August 26, 2020 By Bradley Barth
Google has mitigated a validation flaw in its G Suite and Gmail offerings that could allow malicious emails to bypass even the strictest of SPF and DMARC protections, but the company has not fixed another validation vulnerability in Google Drive that could result in users downloading malware.
Discovered by researcher Allison Husain last April 1, the G Suite/Gmail flaw was found to be the result of a missing verification process during the configuration of mail routes.
DMARC vulnerabilities such as this are a significant find because without them malicious actors can send emails from a spoofed address to make it look like they came from a legitimate co-worker, boss or business partner. U.S. government entities in particular have been strong adopters of DMARC – with roughly three-fourths of U.S. federal domains safeguarded by DMARC enforcement, according to a recent report from Valimail.