Gmail accounts hacked via unpatched hole

axial · Apr 24, 2009

http://windowssecrets.com/comp/090423#story1

Exploits allowing hackers to break into Gmail accounts are likely to occur, if they're not already circulating, after security researchers released details of a hole that Google has reportedly declined to patch.

There are steps you can take to reduce the risk of using a webmail account, but it appears that the usual tricks won't solve the Gmail problem until Google fixes the software.

The weakness that researchers say afflicts Gmail, a free e-mail service hosted by Google, belongs to a class of attacks known as cross-site request forgery (CSRF, pronounced "sea surf").
Click to expand...

Rmus · Apr 24, 2009

It appears that some social engineering comes into play:

Proof of concept released for Google Gmail CSRF flaw
http://www.securecomputing.net.au/News/138947,proof-of-concept-released-for-google-gmail-csrf-flaw.aspx

The PoC shows that an attacker can exploit this flaw by creating a specially designed malicious webpage that accepts requests from Gmail's “change password” functionality. The attacker then sends an email to the victim's Gmail account, potentially luring the user to this malicious page via social engineering.
Click to expand...

OAuth Security Advisory
http://oauth.net/advisories/2009-1

Details

The attack starts with the attacker visiting the (honest) Consumer site, optionally logging into an account he owns at that site. The attacker initiates the OAuth authorization process but rather than follow the redirect from the Consumer to obtain authorization, the attacker instead saves the authorization request URI (which includes the Request Token). Later, the attacker convinces a victim to click on a link consisting of the authorization request URI to approve access to the victim's Protected Resources to the (honest) Consumer.
Click to expand...

----
rich

RejZoR · Apr 25, 2009

The reason why i use nothing but HTTPS secure connection for my GMail (and any settings within Google features/settings).
If it doesn't connect in a secure way, i'm not going to use it until it does.

SystemJunkie · Apr 25, 2009

Google is like a big security hole that is also the reason why several proxy providers generally block google.

Fact is at the point you connect you are exposed to security risks and all-seeing-eye,
nowadays there is no possibility to really avoid this and this is wanted by governments.

HTTPs is one chance to avoid control of secret services and internet mafia but insufficient because you would need enduring encrypted lanes from point a to point b. Too much is intercepted and smuggled between a and b or between your browser and a usual webside like google. They simply attach their virus traffic usually you won´t see that until you take a look.

axial · Apr 25, 2009

SystemJunkie and RejZoR, apologies if I'm not understanding you, but could you confirm that you're both making the distinction between use of Google as a search engine vs. Google's GMail?

Log in or Sign up

Gmail accounts hacked via unpatched hole

axial Registered Member

Rmus Exploit Analyst

RejZoR Lurker

SystemJunkie Resident Conspiracy Theorist

axial Registered Member

Log in or Sign up

Gmail accounts hacked via unpatched hole

axial Registered Member

Rmus Exploit Analyst

RejZoR Lurker

SystemJunkie Resident Conspiracy Theorist

axial Registered Member

Useful Searches