Oxford blocks Google Docs as a phishing countermeasure

Google services are nearly ubiquitous these days. Although the most oft-repeated concern is that this ubiquity compromises user privacy, recent action by Oxford University illustrates that there are other risks accompanying the search giant's omnipresence, such as security. Robin Stevens, from the University's IT department, posted a blog entry about the action on February 18, explaining that IT "recently felt it necessary to take, temporarily, extreme action for the majority of University users: we blocked Google Docs." University officials enforced the block for only two and a half hours, not to combat the security threat itself, but to get the attention of its own users.

Go phish

The issue at hand is phishing attacks delivered via Google Docs's web forms. Phishing itself is not a new problem, Stevens noted, but historically phishing attacks would be delivered as email messages asking the recipient to reply and include account information (such as the password). The replying accounts would then be taken over and used as a platform from which to send out thousands of spam emails through the university's email servers. As a large, established university, Oxford's servers are implicitly trusted by many other email providers and ISPs, which raises the chance of the outgoing spam flood sneaking past filters. This type of email-based phishing attack would generally masquerade as an urgent request from some on-campus office (such as IT itself), warning the user of a policy violation, a full mailbox, or some other issue requiring rapid attention.

These days, however, direct-reply phishing is on the decline, and the more common approach is to trick users into visiting a legitimate-looking web form. Like the phishing email, this form masquerades as official communication, perhaps asking the user to log in (with his or her real password) to take care of some urgent account problem. The trouble is that Google Docs offers a free web form creation service—and it delivers it over SSL, thus making it harder for the university's anti-malware defenses to detect. Stevens reported that recent weeks had seen a "marked increase" in such phishing activity, and that although the majority of the university's users spotted the scams, a small proportion did not.

With even a small fraction of the tens of thousands of university email users falling for the phishing forms, a sizable number of accounts were compromised—and, presumably, could be used to mount spam floods at any time. That put the university at additional risk, Stevens said, because in the past there have been incidents where major email providers began rejecting Oxford email due to large-scale spam. The recent surge in Google Docs form-phishing attacks happened over a short period of time, but thanks to the potential for a site-wide rejection by other ISPs, it risked causing a major disruption to email service for university users.

Response

The straightforward response to phishing attacks delivered via Google Docs would seem to be reporting the incident to Google, but Stevens said that this approach proved futile. IT could report each phishing web form to Google's security team, but:

Instead, the university decided to pull the plug on Google Docs from the university network, in the hopes that the outage would awaken users to the risk. "A temporary block would get users' attention and, we hoped, serve to moderate the 'chain reaction'."

Evidently the block did get users' attention—but IT failed to take into account how tightly Google Docs has become integrated with other Google services in recent years. The disruption to legitimate users was "greater than anticipated," causing Stevens's office to issue an apology and a detailed explanation of the problem.

On the other hand, Stevens did report that the temporary block accomplished its goal of short-circuiting the phishing attack. In the future, he said, the university would both search for a less disruptive way to circumvent Google Docs phishing attacks, and pressure Google to be "far more responsive, if not proactive, regarding abuse of their services for criminal activities." Google's slow reaction to reports of criminal activity has severe consequences for the university, he said.

The 800 pound gorilla

So far, Google has not issued a public response to the Oxford incident. But one does not need to be a major university to find lessons in the story. First, the existence of web forms in Google Docs provides a nearly worldwide-accessible platform for mounting phishing attacks. Google's ubiquity has turned it into a de-facto "generic service" which many users may be oblivious to. In fact, Google Docs is widespread enough that many universities do use it to send out general polls, surveys, and other form-based questionnaires. Yes, the IT department is far less likely to employ a Google Docs form than is (for example) Human Resources, but that is the sort of detail it is all too easily missed by some small proportion of users on any particular email.

Second, Google's multi-day turnaround time for taking action against reported criminal activity is a problem in its own right. But while accurate reports of such criminal activity need to be acted on as soon as possible, the reality is that swift action raises the risk of false positives, too. Here again, Google services are so widespread now that it would be a challenge to police them all in real time. If, as Stevens suggested, Google were to automate any part of the form shutdown process, one nasty side effect would be that the automated process might turn into a vehicle for widespread denial of service instead.

Third, some will say that the sort of large-scale phishing attack seen at Oxford demonstrates that passwords alone are no longer sufficient for account security. But the university's tens of thousands of users present a daunting set of accounts to manage; supplying that many users with cryptographic security tokens or supporting that many users in a multi-factor authentication scheme would constitute a substantially higher cost than it would for most businesses—more so when one considers that the student population turns over regularly.

Of course, Oxford's experience is only one data point. In the Hacker News discussion of the event, commenter Jose Nazario pointed to a 2011 IEEE paper (and provided a PDF link for those without IEEE library access) he co-authored that examined the prevalence of form-based phishing attacks. Google Docs was the second-most popular host for form phishing attacks, and phishing forms based there lasted, on average, more than six days. The most widely-used service for form-based phishing attacks was addaform.com, and there were several others with numbers somewhat close to those of Google Docs.

The prospect of intercepting all form-based phishing is a daunting one, to be sure. But regardless of the precise rankings, eliminating the threat from Google Docs is likely to be far more difficult since, like Big Brother, Google services are everywhere.