Google’s Redirect Roulette: Phishing Fun or Security Flub?
Google’s open redirect vulnerabilities are like a revolving door for phishing scammers, offering them a red carpet entry via the google.com/travel/clk endpoint. Despite Google’s claims of “very little practical risk,” these open redirects are a hacker’s dream and a user’s potential nightmare. Time to tighten those redirects, Google!
Hot Take:
Google’s “open” relationship with redirects is causing some serious trust issues. Who knew that Google’s Travel portal could be your next phishing destination? They say love is blind, but when it comes to clicking links, maybe we should all start squinting a little more.
Key Points:
- Google’s /travel/clk endpoint is being exploited for phishing campaigns due to open redirect vulnerabilities.
- The pc tokens used for redirects have an impractically long or infinite lifespan, allowing repeated misuse.
- The redirect mechanism does not validate the target URL, creating opportunities for phishing attacks.
- Google claims these redirects pose “very little practical risk,” focusing instead on user education and detection.
- Recommendations include improved token expiration and validation to curb abuse.
Already a member? Log in here