and the page informs the user which number they&amp;#x27;re on.</text></item><item><author>colinbartlett</author><text>Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.</text></item><item><author>jhardcastle</author><text>Sysadmin at a school: we use GMail for our students and faculty, and we got hit by this hard right before the holiday break.  Three employees and a handful of students all got hit by the attack within a two hour period.  It&amp;#x27;s the most sophisticated attack I&amp;#x27;ve seen.  The attackers log in to your account immediately once they get the credentials, and they use one of your actual attachments, along with one of your actual subject lines, and send it to people in your contact list.&lt;p&gt;For example, they went into one student&amp;#x27;s account, pulled an attachment with an athletic team practice schedule, generated the screenshot, and then paired that with a subject line that was tangentially related, and emailed it to the other members of the athletic team.&lt;p&gt;They were using bit.ly to obscure the address (in Russia).  We had to take our whole mail system down for a few hours while we cleaned it up.</text></item></parent_chain><comment><author>oxguy3</author><text>Oh my god that&amp;#x27;s awful, what&amp;#x27;s the point of making it so counterintuitive?? I&amp;#x27;ll never understand the motivation of companies that roll their own 2FA instead of just using TOTP or Authy.</text></comment>