Don’t Click That Email Link - DTNSB 5002  ## Metadata - Author: [[Daily Tech News Show]] - Full Title: Don’t Click That Email Link - DTNSB 5002 - Category: #podcasts - URL: https://share.snipd.com/episode/4d0a4d5a-9098-4313-99f3-3e958048d7f6 ## Document Notes ## Highlights - **Avoid Clicking Email Links** - Don't click on links in emails unless you are absolutely certain of the sender's trustworthiness. - If you suspect legitimacy, type the website address yourself instead of using the email link. Transcript: Speaker 1 Standard security advice is not to click on links in email unless you're absolutely certain you trust the sender. Some security advisors just say never click on links in emails. And that may sound impractical, but there's an attack over Gmail happening that illustrates why that's good advice. Ethereum name services developer Nick Johnson received an email claiming to be from Google saying his account information had been subpoenaed. And if he wanted to review the documents around the subpoena to click on a link and log in. Now, you may say, OK, well, that would get my Spidey sense up. But the email came from no-reply at accounts.google Like it literally came from that address, not masked, not, not, you know, faked. It legitimately came from no-reply at accounts.google and even passed Google's domain keys, identified email DKIM authentication, and was placed with other security alerts in Gmail. So you know how it groups all of the like emails together in a thread? It did that. The only giveaway was that the link to log in and review your documents went to sites.google which is insidious because it's a Google.com domain name, but that is Google's free website Building platform. Anybody can create a website at sites.google However, when you went to that page, it faithfully imitated a real support portal. It like took all the layouts, all the images, made it look totally legit to try to trick you into logging in with your valid Google credentials, which it would then steal. The new thing here is that it was signed and delivered by Google. So here's how Johnson figured out they did that. First, register a domain name and create a Google account for that email address and make that email address me at whatever that domain name is. Now, it doesn't really matter what that domain name is, but if you're the fisher, you want to make it look like it came from Google. So you might want it to be google-services or something like that. Then they created a Google OAuth app with the name of their entire message. OAuth apps let you access user data from Google services without requiring passwords. It's how apps can put things on your calendar without having to know your password and having full access to your Google account. When they add their me at domain name to the OAuth app, it generates a legitimate security alert email from Google alerting that the email address and all of the text that went into the Name of that email address's account had been added to the OAuth app. So they get an email from Google that looks like it is in fact from Google and has their entire message as the name of the account that was added. Then they forward that to the target. And here's the vulnerability. Google validates the message and the headers, but not the envelope, not the forwarded envelope. So it shows up in your inbox as a valid security alert. And the second part of the vulnerability is because the address is me at Gmail shows it as having been delivered to the target's email box. Oh, it's me. It's you. That's what we do when we send something to ourselves. So it grouped it like that. Johnson submitted this as a bug report. Google closed it with a working as intended reply. However, after a little more attention came to the issue, Google has reopened it and is now working on a fix. A similar phishing email takes advantage of PayPal's gift address function to insert a bunch of text in there. So you get an email saying you've been added as a gift address, but it looks like it's a PayPal request or an invoice or something like that. But the email does actually come from PayPal. PayPal hasn't publicly responded to that one. What you can do to protect yourself is first, anytime you get an urgent message saying something is wrong, especially legally or an invoice or implying there was an account compromise, Be extra careful. Examine it extra close. And second, don't click on a link from any email, but especially that kind of email. If you think it's legitimate and you should respond, go to your bookmark for that page or type in the URL for that address that you know is legitimate. Don't just copy and paste it from the email, but like, oh, this is from my bank. ([Time 0:02:42](https://share.snipd.com/snip/3c410d6a-01eb-4fe6-ac20-35ced746f352)) - **Phishing Using Legit Google Domains** - Phishers exploited Google's legitimate domain and email forwarding to send convincing fake security alerts. - Google validates message headers but not forwarded envelopes, allowing phishing emails to appear authentic. Transcript: Speaker 1 Ethereum name services developer Nick Johnson received an email claiming to be from Google saying his account information had been subpoenaed. And if he wanted to review the documents around the subpoena to click on a link and log in. Now, you may say, OK, well, that would get my Spidey sense up. But the email came from no-reply at accounts.google Like it literally came from that address, not masked, not, not, you know, faked. It legitimately came from no-reply at accounts.google and even passed Google's domain keys, identified email DKIM authentication, and was placed with other security alerts in Gmail. So you know how it groups all of the like emails together in a thread? It did that. The only giveaway was that the link to log in and review your documents went to sites.google which is insidious because it's a Google.com domain name, but that is Google's free website Building platform. Anybody can create a website at sites.google However, when you went to that page, it faithfully imitated a real support portal. It like took all the layouts, all the images, made it look totally legit to try to trick you into logging in with your valid Google credentials, which it would then steal. The new thing here is that it was signed and delivered by Google. So here's how Johnson figured out they did that. First, register a domain name and create a Google account for that email address and make that email address me at whatever that domain name is. Now, it doesn't really matter what that domain name is, but if you're the fisher, you want to make it look like it came from Google. So you might want it to be google-services or something like that. Then they created a Google OAuth app with the name of their entire message. OAuth apps let you access user data from Google services without requiring passwords. It's how apps can put things on your calendar without having to know your password and having full access to your Google account. When they add their me at domain name to the OAuth app, it generates a legitimate security alert email from Google alerting that the email address and all of the text that went into the Name of that email address's account had been added to the OAuth app. So they get an email from Google that looks like it is in fact from Google and has their entire message as the name of the account that was added. Then they forward that to the target. And here's the vulnerability. Google validates the message and the headers, but not the envelope, not the forwarded envelope. So it shows up in your inbox as a valid security alert. And the second part of the vulnerability is because the address is me at Gmail shows it as having been delivered to the target's email box. Oh, it's me. It's you. That's what we do when we send something to ourselves. So it grouped it like that. Johnson submitted this as a bug report. Google closed it with a working as intended reply. However, after a little more attention came to the issue, Google has reopened it and is now working on a fix. ([Time 0:03:02](https://share.snipd.com/snip/50db9780-4b4e-4dd8-9a0a-4c1cf7c1f38c)) - **Robot Half Marathon Struggles** - A Beijing half marathon included 21 robots, but most failed with some collapsing or breaking apart. - Only four robots finished within four hours, taking twice as long as the human winner. Transcript: Speaker 3 Half marathon that included robots was held in Beijing this weekend. Most of the robots did not do well. Four of the 21 robots finished with the 13 miles within the four hour time limit. Video shows one collapsing at the starting line, one breaking into pieces, and one had the head fall off. Ex-humanoids 5'10 Tianjong Ultra was the top robot, finishing in two hours and 40 minutes, doubling the time of the winning human. Speaker 1 Okay, so no robot came in first, but at least four of them finished. Yeah, this is a fun video. I don't know if you saw that. ([Time 0:19:55](https://share.snipd.com/snip/f2582a6c-77cb-41b4-a4f3-e5991e6dab1a)) - **AI Unlocks Animal Language Patterns** - Using machine learning to decode dolphin communication is smart because language is fundamentally pattern recognition. - Decades of dolphin communication data can be quickly analyzed for dialects and vocabularies with AI. Transcript: Speaker 2 Yeah, well, listen, out of all the strange ways AI or machine learning is being used right now, I think this is actually a really smart one. Because if you think about how language is developed, it's all pattern recognition. That's how we learn language. And that's how animals learn language. Animals syntax based on where they live that they have to learn if you move them for one zoo to another, for example, right? And so it is all very similar. And so if machine learning is recognizing patterns, it's perfect. It's a great way to process just, they have what decades of data on dolphin communication in a lab and in the wild. And so this is a great way to comb through all of that, find patterns, clump things together, see if you can find a vocabulary or a dialect or any sorts of things in a much quicker way than We have done it in the past. ([Time 0:24:16](https://share.snipd.com/snip/82e2be67-f014-4b61-8d97-5a7b36b63dc7)) - **LLMs Learn Complex Languages Efficiently** - Large language models can learn complex communications without knowing the language upfront. - Narrow, focused datasets like dolphin sounds improve accuracy over vast generalized data. Transcript: Speaker 2 Yeah. I think the other piece of this that I think can kind of melt your brain a little bit, if you think too much about it, kind of similar to when you think about, oh, how I see red, is that how you See red? Is that how, right? So does animal language work the same way that our language works? And what I mean by that is not just syntax, not just, you know, is there a noun and a verb? Does it work the same way fundamentally? Because again, they're using these different types of communications that are crazy different. All we really know from animal research so far is that they use names. Lots of animals use names for each other, that they're dialects. So it depends geographically where you're from. You could use different sounds for different things, depending on what pod or community you grew up in, and that a lot of animals can understand commands from humans if you train them, Right? But beyond that, the way that we communicate with sentence structures, with subject matter, with call and response in detail, we really don't know how language functions in other Animal communities. So it's possible this could work really well. It's possible it could completely break and not be functioning because they're going to echolocate and then make a click and then make a screech. And that doesn't mean the same thing in this context as it does in this context, because they're also using body language. They're using situational cues. They're using waving. They're using all sorts of different things that the model's not going to be watching. Speaker 1 Or what occurred to me while you were saying that is you can make the model take into account all of that. And the model would be able to understand it, but not tell you what it means, right? ([Time 0:30:37](https://share.snipd.com/snip/d6450e5a-de2a-41c7-9cbb-e76b3d454d83)) - **Animal Language May Differ Fundamentally** - Animal communication might not structurally resemble human language despite using names and dialects. - Dolphins combine echolocation, clicks, body language, and situational cues that models might not fully interpret. Transcript: Speaker 2 And what I mean by that is not just syntax, not just, you know, is there a noun and a verb? Does it work the same way fundamentally? Because again, they're using these different types of communications that are crazy different. All we really know from animal research so far is that they use names. Lots of animals use names for each other, that they're dialects. So it depends geographically where you're from. You could use different sounds for different things, depending on what pod or community you grew up in, and that a lot of animals can understand commands from humans if you train them, Right? But beyond that, the way that we communicate with sentence structures, with subject matter, with call and response in detail, we really don't know how language functions in other Animal communities. So it's possible this could work really well. It's possible it could completely break and not be functioning because they're going to echolocate and then make a click and then make a screech. And that doesn't mean the same thing in this context as it does in this context, because they're also using body language. They're using situational cues. They're using waving. ([Time 0:30:56](https://share.snipd.com/snip/53459ae0-9902-45cc-a4e9-34e7661f057c))