Let’s analyze the attack scenario:

• The victim registers his mobile phone number with Gmail so that if he forgets his password Google will send him via SMS a verification code that allows him to access his account.
• The attacker just knows the victim’s email address and phone number, he visits the Gmail login page and enters a victim’s email address and then clicks on the “Need help?” link. This link is used by Gmail users when they have forgotten their login credentials.
• The users have several options to retrieve their forgotten credentials including “Enter the last password you remember” and “Confirm password reset on my [MAKE AND MODEL] phone.” The attacker can choose “Get a verification code on my phone: [MOBILE PHONE NUMBER].”
• An SMS message including a six-digit verification code is sent to the victim.
• The victim receives a message saying “Your Google Verification code is [SIX-DIGIT CODE].”
• The attacker then sends the victim an SMS message saying something like “Google has detected unusual activity on your account. Please respond with the code sent to your mobile device to stop unauthorized activity.”
• The victim believing that the message is coming from Google legitimate password restore service replies with the verification code to the attacker number.
• The attacker then uses the code to get a temporary password and gain access to the victim’s email account.Experts at Symantec highlight that legitimate password recovery messages never ask users to reply to the SMS text.

“Legitimate messages from password recovery services will only tell you the verification code and will not ask you to respond in any way.” explains Symantec.

Since the password recovery process is almost similar to several mail services, this new password recovery scam could be used to hack into a number of popular webmail services including Gmail, Yahoo, and Outlook.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs –  cybercrime, password recovery scam)