The attackers used a complex method in the attack to steal user data by exploiting the Google Infrastructure, as fake email messages that appear to be issued from Google itself were sent, and the attackers were able to manipulate it to direct the victims to fake sites to steal their entry data.
How does the attack work?
The attack began with an email Protected that seemed completely correct, as it passed all documentation tests such as the DKIM signature, which made it look like a safe message from Google, and the message included a notification regarding a legally summons, and asked the victim to click on a link to be hosted on the sites.google.com.
When clicking on the link directs the user to a fake page similar to the official support page of Google, but it is actually a forged page designed using the Google Sites that does not contain strong safety protection, making it an ideal platform for creating pages to steal the entry data.
DKIM exploitation mechanism
In this attack, attackers used the re -signature of DKIM, as they first created a new Google account with a scope such as “Me@” and then created the Oauth application from Google containing the content of the alleged message, and this process produces a security alert message that is sent from Google, signed by the signature of DKIM Saleh.
Then the attackers re -send the message using an unrelated domain while maintaining the DKIM signature to pass through a custom SMTP service, thus the message reached the victim’s mail crossing all approved safety filters such as SPF, DKIM and DMARC.
The risks and effects of the attack
Due to this advanced technology, the message appears to be official and safe, and the user is not warned in Gmail, and the attackers used a smart style to show the word “Me” at the top of the message to avoid doubts, which makes the message look like it is addressed to the user’s email address.
On the fake page on Google Sites, users are asked to log in with their Google accreditation data, then their data is stolen.
Google’s response and recommendations
Google announced that she is aware of this attack and has applied protection to prevent these patterns from attacks, and confirmed that Google never requires users to provide sensitive information such as passwords or codes for one time via email, and Google also recommended users to activate bilateral authentication and traffic codes as additional measures to enhance safety against these types of attacks.
