Skip to main content

Scammers can bypass your Google Workspace Safety Checks

A major source of headache for system administrators these days, and has been for some time, is the uptick in phishing messages that fake the sender address so it appears to be from someone within your organization. If you are like me, this is one of the things that keeps you awake at night. Organizations using Google Workspace can take advantage of a safety feature that purports to prevent this from reaching users. You can access its settings from within the admin console under Apps->Gmail->Settings->Safety.




Unfortunately, there are still a ton of legit e-mail servers that don't authenticate, so that safety feature is not going to be very helpful.  However you can enable the checks that detect someone trying to send a message with an employee's e-mail address, your domain (or a variation on it) or even an employee's name.  These are very common attacks, and such checks regularly prevent nefarious messages from reaching our end users.  

The problem is, due to a poorly-planned filter architecture on Google's part, this whole mechanism can be bypassed, allowing a spoofed message to end up in a spam queue that is managed by an end-user.  

Google Workspace Filter Architecture places spam filters and queues ahead of "safety features" such as spoof checks.

As you can see in the diagram above, the spoof checks are effectively circumvented when they are sent to a group.  A moderator will see the message in the group's spam queue, AKA "Pending messages".  If they approve the message, it will then go through the safety checks, but by then the group manager has already seen it, and may act on it.

Comments

Post a Comment

Popular posts from this blog

Reaper, Linux, and the Behringer X-Air - Complete Studio Solution, Part 1

Introduction and Rationale This is part one of a major effort to document my experiences with recreating my home studio, entirely using Linux.  Without getting into too many of the specifics, a few months ago I decided that I was unhappy with Windows' shenanigans - to the point that I was ready to make a serious attempt to leave it behind.  For most in this situation, the obvious choice is to switch to Mac OS.  With its proven track record, support, and options for multimedia production, it is naturally the first alternative to consider if your goal is to simply use something other than Windows. For me the choice was not so simple. I despise Mac OS and, in general, the goals and philosophies put forth by Apple in an effort to ostensibly provide users with an "easy" working environment.  It does not help that I have also failed to find any aspect of the Mac OS UI intuitive, but I realize that this is a subjective matter. With my IT background and user-control* favori
Post a Comment
Read more

Timbaland rips off a Demoscene artist

I knew this day would come. The new Timbaland/Nelly Furtado song "Do It" uses a song made in 2000 by Finnish demoscene artist "Tempest" (Janne Suni). It's a 4 channel .mod (the ripoff is from a playback using the C64 SID soundchip). The song was hosted on scene.org's servers (the main repository for all everyones demos and tracked music, etc.). As you might expect, no permission or royalties were paid to Tempest. Just to clarify, we're not talking about some kind of coincidence here. There is no question that this track was used to create the song "Do It". In an interview, Timbaland tries to downplay it, saying things like "he sampled it from a video game". (This track was not written for a video game- it was actually written for the 2000 demoscene music competition, in which it won 1st place). Regardless, he basically claims he has no legal obligations because it's just like all the other pop artists that sample other m
1 comment
Read more

The Hellscape that is Google’s Web in 2023

Alternate title: "were we better off in 2015 2007?" Time now for another anti-capitalist, “get off my lawn” posting for all the folks out there who won’t see it anyway, because they don’t read real blogs for the reasons specified in this very article. The web has existed for 30 years now. One would think our ability to access information on it would keep getting better. However, I watch as web search is instead devolving every year, to the point where people are giving up and hoping for the next thing.  While this sounds dire, this kind of behavioral change has historical precedent. Remember running your own mail or web server, or better yet, having a phone that you might actually answer calls to, even if you don’t recognize the caller’s number?  Yes, those ideas are gone too. It's all thanks to the uncontrolled thirst for advertising. Let’s walk through the experience of someone doing a simple Google search for “how to control poison ivy”.  The desired outcome would be
1 comment
Read more