Trusted Google Domain Helped Hackers Get Past Security

March 4, 2021

Written by wukovits

Hackers have found a new tool in their never-ending quest to cause trouble. They’ve begun abusing the Apps Script business application developed by Google in a bid to steal credit card and personally identifiable information.

That’s significant because given Google’s dominant position on the internet, the Apps Script is widely trusted by the market.

That fact allows hackers to mask their illicit activities and is further aided by the fact that most online vendors whitelist Google’s subdomains by default. Why wouldn’t they? Google plays a critical role in today’s internet and most business owners rely heavily on a wide range of Google’s tools and services.

Unfortunately, that creates an opportunity that the hackers are only too happy to exploit. Armed with a means of masking their activities, hackers can inject malicious code into a number of eCommerce shopping cart solutions, many of which are JavaScript based.

We owe the discovery of this latest tactic to Sansec security researcher Eric Brandel.

Brandel had this to say about the recent discovery:

“This new threat shows that merely protecting web stores from talking to untrusted domains is not sufficient. E-commerce managers need to ensure that attackers cannot inject unauthorized code in the first place. Server-side malware and vulnerability monitoring is essential in any modern security policy.

when a skimming campaign runs entirely on trusted Google servers, very few security systems will flag it as ‘suspicious.’ And more importantly, popular countermeasures like Content-Security-Policy (CSP) will not work when a site administrator trusts Google.

CSP was invented to limit the execution of untrusted code. But since pretty much everybody trusts Google, the model is flawed.”

And that’s the crux of the problem. Fortunately, if Google’s past performance is any indication, they’ll move swiftly to make their systems even more secure, thus limiting the threat. Until that happens though, it pays to be mindful of the fact that it exists, and plan accordingly.

Used with permission from Article Aggregator

Bayou Tech

We provide solutions for your business. Find out how we can help.

Related Articles

Unlocking Small Business Success: The Impact of AI in a Digital Era

In the rapidly evolving business landscape, staying competitive necessitates embracing technological advancements. Artificial Intelligence (AI), once perceived as a luxury for larger enterprises, is now accessible to small businesses, offering new opportunities for...

Major Cyber Attack at OMV

Louisiana’s Office of Motor Vehicles (OMV) is one of a still undetermined number of government entities, major businesses, and organizations to be affected by an unprecedented Data Breach.There is no indication at this time that cyber attackers who breached MOVEit...

New Graphene Technology May Increase Hard Drive Storage

HDDs are old, well understood technology. They haven't changed much in recent years. In fact, increasingly, people are writing them off, preferring SSDs for their greater speed and smaller size, even though HDDs are less expensive. The clever folks at the University...

Send us a message

Your message was sent.