Qiyu chen, Xiaomin Dong, Chenhui Lai, Xinteng Chen, Vittorio DiPentino Google Mail Hack Qiyu chen, Xiaomin Dong, Chenhui Lai, Xinteng Chen, Vittorio DiPentino

What Happened? Phishing Scam Sharing a Google Doc by trusted accounts to gain permission to access. 1 million users were affected Google stop the scam in one hour http://www.independent.co.uk/life-style/gadgets-and- tech/google-phishing-emails-attack-gmail-scam-link- doc-invitation-hack-a7716581.html https://www.identityforce.com/blog/2017-data- breaches https://www.cnbc.com/2017/05/04/gmail-google- hack-phishing-attack.html

Impact on Google (Risk) Hackers attack Gmail accounts Disclosure of personal information It also affects businesses that use Google’s email service The worm through email arrived user’s inbox The worm also sent itself out to all of the affected users' contacts Cause million users suffered serious damage Potential disaster Hackers can collect data from users’ contacts and change their password on other accounts Manipulate Google's real login system Hackers attack Gmail accounts Disclosure of personal information It also affects businesses that use Google’s email service The worm through email arrived user’s inbox The worm also sent itself out to all of the affected users' contacts Cause million users suffered serious damage Potential disaster Hackers can take over the user's Amazon, Facebook, or online bank account by collecting any personal data that the user has ever sent or received by e-mailing them and having them reset their password on other service accounts. Some malicious mail from users’ known email, manipulate Google's real login system

Root Cause Tricked the user into granting permissions to a third-party application No security alert from Google Weak security awareness of users

Missing Controls Awareness Cyber-intelligence Services Understand what is at risk Recognize suspicious activity Cyber-intelligence Services Used to identify on-line threats and misrepresentations See an influx in email traffic

Recommendation 1. Be cautious of any app asking for access to your information 2. The importance of immediate response 3. Be vigilant, and when in doubt, don’t click 1. There are a TON of websites and apps out there that ask for your information. What was notable about the Google attack was that it gained access to your information indirectly through a legitimate, trusted service. This is possible because companies like Google, Facebook, Twitter and Microsoft all work with 3rd party websites and app providers. Have you ever downloaded an app that says: “Sign in with Facebook” or “Sign in with Google”? By using those options, you’re allowing Facebook or Google to share certain information about you with another service, without giving away your password. Most of the time, this is a really convenient service, allowing you to access many websites without separate login credentials. The problem is that it has become so commonplace that we don’t always think before clicking “Allow.” The Google attack is a good reminder to be cautious of these types of 3rd party requests, because copycats will certainly try the same trick. 2. Despite how fast the attack spread, Google minimized the damage by responding immediately. If you look at this report from a Reddit user, you can see how quickly a Google employee jumped on the thread and elevated the issue to the appropriate team. The threat was resolved in less than an hour, and only .1% of Google’s users were affected. Other businesses should learn from this example. Not only did Google’s team have the technical expertise to stop the threat, but they were accessible and even actively listening to their users. Businesses need to have a plan in place so they know how to respond in the event of a cyber attack. Additionally, they need to have a reliable IT resource who they can reach immediately and who they can rely on to solve the issue quickly and effectively. 3. Hackers and cyber criminals are always coming up with new ways to try to compromise your information. We share a lot of information with companies like Google, and while their teams are doing their best to protect that information, they can’t catch everything. Ultimately, it’s still up to you to pay attention and avoid putting your personal or business information in danger. If there’s ever any doubt about a link or you’re not SURE you can trust a sender, don’t click. Better yet, report anything that looks suspicious. Even an email from someone you know may not be safe – it’s better to pick up the phone and verify it than take the risk. Phishing attacks often rely on people clicking without thinking, so be careful what you click!