“Last month, we were able to report a vulnerability to Google where we were able to  email from any domain that has not been claimed by its owner previously. For example, using google itself as a victim, we were able to claim domains such as ytimg.com and gstatic.com.” states a blog post from published by the researchers.

The account could be used only after that Google has verified the domain though the “Verify domain ownership” process:

“Before your organization can use Google services like Gmail with your company’s domain, you’ll need to verify that you own it. This ensures that no one else can use services or send email that appears to come from your company.” states Google

The two researchers explained to the The Hacker News that there is a page on Google apps that allows domain administrator to send ‘Sign in Instructions’ to the company users i.e. info@mynewco.com (must be created from panel before proceeding) by simply accessing following URL:

https://admin.google.com/EmailLoginInstructions?userEmail=info@mynewco.com

By using the online email editor, an attacker could send any kind of phishing email containing malicious links to the target users. The technique could be effective to steal sensitive information including web service credentials.

In the example provided by the colleagues at TheHackerNews, before the vulnerability was fixed, the researchers obtained [email protected] and sent an email to the victim, reporting the following subject:

Welcome to Twitter, which can convince users into submitting their Twitter credentials to the given phishing pages.

After the duo reported the flaw in Google Apps for Work to Google, the company immediately patched it, anyway the experts explained that the fix is just partial. According to the two researchers, in fact, the attacker is still able to access ‘Send Sign in Instructions’ for unverified domains, but this time via [email protected], instead of the custom email address.

“However you can still claim any domain and have access to the admin console through out the “validation process” and that is by design.” continues the post.

This means that victims will receive email from apps-noreply, but evidently the measure is not satisfactory.

“Google believes that showing the sender as apps-noreply is good enough.”  Behrouz told The Hacker News,

It’s clear that by abusing of this Google Apps vulnerability, phishers could send phishing emails avoiding Google detection because the mail is sent by the servers of the company.

Pierluigi Paganini

(Security Affairs –  Google Apps vulnerability, Google Apps for Work)