Hacking Gmail’s UX with 'From' Fields – Another Phishing Vector

Re:Hacking Gmail’s UX with 'From' Fields – Another Phishing ... by Sephr on Wednesday November 14, 2018 @05:36PM (#18454843)

You think that's bad? There's a Google Inbox and Gmail spoofing vulnerability which has been disclosed for over a year, and it's still not fixed.

Vulnerability details: https://eligrey.com/blog/google-inbox-spoofing-vulnerability...

Screenshot: https://go.eligrey.com/t/screenshots/google-inbox-spoofing-o...

PoC demo (open on Android using Google Inbox or Gmail): https://dangerous.link/gmail-and-inbox-spoofing-on-android

[ Parent | on HN ]

Re:Hacking Gmail’s UX with 'From' Fields – Another Phishing ... by terrik on Thursday November 15, 2018 @12:14AM (#18457025)

Clicking this PoC link on iOS shows that the iOS Mail app suffers the same UI vulnerability. It appears like you are emailing [email protected], when you are not.

[ Parent | on HN ]

Re:Hacking Gmail’s UX with 'From' Fields – Another Phishing ... by zufallsheld on Thursday November 15, 2018 @12:43AM (#18457142)

Same for K9 Mail in Android. Clicking on the mail address reveals the real Destination though.

[ Parent | on HN ]

Re:Hacking Gmail’s UX with 'From' Fields – Another Phishing ... by cottenio on Wednesday November 14, 2018 @11:16PM (#18456817)

I'm shocked this hasn't been resolved in mobile yet. I opened it up on my phone, and heck, with a pretty HTML form emulation in the email you could really have a very effective phishing campaign.

[ Parent | on HN ]

Re:Hacking Gmail’s UX with 'From' Fields – Another Phishing ... by sazfedjhrgnukc on Wednesday November 14, 2018 @06:00PM (#18455036)

> ... and it's still not fixed

It was fixed in May: https://www.xda-developers.com/google-fixes-flaw-spoof-inbox...

[ Parent | on HN ]

Re:Hacking Gmail’s UX with 'From' Fields – Another Phishing ... by Sephr on Wednesday November 14, 2018 @06:33PM (#18455305)

It was only fixed in the webapp. As you can see with the PoC demo link, this is still unfixed in the Inbox app for Android.

[ Parent | on HN ]

Re:Hacking Gmail’s UX with 'From' Fields – Another Phishing ... by sazfedjhrgnukc on Wednesday November 14, 2018 @07:00PM (#18455506)

Thanks for clarifying. I should've been able to deduced that it was only fixed in the webapp from the "open on Android using Google Inbox or Gmail" part of your comment. I'm sorry.

[ Parent | on HN ]

Re:Hacking Gmail’s UX with 'From' Fields – Another Phishing ... by f055 on Thursday November 15, 2018 @03:43AM (#18457786)

Fun fact: the poc doesn’t “work” on iOS if you uninstalled the Mail app and are using a 3rd party client (link triggers App Store prompt “do you want to install mail”) ;)

[ Parent | on HN ]