Gmail 'vulnerability' a phishing scam instead

Reports that a purported Gmail vulnerability was being used by unauthorised third parties to hijack domains turned out to be nothing more than a phishing scam, Google announced Tuesday.

The alleged vulnerability reportedly allowed an attacker to set up filters on users' email accounts without their knowledge, according to a proof of concept posted Sunday at the blog Geek Condition. In the post, Geek Condition's "Brandon" wrote that the vulnerability had caused some people to lose their domain names registered through GoDaddy.com.

However, after consulting with those who claimed to be affected by the so-called vulnerability, Google determined they were victims of a phishing scam.

Google information security engineer Chris Evans wrote in a blog: "Attackers sent customised emails encouraging web domain owners to visit fraudulent websites such as 'google-hosts.com' that they set up purely to harvest usernames and passwords. These fake sites had no affiliation with Google and the ones we've seen are now offline. Once attackers gained the user credentials, they were free to modify the affected accounts as they desired."

A Google representative said the company was trying to contact "Brandon" to get more information on his claim but there was no word whether that blogger helped Google arrive at its conclusion. At the time of writing, the blog has not been updated to mention Google's finding.

While this security breach was apparently unrelated to Gmail's operation, Google reminded users to enter Gmail sign-in credentials only at web addresses starting with "https://www.google.com/accounts", and not to ignore warnings their browsers may raise regarding certificates.

Original article: Gmail 'vulnerability' turns out to be phishing scam from CNET News.com