Bug in Gmail app for Android Allows anyone to Send Spoofed Emails

A security researcher has discovered an interesting loophole in Gmail Android app that lets anyone send an email that looks like it was sent by someone else, potentially opening doors for Phishers.

This is something that we call E-mail Spoofing – the forgery of an e-mail header so that the email appears to have originated from someone other than the actual source.

Generally, to spoof email addresses, an attacker needs:

• A working SMTP (Simple Mail Transfer Protocol) server to send email
• A Mailing Software

However, an independent security researcher, Yan Zhu, discovered a similar bug in official Gmail Android app that allowed her to hide her real email address and change her display name in the account settings so that the receiver will not be able to know the actual sender.

How to Send Spoofed Emails via Gmail Android App?

To demonstrate her finding, Zhu sent an email to someone by changing her display name to yan ""security@google.com" (with an additional quote). You can see the below screenshot posted by Zhu on her Twitter timeline.

"[This] extra quotes [in the display name] triggers a parsing bug in the Gmail app, which causes the real email to be invisible," Zhu told Motherboard.

Once received, the email address could trick the receiver into believing that the mail has arrived from a legitimate Gmail security team, which is not.

Google – 'The Bug isn't a Security Vulnerability'

Zhu reported the loophole to Google's Security team at the end of October, but the team disapproved her bug report, saying the bug is not a security vulnerability.

"Thanks for your note, we do not consider this [bug] to be a security vulnerability," a Google Security Team member told Zhu.

"Filed a Gmail Android bug that lets me fake sender email address. [Google] said it's not a security issue. ¯\_(ツ)_/¯." Zhu tweeted.

Email spoofing can be used legitimately, but because spoofing an email address is surprisingly easy, spammers and phishers take advantage of it to harm people or organisation.

Here's How to Protect Yourself from Spoofed Emails

So, if you want to protect yourself from spoof messages, you can follow the given couple of things:

• Turn on your Spam Filters – Almost every email service offers spam filters and junk boxes that dump spoof emails to your junk mail.
• Learn to Read Email message headers, and Trace IP addresses – Tracking down the source of spam is a good practice. When you receive a suspicious email, open the header, and see if the IP address of the sender matches up with previous emails from the same person.
• Never Click on a Suspicious Link or Download an Unfamiliar Attachment – Always pay attention to the emails you receive and avoid clicking links in email or downloading email attachments. Go to your bank's official website, or other websites directly from the browser and log into your account to find what they want you to see.
• Keep your PC's Antimalware Up-to-Date.