Cybercriminals Exploit Gmail Feature to Scale Up Attacks

Criminals are taking advantage of Gmails dots dont matter feature to set up multiple fraudulent accounts on websites, using variations of the same email address, Agari says.

Some cybercriminals are taking advantage of a long-standing feature in Google Gmail designed to enhance account security, to create multiple fraudulent accounts on various websites quickly and at scale, security vendor Agari said this week.
The feature, which some have warned about previously, basically ensures that all dotted variations of a Gmail address belong to the same account. For example, Google treats johnsmith (at) gmail.com the same as john.smith (at) gmail.com and jo.hn.smith (at) gmail.com. An individual with johnsmith (at) gmail.com as their email address would therefore receive emails sent to
all
dotted variations of the same address.
A Google spokesperson declined to comment on the Agari research, but pointed to Googles official description of the dots feature, where Google
says
that the dots dont matter approach in Gmail ensures no one can take another persons username. Your Gmail address is unique. If anyone tries to create a Gmail account with a dotted version of your username, theyll get an error saying the username is already taken, Google said in its post on the feature.
But the feature can be problematic to organizations that support the creation of new user accounts on their websites—such as credit card companies and social media sites— Agari says. Most such sites, and indeed a vast majority of the Internet, treat each dotted variant as a separate email account. For instance, most websites that support account creation would treat johnsmith (at) gmail.com as a separate email address from john.smith (at) gmail.com. So a criminal can easily create multiple accounts on a website using dot variants of the same email address, Agari
said in its new research
.
Agari researchers recently have observed business email compromise (BEC) scammers taking advantage of the feature to set up dozens of accounts on single websites and have all communications associated with those accounts directed to single Gmail accounts.
Over the past year, the criminals have used the approach to submit 48 credit card applications at four US-based companies and to conduct at least $65,000 in fraudulent credit, Agari said. The attackers have also used the Gmail account feature to file 11 fraudulent tax returns via an online filing service, submit 12 change-of-address requests with the postal service; apply for unemployment benefits; and submit applications with FEMA disaster assistance using identities belonging to other people.
To be clear, the Gmail feature itself did not enable the actual scams: it just made it easier for the BEC attackers to monitor and receive communications across the multiple accounts using a single Gmail address.
By exploiting this feature in Gmail accounts, scammers are able to scale their operations more efficiently, Agari said. They then dont need to create and monitor a new email account for every new account on a website, so their onlie online scams are faster and more efficient.
Any enterprise that includes account creation in its business model, such as financial services or social media, should be aware that attackers can use the Google dot exploit to create a large number of fraudulent accounts, says Crane Hassold, senior director of threat intelligence at Agari.
Organizations can either treat dots the way that Google treats dots, which is to ignore them ... or they can monitor for rapid-account creation from email addresses that include multiple dots to flag potentially suspicious behavior, he says.
Related Content:
Google Adds Security Features to Gmail Face-lift
Cyberattackers Bait Financial Firms with Google Cloud Platform
Hackers Bypass Gmail, Yahoo 2FA at Scale
7 Most Prevalent Phishing Subject Lines

Last News
▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security	▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security	▸ Car Sector Speeds Up In Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Cybercriminals Exploit Gmail Feature to Scale Up Attacks