Hacker News Reader

Comment by Sephr | Hacker News Reader

You think that's bad? There's a Google Inbox and Gmail spoofing vulnerability which has been disclosed for over a year, and it's still not fixed.

Vulnerability details: https://eligrey.com/blog/google-inbox-spoofing-vulnerability...

Screenshot: https://go.eligrey.com/t/screenshots/google-inbox-spoofing-o...

PoC demo (open on Android using Google Inbox or Gmail): https://dangerous.link/gmail-and-inbox-spoofing-on-android

View on HN

Clicking this PoC link on iOS shows that the iOS Mail app suffers the same UI vulnerability. It appears like you are emailing support@paypal.com, when you are not.

Same for K9 Mail in Android. Clicking on the mail address reveals the real Destination though.

I'm shocked this hasn't been resolved in mobile yet. I opened it up on my phone, and heck, with a pretty HTML form emulation in the email you could really have a very effective phishing campaign.

> ... and it's still not fixed

It was fixed in May: https://www.xda-developers.com/google-fixes-flaw-spoof-inbox...

It was only fixed in the webapp. As you can see with the PoC demo link, this is still unfixed in the Inbox app for Android.

Thanks for clarifying. I should've been able to deduced that it was only fixed in the webapp from the "open on Android using Google Inbox or Gmail" part of your comment. I'm sorry.

Fun fact: the poc doesn’t “work” on iOS if you uninstalled the Mail app and are using a 3rd party client (link triggers App Store prompt “do you want to install mail”) ;)

Reply on news.ycombinator.com