<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Good morning!<o:p></o:p></p>
<p class="MsoNormal">A quick recap and update on the Google phishing attack:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is how the Google phishing attack happened yesterday, and what steps you can take to prevent it in the future. This was a widespread attack, not just isolated to Ohio or K12 schools.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">1) Users received an email that a Google Doc had been shared with them. Many users recognized the sender, and the email looked relatively legitimate.<o:p></o:p></p>
<p class="MsoNormal">2) The shared document button took users to a real Google login page (at this point users were still safe).<o:p></o:p></p>
<p class="MsoNormal">3) Once logged in, this is where the attack happened. Users were asked to allow "Google Docs" permission to access their Google account. So, a malicious person created an application that used Google as a single sign on, but they named
the application "Google Docs" to fool users into thinking it was an actual Google application.
<o:p></o:p></p>
<p class="MsoNormal">4) If a user clicked on the Allow button, the fake "Google Docs" application now had access to their Google accounts and to act on their behalf (send the message to everyone in their address book, perform password resets, etc.)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">How can I make sure I'm safe, and prevent a similar attack in the future?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">1) Know that Google applications do not need permission to act on your behalf. If you are logged into Google, you should not need to give any more permission to Google to use services like Google Docs.<o:p></o:p></p>
<p class="MsoNormal">2) We’ve attached a picture of the permission request that users would have received. Always look through these carefully before clicking allow.<o:p></o:p></p>
<p class="MsoNormal">3) If you did fall prey to this attack, take a moment to go in and remove access from the Google Docs application. Go to https://myaccount.google.com > Sign In & Security > Connected Apps. View the applications that are connected to
your account. Remove the Google Docs app if it's connected.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thor Sage<o:p></o:p></p>
<p class="MsoNormal">Executive Director<o:p></o:p></p>
<p class="MsoNormal">Miami Valley Educational Computer Association<o:p></o:p></p>
<p class="MsoNormal">937-767-1468 x3101<o:p></o:p></p>
<p class="MsoNormal"><a href="http://www.mveca.org/"><span style="color:windowtext;text-decoration:none"><img border="0" width="174" height="64" id="Picture_x0020_1" src="cid:image001.jpg@01D2C4AC.F0038FF0" alt="http://www.mveca.org/images/logo.gif"></span></a><o:p></o:p></p>
<p class="MsoNormal"><i>Not-for-profit Technology Services for Education and Local Governments<o:p></o:p></i></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>