{"id":340017,"date":"2017-05-04T07:06:51","date_gmt":"2017-05-03T23:06:51","guid":{"rendered":"http:\/\/techcrunch.com\/?p=1485202"},"modified":"2017-05-04T07:06:51","modified_gmt":"2017-05-03T23:06:51","slug":"heres-googles-official-statement-on-todays-fast-spreading-phishing-attack","status":"publish","type":"post","link":"https:\/\/people.utm.my\/asmawisham\/heres-googles-official-statement-on-todays-fast-spreading-phishing-attack\/","title":{"rendered":"Here\u2019s Google\u2019s official statement on today\u2019s fast-spreading phishing attack"},"content":{"rendered":"

\"\"<\/p>\n

Early this afternoon, a new type of phishing attack<\/a> popped up, targeting Google Docs\/Gmail users and spreading like crazy<\/em>. Well-disguised and infuriatingly subtle, just a click or two (on what was an actual Google-hosted URL, no less) handed some mystery attacker the ability to read your Gmail and<\/em> forwarded the phishing attack to everyone you\u2019d ever emailed.<\/em><\/p>\n

The attack was simple, but sinister. You receive an email. It\u2019s from someone who has emailed you before, and happened to have you in their contacts. They were \u201csharing a document\u201d with you. Click the button to open the document, and you\u2019d see a seemingly innocent page \u2014 one hosted by Google, no less! It wouldn\u2019t ask you for a password, and it already listed all of your accounts. The page was asking you to give a \u201cGoogle Docs\u201d app permission to read your email and contacts.<\/p>\n

The trick: That \u201cGoogle Docs\u201d app wasn\u2019t actually Google Docs at all, just one somehow masquerading under the name.<\/p>\n

Even if you were generally dubious of these sorts of things, it checked a lot of the right boxes. But click \u201callow\u201d and bam \u2014 the mystery attacker now had inbox access and was fwd\u2019ing the bait to everyone in your contact list.<\/p>\n

Google says they\u2019ve stopped the attack for now, and are \u201cworking to prevent this kind of spoofing from happening again.\u201d<\/p>\n

Here\u2019s their full statement, via<\/a> the Google Docs Twitter account:<\/p>\n

\n
\n

(1 of 3) Official Google Statement on Phishing Email: We have taken action to protect users against an email impersonating Google Docs\u2026<\/p>\n

\u2014 Google Docs (@googledocs) May 3, 2017<\/a><\/p>\n<\/blockquote><\/div>\n

\n
\n

(2 of 3) & have disabled offending accounts. We\u2019ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team\u2026<\/p>\n

\u2014 Google Docs (@googledocs) May 3, 2017<\/a><\/p>\n<\/blockquote><\/div>\n

\n
\n

(3 of 3) is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail.<\/p>\n

\u2014 Google Docs (@googledocs) May 3, 2017<\/a><\/p>\n<\/blockquote><\/div>\n

In other words, this specific<\/em> attack is stopped\u2026 but now that the example has been set, copycats could potentially follow suit. Google is working on blocking the overall concept\u2026 but in the meantime, I\u2019d still suggest being super wary<\/em> of unsolicited\/unexpected Google Doc shares.<\/p>\n","protected":false},"excerpt":{"rendered":"

\"\" Early this afternoon, a new type of phishing attack popped up, targeting Google Docs\/Gmail users and spreading like crazy. Well-disguised and infuriatingly subtle, just a click or two (on what was an actual Google-hosted URL, no less) handed some mystery attacker the ability to read your Gmail and forwarded the phishing attack to everyone you’d ever emailed.
\nThe attack was simple, but… Read More<\/a><\/p>\n

\n<\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a>\n<\/div>\n

\"\"\/ <\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-340017","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/340017","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=340017"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/340017\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=340017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=340017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=340017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}