Gmail bug cured by Google

Google faced a major security bug impacting the Gmail and G Suite email servers on Wednesday. The bug could have allowed a threat actor to send spoofed emails mimicking any Gmail or G Suite customer.

According to security researcher Allison Husain, who found and reported this issue to Google in April, the bug also allowed attachers to pass the spoofed emails as compliant with SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance), two of the most advanced email security standards.

 However, despite having 137 days to fix the reported issue, Google initially delayed patches past the disclosure deadline, planning to fix the bug somewhere in September.

 Google engineers changed their mind after Husain published details about the bug on her blog, including proof-of-concept exploit code.

 Seven hours after the blog post went live, Google told Husain they deployed mitigations to block any attacks leveraging the reported issue, while they waited for final patches to deploy in September.

 In hindsight, the bug patching snafu is a common occurrence in the tech industry, where many companies and their security teams don't always fully understand the severity and repercussions of not patching vulnerability until details about that bug become public, and they stand to be exploited.

As for the bug itself, the issue is actually a combination of two factors, as Husain explains in her blog post. The first is a bug that lets an attacker send spoofed emails to an email gateway on the Gmail and G Suite backend.

The attacker can run/rent a malicious email server on the Gmail and G Suite backend, allow this email through, and then use the second bug.

This second bug allows the attacker to set up custom email routing rules that take an incoming email and forward it, while also spoofing the identity of any Gmail or G Suite customer using a native Gmail/G Suite feature named "Change envelope recipient."

The benefit of using this feature for forwarding emails is that Gmail/G Suite also validates the spoofed forwarded email against SPF and DMARC security standards, helping attackers authenticate the spoofed message.

"Additionally, since the message is originating from Google's backend, it is also likely that the message will have a lower spam score and so should be filtered less often," Husain said, while also pointing out that the two bugs are unique to Google only.

Google's mitigations have been deployed server-side, which means Gmail and G Suite customers don't need to do anything.