In order to avoid further phishing attacks on users of Gmail, Google says it will strengthen enforcement of the OAuth system that uses to link third-party apps to Google accounts.
Google explains in more detail how it intends to deal with the misuse of its phishing scam systems after last week's phishing attack with an app that allegedly belonged to Google Docs.
The fake Google Docs application used Google GoOgle's OAuth technology to request access to Gmail's Goal Goals. If users gave access to the app, the same email was sent to all of the victim's contacts.
It is worth mentioning that this news has been released for a week now with titles that make the Greek online community and especially novice users think that Gmail shares viruses and other "devilish" things "that damage computers"…
This is not the first time invaders have used Google's OAuth for phishing.
The so-called Fancy Bear hackers have used the same technique in the US and now in the French elections. As a security expert points out, Google could have prevented these phishing attempts with a more detailed check of the developers enrolled to use the OAuth mechanism.
Chet Wisniewski, principal researcher at security firm Sophos, reports that the phishing attack with the fake Docs “δεν διαφέρει από την κατάχρηση του Goοgle Play Store από τους προγραμματιστές κακόβουλου λογισμικού”. Μόνο που αντί να ανεβάσουν μια κακόβουλη εφαρμογή στο Google Play, the user receives an email from Google and authorizes an app through the company's OAuth.
Google already has several mechanisms to combat this type of "phishing" attacks, such as the machine learning spam detection and detection mechanism, the Safe system browsing but also checking for viruses in attachments.
However, the company said it would update its policies on applications using OAuth.
