Scammers are hosting phishing pages on Google Firebase Storage to bypass email security filters, Threatpost reports. Firebase is a Google-owned application development platform that provides secure storage in Google Cloud. Researchers at Trustwave SpiderLabs have observed several phishing campaigns abusing this cloud infrastructure to obtain URLs that won’t be blocked by email gateways.
The phishing emails themselves aren’t particularly noteworthy. They use various templates spoofing Outlook, Office 365, Bank of America, and others to trick recipients into clicking a link that will take them to a phishing site designed to steal their credentials or financial information.
The use of Firebase URLs is significant, however. One of the biggest hurdles in a phishing campaign is actually getting the emails into recipients’ inboxes. Email security solutions have gotten better at detecting emails that contain links to suspicious websites, so attackers prefer to host their phishing sites on reputable infrastructure. If enough people receive the emails—even if the templates aren’t very refined—at least some recipients will probably fall for the scam.
Karl Sigler, senior threat intelligence manager of Trustwave’s SpiderLabs, told Threatpost that this technique is growing more common.
“Since it’s using Google Cloud Storage, credential-capturing webpages hosted on the service are more likely to make it through security protections like Secure Email Gateways due to the reputation of Google and the large base of valid users,” Sigler said. “The use of cloud infrastructure is rising among cybercriminals in order to capitalize on the reputation and valid uses of those services. They tend to not be immediately flagged by security controls just due to the URL.”
Sigler added that these campaigns highlight the need for user education about social engineering techniques.
“Again, because of the valid uses and large user base of these services, many of these phishing emails can slip through the cracks of the security controls we put in place,” Sigler said. “Educating users about these tactics helps provide defense-in-depth against these techniques when they hit a victim’s inbox.”
Attackers will always find ways to overcome technical defenses. New-school security awareness training can teach your employees how to recognize and thwart both sophisticated and generic phishing attempts.
Threatpost has the story: https://threatpost.com/crooks-tap-google-firebase-in-fresh-phishing-tactic/155967/
Here's how it works:
