Listen Top Shows Blog

Google Event Injection - Tradecraft Security Weekly 20

Google Event Injection - Tradecraft Security Weekly 20

Update: 2017-11-03

Share

Description

Google provides the ability to automatically add events to a calendar directly from emails received by Gmail. This provides a unique situation for phishing attempts as most users haven't been trained to watch their calendar events for social engineering attempts. In this episode Beau Bullock (@dafthack) and Michael Felch (@ustayready) show how to inject events into a targets calendar using MailSniper bypassing some security controls that Google has in place.

Links:
Blog Post: https://www.blackhillsinfosec.com/google-calendar-event-injection-mailsniper/

Comments

In Channel

Black Hat & DEF CON 2018 - Tradecraft Security Weekly #28

Black Hat & DEF CON 2018 - Tradecraft Security Weekly #28

2018-08-2114:20

Phishing 2FA Tokens with CredSniper - Tradecraft Security Weekly #25

Phishing 2FA Tokens with CredSniper - Tradecraft Security Weekly #25

2018-04-1319:06

Evading Network-Based Detection Mechanisms - Tradecraft Security Weekly #24

Evading Network-Based Detection Mechanisms - Tradecraft Security Weekly #24

2018-03-2919:41

HTML5 Storage Exfil via XSS - Tradecraft Security Weekly #23

HTML5 Storage Exfil via XSS - Tradecraft Security Weekly #23

2018-01-1214:31

Leaking Windows Creds Externally Via MS Office - Tradecraft Security Weekly #21

Leaking Windows Creds Externally Via MS Office - Tradecraft Security Weekly #21

2017-12-0112:56

Google Event Injection - Tradecraft Security Weekly 20

Google Event Injection - Tradecraft Security Weekly 20

2017-11-0313:12

Domain Fronting - Tradecraft Security Weekly #18

Domain Fronting - Tradecraft Security Weekly #18

2017-09-0815:33

Cracking Password Hashes Efficiently - Tradecraft Security Weekly #17

Cracking Password Hashes Efficiently - Tradecraft Security Weekly #17

2017-09-0116:00

Automating Screenshots to Quickly Assess Many WebApps - Tradecraft Security Weekly #12

Automating Screenshots to Quickly Assess Many WebApps - Tradecraft Security Weekly #12

2017-07-2609:29

Situational Awareness with HostRecon - Tradecraft Security Weekly #7

Situational Awareness with HostRecon - Tradecraft Security Weekly #7

2017-06-2111:00

Windows Privilege Escalation Techniques - Tradecraft Security Weekly #2

Windows Privilege Escalation Techniques - Tradecraft Security Weekly #2

2017-06-0511:11

Meterpreter with Categorized Domains & Trusted Certs - Tradecraft Security Weekly #4

Meterpreter with Categorized Domains & Trusted Certs - Tradecraft Security Weekly #4

2017-05-3112:06

Attacking Exchange/OWA to Gain Access to AD Accounts - Tradecraft Security Weekly #3

Attacking Exchange/OWA to Gain Access to AD Accounts - Tradecraft Security Weekly #3

2017-05-2412:39

Public File Metadata Analysis - Tradecraft Security Weekly #1

Public File Metadata Analysis - Tradecraft Security Weekly #1

2017-05-1811:18

00:00

00:00

x

Google Event Injection - Tradecraft Security Weekly 20

Google Event Injection - Tradecraft Security Weekly 20