The Google Phishing Attack, Explained | Greg Leffler | Pulse | LinkedIn
Google absolutely must introduce at least some degree of filtering in OAuth application names. There is zero excuse for Google to let an app called "Google Docs" that isn't from them ask for permission to connect to your account. Google should have noticed the behavior of this app and stopped it much more quickly than it did. Google appeared to respond to the attack and disable the fake OAuth app within a few hours, but automated systems should look very suspiciously upon any "app" that reads someone's entire contact list and then attempts to send hundreds of emails. The legitimate use case for that seems pretty nonexistent. Read full article from The Google Phishing Attack, Explained | Greg Leffler | Pulse | LinkedIn
No comments:
Post a Comment