A Gmail bug has been found that lets electronic mails to be transmitted anonymously with no information contained in the sender field. The bug might easily be abused by cybercriminals for use in phishing attacks.
Phishers often hide the sender of an electronic mail in phishing campaigns to deceive the receiver into believing the electronic mail is genuine. The sender’s electronic mail address can be deceived so the shown name seems to be a known contact or well-known organization. Nevertheless, if there is no information in the from field, several end users might be deceived into thinking the electronic mail has come from a genuine source.
The vulnerability was found by software developer Tim Cotton. It is the second Gmail vulnerability he has found in the past few days. The first Gmail vulnerability would let an attacker send a message directly to a user’s sent folder, possibly bypassing inbox anti-spam safeguards. The vulnerability might be abused to make a user think that they have earlier transmitted a message.
The vulnerability is present in how Gmail categorizes electronic mails. If the account holder’s name is in the from field, the message will be automatically sent to the sent folder. If an attacker was then to send a normal electronic mail to the same user, which referred to an earlier message they had received, the user might be enticed into checking the message in the sent folder and might open an attachment or click on an embedded hyperlink.
The latest Gmail vulnerability is similar to the first. Cotton found that if a receiver’s name is paired with a random tag such as <img> or <object> that contained a distorted image, the sender name would remain blank. Using this method, even if the receiver clicks on reply, no sender’s name will show. Even using the Show Original function, the sender’s name was not shown.
As per Cotton, “It was the blend of the quoted alias, a preceding word, space and the long base64, [and] poorly encoded img tag.” While the header was conserved and described, the Gmail UX might not handle it and returned a blank field.
Both vulnerabilities have been informed to Google, but thus far, they have not been rectified.