Se ha descubierto un error de Gmail
que permite a un pirata informático manipular el encabezado “since” en un correo electrónico y en última instancia dejar el remitente en blanco, lo que hace que el correo electrónico sea anónimo. El truco podría ser utilizado para ataques de phishing que pretenden ser advertencias oficiales o mensajes del sistema.
El desarrollador de software Tim Cotten, que la semana pasada descubrió la falla en Gmail, dijo en una publicación el viernes que una vulnerabilidad en el UX de Gmail permite que se falsifique el campo “De” de modo que correos electrónicos “fantasmas” pueden ser enviados posteriormente.
Para lograr el truco, Cotten said he entered the recipient's email in the header “since” and paired it with a large, arbitrary tag, how <object>, <script> or <img>.
“This is a derivative of the previous bug that could serve as a phishing vector”, Cotten told Threatpost. “The email sender field stays blank after placing incorrectly formatted tags”.
The result was an email lacking a sender. Even when Cotten pressed “reply” on the message, the sender's name did not appear in the reply message.
Even under the parameter “Show original” for the email (which can be accessed through the dropdown tag in the sent email) I still couldn’t see the sender's name in the field “of”.
“It was the combination of the quoted alias, a preceding word, space and the poorly coded img tag (note the spelling mistake)”, said Cotton. “As you can see, the header itself was preserved and analyzed by Google, but the UX simply can't handle it”.
Gmail's failure may seem harmless, but it could easily be exploited by malicious hackers crafting messages that pretend to be official warnings or system messages, which often come without a title “of” attached to them.
“Without the sender information, this looks completely legitimate, and a well-trained user could easily be tricked into compromising their own account”, said Cotton.
Cotten ha reportado a Google tanto este error como su error de Gmail previamente descubierto: la compañía no ha respondido ni ha solucionado ninguno de los errores.