Hacker News Reader

The cellphone provider was sprint. My friend is a paid customer of Google Apps. In part of the process he called called Google Apps, and they immediately disabled his Apps account but -- but they couldn't or wouldn't do anything else including helping him escalate to the right people -- They said they did not know who to contact. Eventually after he called back several times, he got a manager/supervisor who was able to create a ticket. He called back the next day and the ticket was deleted!

Meanwhile the scammer is making threats to his family and pretending to be him send out emergency BTC loan requests and resetting bank passwords. He could be SWAT'd at any moment.

Apparently Google executives are in the mindset that it isn't cost effective for them to provide even the most minimalist crisis support -- a trivial 5 minute look at the account and seeing the ransom artist texting him (through his own gmail) would at least justify an account hold. Google couldn't be bothered-- even at a record 66 billion dollar profit to help him. Why? Because they can't make a profit helping him. Or maybe its that and they are still in the 2003 "beta" mindset. It truly is a real life THX 1138 nightmare for him.

He is a paying customer... wow unbelievable.

Why can the police/FBI help in this case, given all the threads and demands? Were they contacted and informed of the situation?

Yes he has a FBI complaint id and met with them. Basically the FBI said there is nothing they can do. I'm going to get him to contact the journalist for this article and see if there is another FBI agent he can work with. Sprint wouldn't work with him at all and only after dozens of calls did they start to help him get his number back. (The entire number was in the process of being ported). We didn't even think about him being SWAT'd until I read this article. The threats were specifically towards his parents. If anybody has any suggestions please let me know.

> My friend is a paid customer of Google Apps. In part of the process he called called Google Apps, and they immediately disabled his Apps account but -- but they couldn't or wouldn't do anything else including helping him escalate to the right people

I would be calling sales and support until I got someone who could do something. I would call any number related to Google - including for services not even related to gmail.

> Meanwhile the scammer is making threats to his family and pretending to be him send out emergency BTC loan requests and resetting bank passwords.

But if his account is disabled how is the scammer sending out emails?

> He could be SWAT'd at any moment.

That is very unlikely and if it did it would have to churn through the legal system first.

> a trivial 5 minute look at the account and seeing the ransom artist texting him

That is a sticky situation - many would argue that Google shouldn't read another user's email. And that's probably why support is an issue.

the ransom artist is in full control of the account and sending out emails and text (through google voice) as him. His account is not disabled. The google Apps access account is not the same as his Gmail account, that is where you might be confused. The apps access is disabled. He is an active member of the bitcoin community just like the two bitcoin members mentioned in the article, where one of them got swatted, for about the same ransom amount. It could be related. Obviously he was targeted to some extent because the attacker knew he had BTC. Google Gmail end user license agreement specifically allows google to read your emails. My point is they could do a better job, they just don't care. You can't trust them, they don't have any financial incentive to treat you as a real human person. Right now Google ads is happily serving ads to right of my friend's gmail account while ransom artist is using the account, and google is making money off those clicks -- that's all they care about. Ultimately, there is no human dimension in their company vision.

> It's a free service - what do you expect?

No reasonable person expects support for free, but relying heavily on a free service would be a lot less scary if there was an option to get customer support for $100, refundable if they can't solve your problem. At the moment there doesn't seem to be a middle ground between 'behave like a company and open a commercial account before you know there's going to be a problem' and 'if a problem does arise there's nothing you can do for any price'.

Iirc you are able to get priority support for resetting a Google password if you pay.

That would certainly be good news! I don't suppose you remember any references to how?

I can't find it now, but I seem to remember seeing some option to pay for priority in the account recovery options when resetting one of my accounts in the past.You could always try it on one of your accounts and see.

> I can't stress this enough but please enable OTP on your accounts. Facebook, gmail, and even your Windows system if you are paranoid enough. Yeah it adds some hassle - but the value of increased security far outweighs the hassle. Also backup the OTP codes somewhere.

It seems like the specific attack vector in this case was linking the gmail account with a cell phone number. Surely the most secure option is simply a very strong password with no TFA, OTP or any other auxilliary recovery options?

> It seems like the specific attack vector in this case was linking the gmail account with a cell phone number.

The whole story seems kind of farfetched really. If the attacker did get forwarding to work - it would only forward calls not text messages (which gmail would send a recovery code via text message). According to the story it was in the process of being ported which MAY send texts to the new number - but on most accounts that I've read with dealing with porting that takes at least 24 hours for them to start receiving text messages on the new provider. To my knowledge no carrier has implemented text message forwarding. Also it seemed my posts were downvoted right around the time of his responses.

There are certain holes in this story - first it was a gmail account, then it turned into a gmail + google apps account which are 2 completely different things.

Regardless - enable OTP period.

> Surely the most secure option is simply a very strong password

Arguably using a different strong (12+ characters) password for every site and service is a good approach - but then you should probably be generating those passwords and storing them into a password manager. Then that password manager becomes a target[1]. Using OTP is just a good layer of security.

[1] http://arstechnica.com/security/2015/06/hack-of-cloud-based-...

Most services which use phone numbers for authentication helpfully offer to call you and read out the code using text-to-speech if they can't text you, including Google accounts. This is often exploited by attackers.

The non-existent support problem exists also with other Google products, even when you pay. For example, I used to use Google Nearline. I pay the storage fees etc., but I cannot even contact some basic support without buying a support package which cost quite a lot. So for now I deleted all my data there.

Is OTP one-time-password?

Yes, typically synonymous with two-factor authentication.

Google apps lets you generate a series of one-time use codes, which you can print out and keep in a safe/folder/notebook, so that if your 2-factor-auth device (phone, fob, etc) gets nuked, you can still log in.

I find it interesting that he could log in without 2-factor auth. Those things I thought were keyed to phone hardware.

Many 2fa implementations offer SMS (which would be compromised given a social engineering cell redirect) as an alternative to TOTP. (What's commonly referred to as "Google Authenticator" - it's time-based, so if you capture the initial image or code, you can actually set it up on multiple devices, so it's not exactly device-based)

This is a reason to not verify over SMS and to instead use the Google Authenticator app. It seems easier to socially engineer a SMS redirect than to obtain the mobile device and bypass its login authentication.

If you are going to verify over SMS, don't have your SMS messages forwarded to email as that would render your 2fa pointless.