Phishing Sites Hosted on Google's Servers

f-secure.com

23 points·nowsourcing··8 comments

At the very bottom of the post:

"We got contacted by a Google employee. They informed us that, surprisingly, the questionable page is indeed the official Google form to request Google Voice account transfer. They also told us to remove all references to the form in this blog post. But I'm afraid we can't do that."

That actually is more troublesome as it is now impossible to distinguish between a legitimate form and a phished one.

yep. Don't know what they're thinking over there.

They'll probably start putting up a disclaimer when its not actually google's doc

I'd like to know how they verified it was a Google employee, and not a brazen phisher.

I've used the Google Voice form they used in their example long ago. It was legitimate and worked just fine.

But I'm not surprised to see some people would use forms on Google Spreadsheets for phishing attacks. Seems ideal.

I have been refraining from doing so as I cannot shake the suspicion that it might be a phishing attack. It doesn't help that most links to it seem to be from Google Groups and other discussion type sites, sometimes posted by people claiming to be Google employees, sometimes not.

Even if it is genuine, it's a bad idea. Someone could make an exact clone of that site, on the same server (simply make a similar Google Spreadsheet) and go fishin'. Only the hash id at the end of the URL would be different.

Reply on news.ycombinator.com