Government officials, activists targeted in Gmail attack

Filed Under: Data loss, Featured, Phishing, Privacy

Gmail logoGoogle has posted to their blog information about a targeted attack against the personal Gmail accounts of US government officials, political activists, military personnel and journalists.

Mila from the Contagio blog provides much more detailed information about the attacks. The messages appear to be handcrafted and spoofed to seem to be from governmental colleagues of many of the victims.

Gmail view/download linksNormally attachments in Gmail appear with a paper clip and links to view or download the item. The attackers created HTML that used fake attachment links that actually lead to a phishing page designed to look identical to the Gmail login page.

Mila wrote about these attacks in February, but the big news is Google sharing this information publicly. Most organizations prefer to keep security problems to themselves and maintain the illusion that their services are perfectly secure.

While this attack is not specifically a problem with Gmail, it is a widespread security weakness in many cloud services. Google sharing information with the public about how these attacks are executed helps all of us learn from these situations and build better systems.

Google gives some good advice in their post, although it seems strange that they feel the need to push Google Chrome as a solution to all security problems...

Gmail sign inHow should we respond to this news? We should take a moment to remind our users about best practices when using web-enabled technologies.

If you are ever presented with a login screen in your browser and you didn't type in the address of the site you are trying to visit, close the window. Only enter your password into pages where you entered in the URL.

, , ,

You might like

One Response to Government officials, activists targeted in Gmail attack

  1. DutchS · 1131 days ago

    Put your info in the cloud? Why not just Xerox all your most sensitive information a few thousand times and drop the copies out of an airplane?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Chester Wisniewski is a Senior Security Advisor at Sophos Canada. He provides advice and insight into the latest threats for security and IT professionals with the goal of providing clear guidance on complex topics. You can follow Chester on Twitter as @chetwisniewski, on App.net as Chester, Chester Wisniewski on Google Plus or send him an email at chesterw@sophos.com.