Google's Confusing Gmail Security Alert Looks Exactly Like a ...

Security researchers say the legitimate email is training people to have bad email hygiene. +EnglishVICEWatchWorldNewsCultureEntertainmentIdentityEnvironmentTechSexHealthFoodMusicVICEWatchInputforsearchingarticles,videos,showsWorldNewsCultureEntertainmentIdentityEnvironmentTechSexHealthFoodMusicGoogle’sConfusingGmailSecurityAlertLooksExactlyLikeaPhishingAttemptSecurityresearcherssaythelegitimateemailistrainingpeopletohavebademailhygiene.byLorenzoFranceschi-Bicchierai16.1.18ShareTweetSnapImage:sabbracadabra/ShutterstockLastweek,mypartnergotastrangeemailalertfromGoogle—oratleastitlookedlikeitcamefromGoogle.Alarmedandconfused,sheimmediatelyforwardedittome.“Whatthewhat?”shewroteintheemail.MypartnerisnotasecuritygeeklikeIam,andyetIhadthesamereactionwhenIsawit.Bothwhensheforwardedittomelastweek,andwhenIgotanidenticalalerttoday.Inspectingitmoreclosely,IwasprettyconfidentthiswasalegitGooglealert.Theemailaddressofthesenderisno-reply@accounts.google.com,andGmailitselftellsmeit’smailedbygaia.bounces.google.comandsignedbyaccounts.google.com.Asasecurityreporter,thesearebothsignsthattellmetheemailislegitimate.Butregularusersmightnotknowwheretolookfortheseorhowtointerpretthem.AdvertisementStillwewerenottheonlyonesbaffledandabitworriedbyit.SeveralpeopleonTwittertoldmetheyfeltthesamewhentheygotit:somethoughtitwas“suspect,”orstraightupa“phishingemail.”RichardDeVere,asecurityconsultantwhospecializesinsocialengineering,saidthateventhoughtheGoogleemailwegotisnotaphishingattempt,itissogoodatluringpeopletoclickonalinkthatheplanstoaddittohisbrochureofgoodphishingattackstouseitinhisethicalhackingengagements.“Ithasurgency,guidestoaloginpage,quitevague,butalarming…weusedtotakelegitimateGoogleemailsandadapt,butthisisjustperfectasis.[…]It’sthatgood,”hetweeted.“UnforgivableforGoogletosendthisoutenmasse.”Readmore:TheMotherboardGuidetoNotGettingHackedInthiscase,accordingtoGoogle,thealertsaredesignedtogetuserstogothroughtheveryuseful,anduser-friendly,securitycheckup,whichhelpsuserssetuptwo-factorauthentication,checkifanyoldappshaveaccesstotheiraccount,andreviewunusualsecurityeventssuchassign-insfromnewdevices.Thecompanytoldmethatthisalertistheresultofmonthsofexperiments,andthisversionofthealerthadthebestengagement(meaningpeopleactuallyopenedandclickedit).Therearenospecificsinitbecausethecompanywantedtoavoidgivinghackershintsaboutwhatwaswrongwiththeaccount,andthecompanyconcludedthattheextraclickrequiredtogettothecheckupwasasecurityfeatureinthiscase.AdvertisementHarloHolmes,adigitalsecuritytrainerattheFreedomofThePressfoundation,toldmethatthedesignofthisemailalert“reinforces”theusererrorofclickingonphishinglinks.Ineffect,thisalertmayverywellbetrainingpeopletoclickonrandomlinkssenttotheiremails.Inthiscase,theemailislegitimate,butthattypeofbehaviorisgenerallyhowpeoplegetphished.Gotatip?YoucancontactthisreportersecurelyonSignalat+19172571382,[email protected],oremaillorenzo@motherboard.tvHolmesstressedthatwhensomeonereceivesanalertlikethis,therightthingtodoistofirst“takeadeepbreath,”andthenopenanewbrowserwindowandmanuallytypeandnavigatetothesettingsoftheserviceinquestion(inthiscase,tomyaccount.google.com/security-checkup)andseewhat’sgoingonthere,withouteverclickingonthelinkintheemail.“Theyarewalkingafinelinehere:ifyouraccountiscompromised,theydon’twanttogiveyourattackertoomuchspecificinfoastohow,”Holmestoldmeinanonlinechat.“Theyjustgiveyouenoughinfotohopefullygetyourattention.”MattMitchell,asecurityspecialistwhoteachesregularpeoplehowtostaysafeonline,agreedthatthisalertispoorlydesigned.“Iamsurethenowpanickeduserjustwantstoknowwhattodo,”hetoldmeinanonlinechat.“Goodsecuritybeginswithcommonsense.Userswillbehavebadly,weneedtoaccountandplanforthat.”Googlehashistoricallybeenveryproactiveathelpingusersimprovetheirsecuritysettingsandalertingthemofattacksontheiraccounts.In2012,thecompanystartedwarninguserswhoweretargetsofgovernmenthackingattempts.Toavoidmisunderstandings,thesealertsdon’tcomeinanemail,butaredisplayedinthebrowser.GivenhowmuchhackerslovetopretendtobeGoogletotrickvictimsintogivingawaytheirpasswords,perhapsthatwouldhavebeenabetterdesignforthisalertaswell.GetsixofourfavoriteMotherboardstorieseverydaybysigningupforournewsletter.Tagged:TechMotherboardNewsHackingGooglecybersecurityemailphishingInfosecGmailalertTechnewsinformationsecurityAdvertisement