Inside Google’s Global Campaign to Shut Down Phishing

[FreddyFreeloader]

AT THE BEGINNING of May, a phishing scam flooded the web, disguised as a typical Google Docs request. Some of the emails even appeared to come from acquaintances. If victims clicked through and granted seemingly innocuous permissions, they exposed their entire Gmail account to whoever was behind the scam. It was an explosive scheme. And Google responded in kind.

“We convened what we call a war room,” says Mark Risher, Google’s director of counter-abuse technology. “Basically we pulled people together in a physical room here in Mountain View, California, and we also had experts from many other offices around the company that quickly came together. Each specialty gets called in.”

MORE GOOGLE SECURITY

• 

Unfortunately, that sort of crisis response is all too common for Google. Its massive user base and footprint on the web make its services and customers prominent targets for every imaginable phishing attack, not to mention all the other manner of hacks and assaults. But phishing presents an especially tricky problem. Campaigns are hard to spot by design, and also evolve rapidly.

“The bad guys try hard, so we are motivated to try even harder,” says Sri Somanchi, a project manager in the Gmail anti-abuse team. “We keep going because we know that any little slip up on our side is going to have a huge cost for users.”

That response can take many forms. And if they’re doing their job right, you barely even notice.

Phish Fry

More: Inside Google’s Global Campaign to Shut Down Phishing

 

[Malware Person]

at least Google is trying to stop phishing.