Abusing App Engine to Automate Phishing

app phishing attackAttackers can abuse a feature in Google App Engine to generate unlimited phishing URLs, BleepingComputer reports. Security researcher Marcel Afrahim found that App Engine URLs that contain a non-existent subdomain will redirect the user to the app’s default page, rather than displaying a 404 error. As long as the “project ID” portion of the URL is correct, any App Engine URL will redirect to that particular project.

Many security products rely on blocking known malicious or suspicious URLs, but this technique allows attackers to generate a random, new URL for every single attack. This technique can be used for phishing attacks as well as for downloading malware payloads without being flagged by email filters or security products. Afrahim demonstrates how this can easily be automated with a few lines of code.

“And now you have a script that downloads the payload from different URL hostnames each time [it] is run and would render the network IOC of such hypothetical sample absolutely useless,” Afrahim writes.

Additionally, since these apps are hosted on Google’s infrastructure, some users could be fooled into thinking they’re actually trusted by Google.

“The fact that a single malicious app is now represented by multiple permutations of its subdomains makes it hard for sysadmins and security professionals to block malicious activity,” BleepingComputer explains. “But further, to a technologically unsavvy user, all of these subdomains would appear to be a ‘secure site.’ After all, the appspot.com domain and all its subdomains come with the seal of ‘Google Trust Services’ in their SSL certificates.”

Afrahim notes that at least one phishing campaign is already using this technique, and more can be expected to follow. Attackers will always find new ways to exploit flaws or abuse features to bypass security technology. New-school security awareness training can help your employees avoid falling for phishing attacks and other forms of social engineering.

BleepingComputer has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Topics: Phishing

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews