Google Neutralizes Phishing Scam

A phishing scam that surfaced recently used Google Docs in an attack against at least 1 million Gmail users.

However, that amounted to fewer than 0.1 percent of Gmail users were affected, according to the company.
Google last year put the number of active monthly Gmail users at more than 1 billion.

Google shut down the phishing scam within an hour, it said, through both automatic and manual actions. It removed the fake pages and applications, and it pushed updates through Safe Browsing, Gmail and other anti-abuse systems.

Users did not need to take any action on their own in response to the attack, Google said, but those who wanted to review third-party apps connected to their account could do so at its Security Checkup site.

Anti-Phishing Security Checks

Coincidentally, Google this week introduced a new anti-phishing security feature to Gmail on Android. The new tool delivers a warning when a user clicks on a suspicious link in an email message, alerting them that the site they're trying to visit has been identified as a forgery. Users can back away or continue to the site at their own risk.

Google is gradually rolling out the new feature to all G Suite users.

How the Docs Attack Went Down

This week's Docs attack was an effective approach to luring users before Google clamped down.

People got an email from someone they knew inviting them to click on a link to collaborate on a Google Doc.

Clicking on the "Open in Docs" link redirected them to a Google OAuth 2.0 page to authorize the Google Docs application, which was a fake.

The application stated that Google Docs would like to read, send, delete and manage the recipient's email and manage their contacts -- requests common to several applications that use Google as an authentication mechanism.

Once the permission was granted, the attacker gained access to the victim's address book, which allowed the attack to go viral swiftly.

The OAuth Vulnerability

The attack leveraged OAuth, "a ubiquitous industry standard protocol [that provides] a secure way for Web applications and services to connect without requiring users to share their account credentials with those applications," said Ayse Firat, director of analytics and customer insights at Cisco Cloudlock.

"Because it's so universally adopted by almost all Web-based applications and platforms, including consumer as well as enterprise applications such as Google Apps, Office 365, Salesforce, LinkedIn and many others, it provides a broad attack surface," she told TechNewsWorld.

OAuth 2.0 is highly sensitive to phishing because every website using it asks end users for the username and password of their master identity. Cisco CLoudlock has identified more than 275,000 OAuth apps connected to core cloud services, such as Office 365, compared with only 5,500 three years ago.

OAuth-based attacks "bypass all standard security layers, including next-generation firewalls, secure Web gateways, single sign-ons, multifactor authentication and more," Firat cautioned.

The Ramifications of Using OAuth

With software vendors increasingly putting their applications in the cloud, how great a risk do OAuth's vulnerabilities pose for end users?

"Most cloud services are pretty secure, and OAuth-based attacks likely will not be successful if services depending on the protocol are otherwise secured," said Michael Jude, a program manager at Stratecast/Frost & Sullivan.

OAuth authentication "is bigger than just online apps," he suggested. "It's also a basic establishment protocol that could become important in social media efforts to become more akin to common carriage operations for communications."
OAuth "has to be done right, or there's no future for social media-mediated communication services," Jude warned.

Protecting Against OAuth-Based Attacks

Organizations need to develop a high-level strategy as well as a specific application use policy to decide how they will whitelist or ban applications, and share this vision with their end users, Firat suggested.

Individual users should go into their Google account security settings and revoke permissions to applications they don't know or trust, she recommended. They also "should never grant permissions to applications that request excessive access."

Efforts have been launched to incorporate stricter security requirements into OAuth, Frost's Jude said, "but I haven't heard of any particular availability."

TechNewsWorld:

You Might Also Read:

Why SMEs Need Cyber Insurance:

Fake Microsoft Phishing Scam:

Why Spear-Phishing Hacks Are So Successful:

 

 

 

« Government Sponsored Cyber-insecurity Is A Gift For Hackers
Intelligence In The Age of Cyber Warfare »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CyTech Services

CyTech Services

CyTech provides unique services and solutions complemented with professional subject matter experts to both the Federal and Commercial sectors.

Apcon

Apcon

Apcon's mission is to provide valuable network insights that enable security and network professionals to monitor, secure and protect their data in both physical and virtual environments.

Hillstone Networks

Hillstone Networks

Hillstone Networks offers a broad range of security solutions for enterprises and data center networks – whether physical, virtual, or in the cloud.

Luxar Tech

Luxar Tech

Luxar's network visibility products enable enterprises and service providers to monitor network traffic, improve security and optimize efficiency.

ManTech International

ManTech International

ManTech provides comprehensive, integrated cyber security support, which includes computer and network design, implementation, and operations.

Retail & Hospitality Information Sharing & Analysis Center (RH-ISAC)

Retail & Hospitality Information Sharing & Analysis Center (RH-ISAC)

Retail & Hospitality ISAC operates as a central hub for sharing sector-specific cyber security information and intelligence.

Cryptovision

Cryptovision

Cryptovision GmbH is one of the leading specialists for modern, user-friendly cryptography and solutions for secure electronic identities.

Hellenic Accreditation System (ESYD)

Hellenic Accreditation System (ESYD)

ESYD is the national accreditation body for Greece. The directory of members provides details of organisations offering certification services for ISO 27001.

Spamhaus

Spamhaus

Spamhaus is the world leader in supplying realtime highly accurate threat intelligence to the Internet's major networks.

Vigilant Technology Solutions

Vigilant Technology Solutions

Vigilant is a global cyber security technology company offering solutions to manage entire IT & cyber security lifecycles.

Keysight Technologies

Keysight Technologies

Keysight is dedicated to providing tomorrow’s test technologies today, enabling our customers to connect and secure the world with their innovations.

FoxTech

FoxTech

FoxTech is an independent, friendly and deeply specialised cyber security company in the UK, with expertise spanning decades of Public Sector and Government services.

SecureOps

SecureOps

SecureOps is transforming the Managed Security Service Provider industry by providing tailored cybersecurity solutions proven to protect organizations from cyberattacks.

Mailinblack

Mailinblack

Mailinblack protects your organisation against email threats with an innovative solution that meets your security requirements.

Protecto

Protecto

Make privacy and governance effortless. Brakes allow you to drive faster. Stronger data privacy and security enable companies to unlock the full potential of the data.

AuthMind

AuthMind

Prevent your next identity-related cyberattack with the AuthMind Identity SecOps Platform. It works anywhere and deploys in minutes.