0

I'm looking for information on scams that target GMail users. I believe I found an article that discusses the attack in the context of bank fraud at Warning over text message scam that allowed 'smishing' fraudsters to steal £70,000 from pregnant woman's bank account.

The attack I have seen appears to be very similar. A phone number is spoofed and a text message arrives that appears authentic. The message even shows on a thread of the real person. But instead of stealing money, access to a GMail account is gained.

The user has an Android phone and it is fully patched. It is still under contract so I don't believe it has been abandonware'd. She also has Gmail on with two factor authentication enabled. She was [presumably] logged in, and I believe Gmail uses auth tokens/cookies that never expire.

Later, a relative of the woman received an email message trying to entice the new victim. The thing that struck me was, the attack originated in SMS then switched to email for the new victim.

This is where I need information. How does clicking on a link in a text message yield access to a GMail account? Is this simply stealing an authentication cookie through XSS and policy violations? Or is this just an instance of a confused deputy, where the email program sent an email message on behalf of the sms program? Or is there something else going on like an active vulnerability?

  • Where did you see the attack or anything about it? – user169799 Feb 1 '18 at 22:01
  • @safebookverified - My mother. My mother got a text from my Aunt. My mther followed the link in the text but did not enter credentials. She stated she was not aksed to log into anything. A day later my cousin said she received a suspicious email from my mother. My mother showed me the text message she received and it definitely looked authentic, meaning it appeared to originate from my Aunt or a shmishing spoof. – jww Feb 1 '18 at 22:18
  • Ok, but what is in the message? Is it only text? Try to hold press on it and view the details to see whether the byte-count matches in case there is something hidden. – user169799 Feb 1 '18 at 22:19
  • Oh you said that there is a link in the text message. Is it a link to a fake login page? Or what does the link go to? – user169799 Feb 1 '18 at 22:20
  • 1
    wired.com/2017/05/… – user169799 Feb 1 '18 at 22:26
1

There's not really an answer to this question, because all we can do is speculate, but I'd hazard a guess that the link they clicked on coerced them into accepting an application to have access to their Google account with full privileges. You can go to https://myaccount.google.com/security and look at the section called "Apps with account access" to check for this.

The other option is that the link presented her with a fake login page and she provided credentials - plain old phishing.

  • Thanks Polynomial. I confirmed she did not enter credentials, so I think I can rule that out. Let me check that area of Gmail security. I was already in there looking for logins, but I did not check for app access. – jww Feb 1 '18 at 18:09
  • @jww You "confirmed" it but you linked a completely unrelated article that does not support your claim. It seems more likely that you are mis-remembering something, or were given incorrect facts by someone. Until you can provide more information I have to agree with, and I'd say the "fake login page" option is probably more likely. – user169799 Feb 1 '18 at 22:04
  • @safebookverified I thought the same with the originally linked article, but jww explicitly says "the attack I have seen appears to be very similar", i.e. it starts the same way but goes a different direction. – Polynomial Feb 1 '18 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.