Be wary of emails with links to ... er, Google Drive? Is that right?

Re: Scam the scammers ... ?

Because then Google will sue you for attempting to break into their stuff since you'll be flinging all that data at their equipment.

These attacks are leveraging scripting capabilities with the provider so you are duped out of your information without ever touching a suspicious domain. Like the Google Drive attack will point you to a series of phishing pages hosted on a public-facing Google Drive and store the retrieved data into Google Docs. On AWS, the pages are hosted on S3 buckets and data is stored into another.

The point is that the victim never comes in contact with a domain that anti-malware tools wouldn't flag and/or very unlikely to be blocked in an organization. The other side of it is that loading up webpages and having people submit data to a Google Forms document aren't exactly unusually use cases for these services and are going to go unnoticed by Google / Amazon / Etc.

Re: Standard practice

Agreed, never click on an unexpected file or link from any source should be hammered into everyone's head. Social engineering is the most effective way to bypass any security measures.

Re: Standard practice

Unfortunately that wouldn't work for a lot of organizations that are using Google Drive to store information. Just this morning I had to submit a couple inventory reports by filling out a form hosted on the company's Google Docs pages. HR also regularly sends out announcements by sharing a link to Google Docs.

I've worked with a dozen or so organizations like this and I doubt I just got lucky and hit the few orgs that work that way.

And, really, the only way to tell the difference between a legitimate google docs attachment and one from scammers is by looking at the UUID embedded in the link URL and checking to see if it matches the UUID assigned to a legitimate user. Which also assumes that the user hasn't had their UUID changed due to be moved to a different version of the service or some other random action that caused it to change.

Really, the issue here is that instead of the attack purporting to be from hr.internal.company.com but coming from hr.internal.company.com-totally-legit-url.ru. It is now purporting to come from drive.google.com/1234-abcdef0-7894-ac43-12fc390/docs/files/ but really coming from drive.google.com/4567-ffecba12-23e4-23fa-bcce12f/docs/files

Re: Standard practice ....... Screwed if you do, FCUKed if you don't

Following unquestioningly the standard advice of never opening attachments that you weren't expecting surely results in displays of psychosis with the delusional paranoid schizophrenic obsessing over that which they have no knowledge of, but which they fear and are terrified of being in the hands, hearts and minds of others in either the opposition or competition.

And has one always playing second fiddle to subsequent main actions which you missed by taking heed of standard advice.

What it also encourages is the free spontaneous public sharing of extremely sensitive information in a series of zeroday type postings which easily exploit the standard advice vulnerability, for that is what it is become.

Pretty soon, whenever you're looking for and expecting there to be a whole host of smarter folk in the room, they'll be suddenly forced to contact you if they are to remain in any way future relevant.

And ..... being overtaken by events and ending up being popularly viewed as both impotent and unintelligent is also the fate to be suffered by that which and those who fail to make contact whenever they really should.

IT really is an AI Mined Mind Field out there in which one cannot Lose, Win or Win Win without Playing and Taking Part in a Role..... with an Almighty Few Leading All Others Following?

Re: Public shares

We block 'em but I'm forced to open them up for many users. We don't have a facility to receive large files and no one will pay for one. As long as I'm forced to open up Dropbox etc then the problem goes away for them. also this is driven by external parties who want tot use the free file transfer service of their choice and damned if we don't. To get the stuff (much of it we can't ignore) we have to allow access.

Re: Evading traditional content filters

>, invent a computer that can't be compromised by clicking on a link!

Like the special iPads we give management with the two trackwheels that can be only be erased by shaking them?