Hello and welcome to the Sands and at Storm Center's Stormcast. My name is Johannes Ulrich,

and this episode brought you by the Graduate Certificate Program in Incident Response is today recorded in Jacksonville, Florida.

In today's diary, Jan is writing about how Google is aiding fishing attacks by providing open redirects.

Now, these open redirects aren't provided intentionally, but more or less accidentally.

In this particular case, the problem stems from links that Google offers from its maps pages to the hotel websites

that are linked from the maps. This link actually at first looks kind of like they're doing

the right thing. There are two parameters to the URL. There is a token and then the actual URL. Now, what often happens in

these kind of cases is where the token provides some kind of cryptographic assurance that

the URL is actually the URL that you will like to direct to. However, in this case, the token appears to be more encoding where the link came

from and who may have clicked on it. So once you have a valid token, doesn't matter which one

it is, you just may append any URL, doesn't even have to be a valid hotel link to the URL here.

And then, well, the victim will be redirected initially believing that they went to Google.

And that's sort of really where the problem with open redirects comes in, that open redirects essentially borrow the trust that people do have

in websites like Google. So they're clicking on a link to Google but are then immediately being

redirected to a phishing page that may even attempt to impersonate Google in some cases.

Google's response to this is, well, that they don't really see this as a problem.

Well, people just shouldn't trust Google.

And if you don't trust Google, then there is no trust to steal.

And this attack should fail.

I think that's solid advice.

Don't trust Google.

And that's probably the best defense you have at this point

...