Google confirms scammers’ use of the Gmail “Checkmark”

Share post:

Google’s Gmail checkmark system, which uses a blue checkmark to help users identify recognized corporations and organizations, is reportedly being utilized by fraudsters to trick users and undermine its original purpose.

The weakness was discovered by cybersecurity engineer Chris Plummer, who demonstrated that scammers had discovered a technique to mislead Gmail into recognizing their bogus brands as authentic, undermining the trust that the checkmark system was intended to inspire.

Google first ignored Plummer’s findings before admitting their error and taking the situation seriously. They told Plummer that they were actively examining the problem and that it was their top priority to resolve.

Later, Google apologized for dismissing Plummer’s conclusions and reopened the probe by appointing a team to undertake a thorough review. They praised Plummer for his persistence and vowed to keep the general public aware of their findings and the efforts they were taking to remedy the problem.

Jonathan Rudenberg, a debugger, also uncovered a vulnerability in Gmail’s BIMI implementation, known as Gmail Checkmark. He discovered that Gmail merely checks the SPF (Sender Policy Framework), enabling the DKIM (DomainKeys Identified Mail) signature to come from any domain. This implies that a shared or incorrectly configured mail server on a BIMI-enabled domain can be used to send bogus emails to Gmail with the full BIMI treatment. Rudenberg went on to say that BIMI weakens email security by allowing phishing attacks with just one email system misconfiguration.

The sources for this piece include an article in Forbes.


Related articles

Apple faces backlash over recent ads

Apple is currently facing significant public backlash due to a controversial advertisement featuring a hydraulic press crushing various...

 Google executives face employee concerns amid profitsurge

At a recent all-hands meeting, Google employees voiced significant concerns regarding morale, cost-cutting measures, and the impact of...

Spotify CEO confesses to “rough times after layoffs” – stock price rises

In December, Spotify CEO Daniel Ek announced the largest round of layoffs in the company's history, cutting 1,500...

Zuckerberg shares his vision with investors and Meta stock tanks

In an era where instant gratification is often the norm, Meta CEO Mark Zuckerberg’s strategic pivot towards long-term,...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways