Hackers concealed phishing attacks in Google Cloud

Spread the love

Mumbai: Hackers are concealing phishing attacks on Google Cloud Platform (GCP) warned Check Point researchers.

By using advanced features in a well-known cloud storage service according to Check Point researchers, the hackers can better disguise their malicious intentions.

And hackers would remain free from more traditional red flags that people look for such as suspicious-looking domains or websites without an HTTPS certificate.

“Hackers are swarming around the cloud storage services that we rely on and trust, making it much tougher to identify a phishing attack,” said Lotem Finkelsteen, Check Point’s Manager of Threat Intelligence.

“Traditional red flags of a phishing attack, such as look-alike domains or websites without certificates, won’t help us much as we enter a potential cyber pandemic,” added Finkelsteen.

Finkelsteen asked users of Google Cloud Platform, even AWS and Azure to be beware of this fast-growing trend, and learn how to protect themselves. “It starts by thinking twice about the files you receive from senders,” he commented.

Below, Check Point researchers provide an example of a hacker using GCP advanced features, Google Functions, to orchestrate a sophisticated phishing attack, just like any other business.

Example: Hacker uses GCP Advanced features to push Phishing attack

This year, Check Point researchers came across an attack that started with a PDF document uploaded to Google Drive, which included a link to a phishing page.

The phishing page, hosted on storage.googleapis[.]com/asharepoint-unwearied-439052791/index.html, asked the user to login with their Office 365 or organization e-mail.

When a user chooses one of the options, a pop-up window with the Outlook login page appears. After the credentials were entered, the user is led to a real PDF report published by a renowned global consulting firm.

During all of these stages, the user never gets suspicious since the phishing page is hosted on Google Cloud Storage.

However, viewing the phishing page’s source code has revealed that most of the resources are loaded from a website that belongs to the attackers, prvtsmtp[.]com. The attackers started using Google Cloud Functions, a service that allows the running of code in the cloud.

In this case, the resources in the phishing page were loaded from a Google Cloud Functions instance without exposing the attackers’ own malicious domains. Investigating prvtsmtp[.]com showed that it resolved to a Ukrainian IP address (31.28.168[.]4).

Many other domains related to this phishing attack resolved to the same IP address, or to different ones on the same netblock.

Figure 1: Phishing Page asking user to login with their Office 365 credentials

Phishing Page asking user to login with their Office 365 credentials
(Image source – Check Point)

Figure 2: PDF report published by a renowned global consulting firm

(Image source – Check Point )

Figure 3: Phishing page’s malicious code

(Image source – Check Point)

How to Stay Protected

  • Beware of lookalike domains, spelling errors in emails or websites, and unfamiliar email senders.
  • Be cautious with files received via email from unknown senders, especially if they prompt for a certain action you would not usually do.
  • Ensure you are ordering goods from an authentic source. One way to do this is NOT to click on promotional links in emails, and instead, Google your desired retailer and click the link from the Google results page.
  • Beware of “special” offers. “An exclusive cure for coronavirus for $150” is usually not a reliable or trustworthy purchase opportunity.
  • Make sure you do not reuse passwords between different applications and accounts.

Leave a Reply

Your email address will not be published. Required fields are marked *