Phishing for Google Checkout Dollars?
|
Hackers have stepped up their attack on Google's sites, this time targeting Gmail. Websense Security Labs reported Monday that phishing attacks against Google have increased in sophistication. In the latest attacks, users are shown a spoofed copy of the Gmail log-in page with a message claiming, "You WON $500.00!" The page tells the reader that the money will be delivered to an e-Gold, PayPal, StormPay or MoneyBookers account of his or her choice. However, the reader must sign up for "Gmail Games" first and pay an $8.60 entrance fee. The reader is then directed to an actual payment site located in the United States, according to Websense. While phishing attacks using Google sites are not new, the stakes for these attacks have been raised since Google launched its online payment processing service, Google Checkout. If a Gmail account is compromised, hackers could have access to that user's Google Checkout account. Websense Security Labs also recently figured out a way to use the freely available Google API to find dangerous .exe files on Web servers around the world. |
Create, Communicate, Collaborate with IT Professionals at Ziff Davis Enterprise IT Link
Comments (3)
My VISA was hit with thousands of dollars in authorized charges this week. All charges were from Google Adworks (which I am not a member of and had never heard of). Nor had I ever heard of Google Checkout. I think eBay was right on in banning Checkout for its customers, citing fraud concerns. In only two weeks with Checkout, the fraud has begun. How is it that a person could use my credit card number and set up an account with Google to buy/sell and have it work? Does Google do NO verification of identify in any way? Did the fact my billing address and whatever shipping address the criminal used are different not raise an eyebrow at Google? Amazing.
Posted by Patrick Donnelly | July 14, 2006 5:18 PM
Thanks for the add? A researcher has exploited a security hole in Google Public Service Search to create an ingeniously deceptive phishing attack that looks like it's hosted on Google's domain.
Posted by Google Watch | September 15, 2006 10:16 AM
Thanks for the add? A researcher has exploited a security hole in Google Public Service Search to create an ingeniously deceptive phishing attack that looks like it's hosted on Google's domain.
Posted by Google Watch | September 15, 2006 10:22 AM