Well, we've got a red alert on a new potential exploit that seems to be able
to trick Gmail and potentially other email clients into verifying a spoofed email and
showing a whole verified badge and logo and all that sort of thing. This was
discovered by someone on Twitter named Chris Plummer, who is a cybersecurity professional,
and he received an email pretending to be UPS, but everything else about the email was super sketchy.
So you can see the subdomain and the username seem to be randomly generated, the sender name
just says "FE", the subject line is "SD", not sure what any of that is all about. And for reference,
this is an example of a legitimate email from UPS, though the guy didn't seem to post any
more details on what the email contained, but it was probably a run-of-the-mill email scam.
Now, the big deal is not that they spoofed the email. You can spoof an email, but the hard part
is getting past all the methods of email security verification, such as SPF, DMARC,
and DKIM, which are meant to specifically avoid this type of thing. Google's security team is
apparently aware of this and is looking into it, though there's no telling how long this will take.
They did assign the report with almost the highest priority and severity levels of P1 and S1,
though. But basically, all you have to know now is that if you get any suspicious emails
in the near future, that even if they come from a blue-check verified logo account,
apparently you need to watch out because it could potentially— there's a small chance,
I haven't seen this going around a lot, but there is a chance that it could be fake,
so you kind of have to use your common sense on the rest of the email as well.
But that does sort of apply all the time because you never know if a company's email server is
going to get hacked or even someone's account on there. It's just very unusual that you get
this extra verified thing using a checkmark, which actually uses a new standard called BIMI,
which is meant to allow companies to verify their trademark logo and attach that to emails,
assuming they have all the highest level email verification settings in place,
which UPS does apparently seem to have. Which is why this is also a big deal.
Now, I'm not going to get into the details of how these security protocols work, like DMARC, SPF,
and DKIM, though I did make another video where I was talking about how to spot spoofed emails,
and I did go into great detail about how those actually work,
if you want to check that out. But on the surface though,
it doesn't seem like there's any issues with how UPS has their settings configured.
Now, a lot of people in the Twitter thread that are smarter than me were
speculating on how this could have maybe been pulled off,
but there doesn't seem to be anything concrete yet. So at the moment, I can't be sure whether
this is a specific thing to UPS or if it is an exploit having to do with all of Gmail.
However, there are a few things that do suggest this may be having to do with Gmail,
which I'll explain in a second. As Chris mentions, it seems like the email started out
from being sent from Facebook, like a Facebook account, and went through someplace in the UK,
and then finally through Office 365, and then it was delivered to Gmail.
And Chris did very recently post the email headers, but it seems like all the people who are
discussing that haven't seen that yet. So we don't really have too good of an analysis yet. Now,
I'm not an expert, but I did put the email headers into Google's toolbox for email header analysis,
and you can see that it says that SPF DKIM and DMARC all pass, but I am surprised at this
because I thought the whole point of DMARC is that it looks for alignment between the
from address that's displayed to the user and the DKIM signing domain,
which is not ups.com here, so I don't know why this passes.
And not even anywhere else in the headers does it suggest that UPS signed it anywhere,
so I don't know where that came from. Then I put the email headers into another email header
analysis site, and this time it did say that it doesn't think the DKIM and DMARC are valid,
so that is surprising that Google says it apparently is, but this other one doesn't.
Maybe that's where the bug come from, and maybe there is a bug
in Gmail that is incorrectly verifying this has passed when it shouldn't be. Now again,
I'm not an expert on this. There could be a reason why it says that the DMARC and
DKIM passed and the exploit was done somewhere else. It just seems weird to me because again,
I thought that was literally the whole point of a DMARC check.
Unfortunately, I was not able to find the actual Google issue tracker page or thread. I guess it's
not on a public one, so I can't keep checking to see if the bug has been fixed or updated or what,
unless the original poster posts that. He might get a notification or something because
he originally made the bug report, but we're just gonna kind of have to assume that well,
hopefully Google is aware of it and they'll fix it as soon as possible.
And again, unfortunately I don't have any more details to give you. I'll put a link
to the Twitter thread in the description, and you can see where he posted the email headers,
and maybe you can do a better analysis than, obviously what I'm capable of doing, just
plugging it into some website. And again, the only thing to do right now is just be extra suspicious
of all emails coming to you, even if it says blue checkmark verified, all that sort of stuff.
If you want to keep watching, I recommend the other video I mentioned talking about,
it's basically the ultimate guide for spotting a spoofed email. And even in that one,
I mentioned how, even if everything checks out,
you still have to be aware that maybe something got hacked, so you always have to be on guard.
Anyway, so I'll put that link right there. Thanks for watching, and I'll see you in the next one.