3 ms·

You think that's bad? There's a Google Inbox and Gmail spoofing vulnerability which has been disclosed for over a year, and it's still not fixed. Vulnerability

by Sephr 8y ago

You think that's bad? There's a Google Inbox and Gmail spoofing vulnerability which has been disclosed for over a year, and it's still not fixed. Vulnerability details: https://eligrey.com/blog/google-inbox-spoofing-vulnerability/ https://eligrey.com/blog/google-inbox-spoofing-vulnerability... Screenshot: https://go.eligrey.com/t/screenshots/google-inbox-spoofing-on-android https://go.eligrey.com/t/screenshots/google-inbox-spoofing-o... PoC demo (open on Android using Google Inbox or Gmail): https://dangerous.link/gmail-and-inbox-spoofing-on-android https://dangerous.link/gmail-and-inbox-spoofing-on-android

sazfedjhrgnukc 8y ago
> ... and it's still not fixed It was fixed in May: https://www.xda-developers.com/google-fixes-flaw-spoof-inbox-by-gmail https://www.xda-developers.com/google-fixes-flaw-spoof-inbox...
- Sephr 8y ago
  It was only fixed in the webapp. As you can see with the PoC demo link, this is still unfixed in the Inbox app for Android.
  - sazfedjhrgnukc 8y ago
    Thanks for clarifying. I should've been able to deduced that it was only fixed in the webapp from the "open on Android using Google Inbox or Gmail" part of your comment. I'm sorry.
cottenio 8y ago
I'm shocked this hasn't been resolved in mobile yet. I opened it up on my phone, and heck, with a pretty HTML form emulation in the email you could really have a very effective phishing campaign.
terrik 8y ago
Clicking this PoC link on iOS shows that the iOS Mail app suffers the same UI vulnerability. It appears like you are emailing support@paypal.com, when you are not.
- zufallsheld 8y ago
  Same for K9 Mail in Android. Clicking on the mail address reveals the real Destination though.
f055 8y ago
Fun fact: the poc doesn’t “work” on iOS if you uninstalled the Mail app and are using a 3rd party client (link triggers App Store prompt “do you want to install mail”) ;)

by Sephr 8y ago

sazfedjhrgnukc 8y ago

> ... and it's still not fixed It was fixed in May: https://www.xda-developers.com/google-fixes-flaw-spoof-inbox-by-gmail https://www.xda-developers.com/google-fixes-flaw-spoof-inbox...

Sephr 8y ago
It was only fixed in the webapp. As you can see with the PoC demo link, this is still unfixed in the Inbox app for Android.
- sazfedjhrgnukc 8y ago
  Thanks for clarifying. I should've been able to deduced that it was only fixed in the webapp from the "open on Android using Google Inbox or Gmail" part of your comment. I'm sorry.

cottenio 8y ago

I'm shocked this hasn't been resolved in mobile yet. I opened it up on my phone, and heck, with a pretty HTML form emulation in the email you could really have a very effective phishing campaign.

terrik 8y ago

Clicking this PoC link on iOS shows that the iOS Mail app suffers the same UI vulnerability. It appears like you are emailing support@paypal.com, when you are not.

zufallsheld 8y ago
Same for K9 Mail in Android. Clicking on the mail address reveals the real Destination though.

f055 8y ago

Fun fact: the poc doesn’t “work” on iOS if you uninstalled the Mail app and are using a 3rd party client (link triggers App Store prompt “do you want to install mail”) ;)