Attack to disguise Gmail's attachment and induce it to fake Google and log in

BySwapnil Bhavsar

Malware is installed when opening the file attached to the e-mail ...... Although it is a case to listen frequently, in Gmail, based on the embedding link pretended as if the file is attached, A new phishing attack that guides you to Google has been confirmed.

This is the closest I've ever come to falling for a Gmail phishing attack. If it had been high for me DPI screen making the image fuzzy ...Pic.twitter.com/MizEWYksBh

- Tom Scott (@ tomscott)December 23, 2016

This is disturbingly clever. You get sent to a text / html data URI! Not testing any further but, blimey, talk about using power for evil.Pic.twitter.com/TamVn7DBfW

- Tom Scott (@ tomscott)December 23, 2016

It's popular with comedians who discovered new attacks YouTuberTom ScottMr. According to Mr. Scott, the e-mail was sent from an e-mail address of the acquaintance, and it seemed that the PDF file appeared to be attached.

Mail sent by Mr. Scott, sent. It looks like a 100 KB PDF file "INVOICE-DEC 287 E. pdf" is attached, but this part is actually embedded in the image, trying to click to open or download the file Then ...


The one like Google's login page opens.


しかし、アドレス欄をよく見ると「https://accounts.google.com/ServiceLogin～～」という文字列の前に「data:text/html,」というフレーズが入っています。つまり、ウェブサイトではなく、別のHTMLファイルを開いているということです。実際、スコット氏によると、URL部分はあとから上書きされて書き換わっていたとのこと。


Although Mr. Scott was dangerously deceived, since the monitor was of high resolution, he found a suspicious character string at the right end of the address field. I noticed that using a iframe to open a page for phishing not Google.


By the way, for Scott's report, half of the reply was content that criticized Mr. Scott, such as "I'm trying to download an attached file", so the writers writing articles at TechRadar and BBC Mr. Holly Blockwell said, "I am very sorry that there are lots of reactions to criticize.The phishing scam that many people have been deceived is very stupid and rustic.This is also very well done In my opinion, I think that many people will be caught. "

According to Joe Uchill, cyber security expert, he is known as an expert to attend the international event DEFCON where hackers gatherChristopher HadnagyEven Mr. seems to have suffered from phishing scams, so do not be discouraged.