Android Gmail app security hole lets you pretend to be anyone online

A bug which allows you to pose as anyone when sending an email through the Gmail application has been deemed a non-issue despite the risk of exploit via phishing campaigns.

The bug is found within the standard Gmail application and needs only a few simple steps to implement. As reported by Motherboard, the issue was discovered by security researcher Yan Zhu and disclosed publicly last week.

In order to spoof your email address and masquerade as someone else when sending an email, you need only change your display name in account settings, which hides your legitimate email address.

Zhu demonstrated the problem through the email screenshot shown below. The independent researcher did nothing beyond changing her display name to yan ""security@google.com" -- including the important extra quotation mark, which triggers a parsing bug. The bug then forces the real email address to become invisible in the Gmail app, allowing Zhu to conceal herself as a member of Google's security team.

If an attacker is able to spoof their email address in this way and appear as something legitimate -- whether it be security@yourbank.com, account@google.com or your grocery store, a well-known delivery agent or friends and family, mass-phishing campaigns and spear-phishing may become more successful.

These techniques are used by cyberattackers to make fraudulent emails appear legitimate and entice victims to visit malicious websites which may download malware payloads or lure people into entering their account details, paving the way for account takeovers, data theft and empty bank accounts.

Your spam box is full to the brim of fake messages from sources pretending to be your bank, financial institutions and well-known companies such as eBay and PayPal because it is not difficult to spoof email addresses. However, the problem with this bug is that the flaw allows attackers to circumvent the usual spam filters which detect and stop these messages reaching your main inbox.

Source : zdnet.com