Google Online Security Blog: Taking on the Next Generation of Phishing Scams

Security Blog

The latest news and insights from Google on security and safety on the Internet

Taking on the Next Generation of Phishing Scams

11 mai 2022

Posted by Daniel Margolis, Software Engineer, Google Account Security Teambrowsers get betterencryption becomes ubiquitous on the Weba recent phishing attack on the U.S. Department of Laborat I/O we announced

Left: legitimate Google SMS verification. Right: spoofed message asking victim to share verification code.

In other cases, attackers have leveraged more sophisticated dynamic phishing pages to conduct relay attacks. In these attacks, a user thinks they're logging into the intended site, just as in a standard phishing attack. But instead of deploying a simple static phishing page that saves the victim's email and password when the victim tries to login, the phisher has deployed a web service that logs into the actual website at the same time the user is falling for the phishing page.

The simplest approach is an almost off-the-shelf "reverse proxy" which acts as a "person in the middle", forwarding the victim's inputs to the legitimate page and sending the response from the legitimate page back to the victim's browser.

The Solution Space

Over the past year, we've started to automatically enable device-based two-factor authentication for our users. This authentication not only helps protect against traditional password compromise but, with technology improvements, we can also use it to help defend against these more sophisticated forms of phishing.

Taking a broad view, most efforts to protect and defend against phishing fall into the following categories:

Browser UI improvements to help users identify authentic websites.

Password managers that can validate the identity of the web page before logging in.

Phishing detection, both in email—the most common delivery channel—and in the browser itself, to warn users about suspicious web pages.

Preventing the person-in-the-middle attacks mentioned above by preventing automated login attempts.

Phishing-resistant authentication using FIDO with security keys or a Bluetooth connection to your phone.

Hardening the Google Prompt challenge to help users identify suspicious sign-in attempts, or to ask them to take additional steps that can defeat phishing (like navigating to a new web address, or to join the same wireless network as the computer they're logging into).