[ad_1]
Phishing actors abuse Google’s SMTP relay service to bypass email security products and successfully send malicious emails to targeted users.
According to a report from email security company Avanan, there has been a sudden increase in threat actors abusing Google’s SMTP relay service as of April 2022.
The company has detected at least 30,000 emails in the first two weeks of April distributed through this method.
attack details
Google offers a Simple Mail Transfer Protocol (SMTP) relay service that Gmail and Google Workspace users can use to route outgoing email.
Businesses use this service for a variety of reasons, ranging from not having to manage an external mail server to using it for marketing emails, so your mail server doesn’t get added to a block list.
Avanan claims that threat actors can use Google’s SMTP relay service to impersonate other Gmail tenants undetected, as long as those domains don’t have a DMARC policy configured with the ‘reject’ policy.
Domain-based Message Authentication, Reporting and Conformance, or DMARC, is an email authentication protocol that allows domain owners to specify what should happen if an email is spoofing their domain.
To do this, domain owners create a special DNS DMARC record that includes a directive that tells the mail server what to do. These policies are ‘none’ (do nothing with the spoofed email), ‘quarantine’ (place the email in the spam folder), or ‘reject’ (do not accept any emails).
New phishing campaigns use the SMTP server ‘smtp-relay.gmail.com’, which is a trusted server and is therefore commonly placed on allowed lists by email gateways and filtering services of spam.
For example, the following email, detected by Avanan, appears to come from Trello.com, but is actually from jigokar.com and passed through Google’s relay service.
As stated above, these attacks only work if the spoofed entity has set its DMARC policy to “none”, which is not as uncommon as you might think. For example, dell.com, wikipedia.org, yandex.ru, pornhub.com, bit.ly, and live.com all have DMARC policies set to “none”.
Setting strict DMARC policies is a security best practice as it helps prevent threat actors from spoofing domains.
In the case of Trello, the DMARC policy has been disabled due to the use of other security tools, making spoofing possible.
Emails are likely to miss spam detections because all Gmail tenants using this relay likely set up SPF records that put Google’s SMTP relay service on their domain’s trusted senders list.
When a threat actor spoofs a Gmail tenant’s domain, it passes the SPF record, and since DMARC is not set to ‘reject’, it will be successfully delivered to the targeted user’s inbox.
While Google’s relay service is being abused by these threat actors, Avanan says that any other relay service is susceptible to the same type of abuse.
Avanan says they reported this abuse to the Gmail team on April 23, 2022.
Bleeping Computer has contacted Google with further questions and whether it plans to take further action against this abuse, and a spokesperson has told us the following:
We have built-in protections to stop this type of attack. This research explains why we recommend users across the ecosystem to use the Domain-based Message Authentication, Reporting, and Conformance (DMARC) protocol. Doing so will defend against this attack method, which is a well-known problem in the industry.
Details on how users can properly configure their environments can be found here: https://support.google.com/a/answer/2956491?hl=en and here: https://support.google.com/ to/answer/ 10583557
There’s nothing unique to Workspace here, it talks about how email standards work across the industry. This research doesn’t reflect many of the layered defenses that keep customers safe, such as DMARC and email abuse filtering.
recommendations
Checking the sender address to detect a malicious phishing attempt isn’t enough against this type of attack, so checking the full headers when you’re unsure would be a great place to start.
Also, when links are embedded in the body of the message, hover over them to check the destination instead of clicking. Sometimes simply visiting harmful sites is enough for malware to get installed on your system.
Finally, if the message contains attachments, especially if they are in dangerous formats, do not download or open them.
[ad_2]
