Hello, welcome to the Thursday, May 4th, 2017 edition of the Sansonet Stormsendos Stormcast. My name is Johannes Ulrich.

And today I'm recording from Jacksonville, Florida. If you have an email account, then you very likely saw an interesting Google Docs fish earlier today.

Now, these emails typically arrived from valid Gmail accounts,

not necessarily someone you knew. And what really sort of gave them away as malicious or odd

was the two field in email, which wasn't your name. Instead instead it was an email address that looked suspicious

it had a lot of ages and followed by melnator.com at least the samples that I have seen. Now the

tricky part about this fishing attempt was that you typically never get asked for your password. What this fish is after

is O-O-O-O-O-R credentials. Now, O-O-Oth is an interesting authentication scheme that you see used a lot by social

media, by Google, and it allows you to assign certain privileges to applications.

So the way Oath works, you could assign privileges to an application that, for example,

needs access to your Google documents. So the application requests as access from you, you authenticate to Google and then

basically tell Google that it's okay to let this particular application access your Google

documents.

You probably have done that before, Facebook, Twitter, all of these social media sites also

heavily rely on OOF.

The good part about OOath is that this third-party application never actually needs to know your username and password.

Instead, during that handshake where you approve the application, this application is being provided a very application-specific password that works only with this application

and only allows access to specific items that you allowed access to.

So in this particular case, the fishing attempt did just that.

It asked you for access. Now, it did in particular ask access not to Google documents, but instead to read, send, delete and manage your email. In addition, it also asked for access to manage your contacts. This may have given it away that this was not just a normal document

that someone wanted to share with you, but if you clicked on allow, then Google issued an application

specific password, an Oath token to this malicious application. It made it more likely for people to fall for it by calling

...