Google's login page has a fault that hackers could use to trick you out of your password
Thomson Reuters
In a post published Saturday on his personal website, Aidan Woods writes of the find and some frustrating interactions he had with Google's security team, which told him they would not track it as a security bug.
"I hope that public disclosure will encourage Google to do otherwise," Woods wrote.
Here's what Woods figured out: Google's login page allows the insertion of an extra parameter called "continue" which can redirect a user to any URL, as long as it's one that starts with google.com.
So, for example, adding ?continue=http://www.google.com/amp/businessinsider.com onto the login URL would bring a person to a real Google login screen. Then after they enter their username and password, it would take them to the home page of Business Insider.
And that can be a very bad thing.
As Woods notes, an attacker can redirect someone to a Google form to gather personal information, or have them automatically download a malicious file uploaded to Google Drive. Or, in perhaps what would be the easiest use case, a hacker can redirect a user to a website they control that looks exactly like the Google login screen - with a message saying "password incorrect, please try again" - convincing the user to give up their password.
It's a classic phishing scheme that would basically use Google.com against the victim. Email phishing, where an attacker sends an email directing someone to download malicious files or click a link, is by far the most-used method cyber criminals employ these days.
That's because it's simple and very effective - and using a Google login page would make it even more so.
Woods shared emails with the company's security team, which downplayed the problem. A Google employee named Karshan sent the researcher to a Google website classifying such redirects as posing "very little practical risk" though it noted that a redirect classified as a URL whitelist bypass - which is what this is - can lead to "more serious flaws."
Business Insider confirmed the redirect issue still exists. Interestingly, another researcher who saw Woods post claimed he contacted the company back in late June, and was similarly rebuffed.
"I couldn't quite believe that Google had both understood this issue, and simply shrugged it off," Woods wrote.
Google did not immediately respond to a request for comment.
For now, users should be cautious when being asked to re-enter their password. If asked to give your password or other personal information, double-check the URL and ensure it's still coming from google.com. If it's not, it's possible you're seeing this attack in action.
Woods created a video of how it works:
- Should you be worried about the potential side-effects of the Covishield vaccine?
- India T20 World Cup squad: KulCha back on menu, KL Rahul dropped
- Sales of homes priced over ₹4 crore rise 10% in Jan-Mar in top 7 cities: CBRE
- Gold prices fluctuate as geopolitical tensions ease; US Fed meeting, payroll data to affect prices this week
- Best beaches to visit in Goa in 2024
- Nothing Phone (2a) blue edition launched
- JNK India IPO allotment date
- JioCinema New Plans
- Realme Narzo 70 Launched
- Apple Let Loose event
- Elon Musk Apology
- RIL cash flows
- Charlie Munger
- Feedbank IPO allotment
- Tata IPO allotment
- Most generous retirement plans
- Broadcom lays off
- Cibil Score vs Cibil Report
- Birla and Bajaj in top Richest
- Nestle Sept 2023 report
- India Equity Market