A login page vulnerability for Google’s Login Page has recently been discovered. Unfortunately, Google doesn’t consider it a real threat, so it won’t be fixed.
In a nutshell, it is possible for a hacker to take advantage of a login page vulnerability and hijack the login process on the actual Google Login page; tricking you into revealing your password or forcing a file to be downloaded onto your computer.
How the Vulnerability Works
Google has built their login page with the ability to forward users to the appropriate service after successfully logging in to their account. That’s fine, if you went to the Login Page on your own. However, if you used a link (received in an email, or found on a website) to get the login page, it’s possible that the author of the link purposely designed the link to fail the login process and direct you to a fake “Re-enter your Password” page. Now, you are likely to assume you accidentally typed your password incorrectly and will probably type it again. This results in the hacker stealing your password. But, you won’t know it happened, because the hacker, in addition to stealing your password, will then use it to correctly log you in to your account.
Why Won’t Google Address It
According to the security researcher who reported the vulnerability, Google replied that the vulnerability can only happen if someone is victimized by a “phishing” attack, and as such, is no different from any other “fake” login that people fall victim to.
How to Protect Yourself
- Never log into a Google Services Page (such as Google Docs or Gmail) using a link that is contained on a website or in an email.
- Be aware that the results of a Google Search could be designed to trick you into logging in to Google, so don’t trust search results that send you to a Google Login Page
- Always type the URL for Gmail or any Google Service directly into the address bar of your browser
- Consider opting in to Google’s two-factor authentication program. This program is designed to require persons logging into a Google Service to authenticate the device (computer, tablet, phone) the first time it is used, so that people who discover your password still cannot login from an unauthorized device.
If you suspect that your Google Password has been compromised, you should use Google’s “Forgot Password” procedure to change your password. If you have any other security-related questions, feel free to contact me at Safe and Secure Computing.
