Photo by Simone Pellegrini on Unsplash [Download]

Google fixes a Gmail bug that could've let attackers spoof emails

While users were struggling to use Gmails services yesterday for a long time, Google fixed a critical bug that mightve let attackers send spoofed emails.

It took Google a whopping 137 days to close the bug after security researcherAllison Husain first reported it to the company.

The bug could also let attackers bypass protection protocols such asSender Policy Framework andDomain-based Message Authentication, Reporting and Conformance that protect you from spoofing.

These techniques compare the senders IP address to a pre-approved list of IPs from the domain that is allowed to send emails.

Because of this, even if the original email failed theSPF and DMARC test, the spoofed email would end up in the attackers second inbox because the IP was put in the allowlist.

Once the email is in the attackers second G suiteinbox, they could configure a random recipient through GmailsChange envelope recipient function.

Original article
Author: Thenextweb

TNW is one of the world’s largest online publications that delivers an international perspective on the latest news about Internet technology, business and culture.

Thenextweb has recently written 3 articles on similar topics including :
  1. "Google has evidently fired the founder and co-lead of its Ethical AI team, Margaret Mitchell. This comes after weeks of being locked out of her work accounts over an investigation related to Mitchells objections concerning the controversial firing of her fellow co-lead Timnit Gebru. Im fired". (February 20, 2021)
  2. "Impeached US President Donald Trump, in response to civil unrest surrounding the killing of George Floyd, over the weekend ordered US military and police forces to attack citizen protesters". (June 1, 2020)
  3. "Cybercriminals are having a field day as people are stuck in their homes due to the coronavirus pandemic. Coronavirus-related phishing attacks have risen by a whopping 667% since January,as hackers have been bombarding people with emails while masqueradingas a well-known company or a health authority like the World Health Organization (WHO)". (April 17, 2020)
Posted on  , ,