Gmail Security Flaw Proof of Concept

[HURST]

Is it possible for someone to create a malicious filter without having access to your Gmail username and password? No, however, they can force you to create the filter without your knowledge.

The blogosphere is buzzing about a Gmail Security Flaw that has caused some people to lose their domain names registered through GoDaddy.

http://geekcondition.com/2008/11/23/...of-of-concept/

[ronjor]

Google Says Reports of Gmail Flaw Unfounded

A posting on GeekCondition.com Nov. 23 warned of a flaw allowing attackers to force Gmail users to create a malicious message filter without their knowledge. As a result, the post said, attackers could hijack messages sent to a victim's Gmail account by redirecting messages into the trash and forwarding copies to the attacker.

Google, however, explained that the source of the problem was not a flaw in Gmail, but a phishing scheme in which attackers sought to lure Web domain owners to rogue sites so their information could be stolen.

Article