Google competently combats a crisis

Yesterday afternoon, a new, clever, insidious phishing attack befell Google. Not only did it infect Google, it spread both crazy fast and crazy wide. It was specifically targeted at Google Docs/Gmail users, and it was beyond well disguised: all it took was a couple of clicks (on a legit-looking, Google-hosted URL — how’s that for data?). The target of the attack? It gave the attacker the ability to read all of your Gmail, followed immediately by forwarding the phishing attack to everyone you’ve ever emailed. Ever.

The attack started with an email you receive, and it’s from someone who’s emailed you before. The contents of the email? A Google Docs share link. You clicked the URL to open the document, and you’d see a seemingly innocuous page that’s hosted by Google itself. The page doesn’t ask for a password or a password reset; it already listed all your Google accounts, even. All the page was asking you to do was give a “Google Docs” app permission to read your email and contacts.

What’s so insidious about that you may ask?

That “Google Docs” app wasn’t Google Docs at all — it was just an app somehow masquerading as it.

Many of us in the tech community are appropriately skeptical when we get emails from accounts we don’t recognize, or ask us to reset passwords, etc., except this attack checked a lot of the correct boxes. If you happened to fall for it and clicked the “allow” button, the attacker immediately gained full inbox access, plus, to top everything off, you were now forwarding the bait to every single person on your contact list.

Gross.

So what can you learn from this unfortunate situation?

How to handle a crisis competently.

Within hours of the phishing attack surfacing, Google was all over it. Some enterprises reported Google automatically redirecting these emails to SPAM folders. The attack was admitted and publicized widely from both Google and through the media. Instead of trying to hide the issue or sweep it under the rug, Google admitted what was happening, reacted, responded and neutralized the threat. By getting on top of the issue early, making sure people know about it so they can take appropriate countermeasures, afforded Google credibility and trust. Being open and honest, paired with lightning fast reaction time, allowed Google and Gmail to weather this storm largely unscathed. They put in stop-gap measures to plug the hole as quickly as possible, followed by a wholesale solution implementation shortly thereafter. Stop the bleeding, close the wound, suture it up nice and tidy.

This is a great example of how to competently handle a crisis; we would all do well to heed said example.

 



Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

19 − twelve =

Jeff Francis

Jeff Francis is a veteran entrepreneur and founder of Dallas-based digital product studio ENO8. Jeff founded ENO8 to empower companies of all sizes to design, develop and deliver innovative, impactful digital products. With more than 18 years working with early-stage startups, Jeff has a passion for creating and growing new businesses from the ground up, and has honed a unique ability to assist companies with aligning their technology product initiatives with real business outcomes.

Get In The Know

Sign up for power-packed emails to get critical insights into why software fails and how you can succeed!

EXPERTISE, ENTHUSIASM & ENO8: AT YOUR SERVICE

Whether you have your ducks in a row or just an idea, we’ll help you create software your customers will Love.

LET'S TALK

When Will Your Software Need to Be Rebuilt?

When the software starts hobbling and engineers are spending more time fixing bugs than making improvements, you may find yourself asking, “Is it time to rebuild our software?” Take this quiz to find out if and when to rebuild.

 

is it time to rebuild our software?