TheJournal.ie uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Click here to find out more »
Dublin: 19 °C Tuesday 23 May, 2017
Advertisement

Use Gmail? Sneaky hackers use contact emails to attack Google Docs

The internet giant has managed to contain the attack.

The campaign affected fewer than a tenth of a percent of Gmail users.
The campaign affected fewer than a tenth of a percent of Gmail users.
Image: AP/PA Images

A ‘PHISHING’ SCAM that tricked people with what appeared to be Google Docs links was doused by the internet giant after spreading wildly.

The purpose of the scam, and the culprits behind it, remained unknown.

“We have taken action to protect users against an email impersonating Google Docs, and have disabled offending accounts,” a Google spokesperson said in an email response to an AFP inquiry.

“We’ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again.”

The scam combined “a phishing attack and a worm,” using a deceptive email to get people to open the door to malicious code that wriggled into their messaging programs to spread itself to others, according to Electronic Frontier Foundation staff technologist Cooper Quintin.

Email sent from a known contact’s real address would arrive containing a link it claimed led to a file to be shared at Google Docs online service, according to a rundown of the chicanery.

Clicking the link led to a real Google web address and asked for authorisation to run an application the attacker had cleverly called ‘Google Docs.’

Permissions granted to the application included allowing it to read or send email on a person’s behalf.

“It doesn’t immediately look like a phishing email,” Quintin said.

When you authorize the app, the very next thing it does is send the same emails to everyone in your contacts.

The application, along with online domains it was connecting to, were disabled within hours of it starting to spread wildly, according to Quintin.

“I suspect that it was far more successful than whoever released it into the world hoped or expected, and was maybe undone by its own success,” he said.

The domains went down pretty quickly. Google disabled the app, so it is no longer a threat.

The campaign affected fewer than a tenth of a percent of Gmail users, and was stopped within an hour, according to the California-based internet powerhouse.

Gmail is reported to have more than a billion users.

Google determined that while contact information was accessed, no other data was gleaned by the ruse, according to the spokesperson.

© – AFP 2017

Read; Google vows fix for ‘inappropriate’ search results >

Read: Uber executive leaves after claims he failed to disclose sex harassment allegation >

  • Share on Facebook
  • Email this article
  •  

About the author:

AFP

Read next:

COMMENTS (5)

This is YOUR comments community. Stay civil, stay constructive, stay on topic. Please familiarise yourself with our comments policy here before taking part.
write a comment

Leave a commentcancel