0

I'm looking for information on scams that target GMail users. I believe I found an article that discusses the attack in the context of bank fraud at Warning over text message scam that allowed 'smishing' fraudsters to steal £70,000 from pregnant woman's bank account.

The attack I have seen appears to be very similar. A phone number is spoofed and a text message arrives that appears authentic. The message even shows on a thread of the real person. But instead of stealing money, access to a GMail account is gained.

The user has an Android phone and it is fully patched. It is still under contract so I don't believe it has been abandonware'd. She also has Gmail on with two factor authentication enabled. She was [presumably] logged in, and I believe Gmail uses auth tokens/cookies that never expire.

Later, a relative of the woman received an email message trying to entice the new victim. The thing that struck me was, the attack originated in SMS then switched to email for the new victim.

This is where I need information. How does clicking on a link in a text message yield access to a GMail account? Is this simply stealing an authentication cookie through XSS and policy violations? Or is this just an instance of a confused deputy, where the email program sent an email message on behalf of the sms program? Or is there something else going on like an active vulnerability?

Improve this question
6
  • Where did you see the attack or anything about it?
    – user169799
    Commented Feb 1, 2018 at 22:01
  • @safebookverified - My mother. My mother got a text from my Aunt. My mther followed the link in the text but did not enter credentials. She stated she was not aksed to log into anything. A day later my cousin said she received a suspicious email from my mother. My mother showed me the text message she received and it definitely looked authentic, meaning it appeared to originate from my Aunt or a shmishing spoof.
    – user29925
    Commented Feb 1, 2018 at 22:18
  • Ok, but what is in the message? Is it only text? Try to hold press on it and view the details to see whether the byte-count matches in case there is something hidden.
    – user169799
    Commented Feb 1, 2018 at 22:19
  • Oh you said that there is a link in the text message. Is it a link to a fake login page? Or what does the link go to?
    – user169799
    Commented Feb 1, 2018 at 22:20
  • 1
    wired.com/2017/05/…
    – user169799
    Commented Feb 1, 2018 at 22:26

1 Answer 1

Reset to default
1

There's not really an answer to this question, because all we can do is speculate, but I'd hazard a guess that the link they clicked on coerced them into accepting an application to have access to their Google account with full privileges. You can go to https://myaccount.google.com/security and look at the section called "Apps with account access" to check for this.

The other option is that the link presented her with a fake login page and she provided credentials - plain old phishing.

Improve this answer
3
  • Thanks Polynomial. I confirmed she did not enter credentials, so I think I can rule that out. Let me check that area of Gmail security. I was already in there looking for logins, but I did not check for app access.
    – user29925
    Commented Feb 1, 2018 at 18:09
  • 1
    @jww You "confirmed" it but you linked a completely unrelated article that does not support your claim. It seems more likely that you are mis-remembering something, or were given incorrect facts by someone. Until you can provide more information I have to agree with, and I'd say the "fake login page" option is probably more likely.
    – user169799
    Commented Feb 1, 2018 at 22:04
  • @safebookverified I thought the same with the originally linked article, but jww explicitly says "the attack I have seen appears to be very similar", i.e. it starts the same way but goes a different direction.
    – Polynomial
    Commented Feb 1, 2018 at 22:41

You must log in to answer this question.