Slashdot Log In
GoogHOle Exploits GMail, Picasa and 200K Other Sites
Posted by
CmdrTaco
on Mon Sep 24, 2007 09:27 AM
from the hate-when-that-happens dept.
from the hate-when-that-happens dept.
Giorgio Maone writes "Multiple Google-targeted exploits disclosed in the past 3 days could compromise your GMail account, steal your pictures from Picasa or impersonate you on almost 200,000 big sites which outsourced their search engines (vulnerabilities included in the price). If even Google, a very reactive company when web security matters, does face this kind of problems, how serious is the threat and what can you do, as a "normal" web user, to protect yourself?"
Related Stories
[+]
Gmail Vulnerability May Expose User Information 94 comments
An anonymous reader writes "A cross-site scripting vulnerability may mean bad news for Gmail users. The ethical hacking group GNUCitizen has developed a proof-of-concept program that deftly steals contact information and emails from the popular web-based mail service. At the moment there are no 'wild' exploits for this vulnerability. The article discusses how lax security makes holes like this a problem for corporate IT houses as well as Google. '"People do use private accounts to store work information," IBRS security analyst James Turner said. "I've worked at one organization where this was implicitly expected, because the mail server at the time was so unreliable. But that scenario is certainly less than optimal. "In an ideal world, an organization would be able to draw a line in the sand and say that corporate data does not pass this point. The current reality is that there are Gen-Y workers who are sharing information with each other on multiple alternative communication channels--Gmail and Facebook included."'" This, just a few days after a search-based exploit was discovered.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
The real question: (Score:4, Funny)
Re:The real question: (Score:5, Interesting)
If you've read our previous post Say Cheese! then you know that Google's Picasa registers the picasa:// URI in the Windows registry and it is possible to abuse this registered URI through a Cross-Site Scripting exposure to steal a victim's images.
So that's a windows only exploit?
We could not possibly blame that on windows.
Parent
Re: (Score:2, Insightful)
I'd guess not. Picasa on Linux is a Wine application. Wine, of necessity, has a (yechhh) Registry and Windows API calls to tinker with it. So a registry based attack on the Google web site might very well stand about the same chance as any other complex software under Wine on Linux. Might work, might not. Again, that's a guess. Like 99% of the other posts on Slashdot, this one isn't based on actual knowledge or anything like that.
Re:The real question: (Score:4, Insightful)
That has absolutely nothing to do with Windows. It's poor design in a Windows/WINE-only application.
Parent
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
Re:Easy to blame M$ (Score:5, Interesting)
Let's be honest, exploitable applications are OS independent. Though I guess honesty never really comes into it with you, hmm?
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Nothing... (Score:4, Insightful)
Re:Nothing... (Score:4, Insightful)
Well, you can certainly stop using the apps... It's the problem of a user becoming too invested in any one thing (OS, DB, etc.). Whenever you become a pundit, a die-heard fan, or even just a casual, everyday user, you buy the whole package, bugs and all. You not only accept that an app proves useful to you, but that it will contain flaws that may prove problematic. Everyone seems to accept that because it is Google, they write perfect code. No way. The quality of code today is such that flaws such as these are inevitable. This doesn't make Google bad, stupid, or irresponsible; it's just part of the business. They will fix these things and life will go on.
Parent
Re:Nothing... (Score:5, Insightful)
However, anything I accept for free, anything where there isn't some sort of agreed contract between my and the supplier, then caveat emptor (pun intended)
Parent
Re:Nothing... (Score:5, Insightful)
Parent
Flexcar/Zipcar work that way wonderfully! (Score:3, Insightful)
Trust nobody! (Score:5, Insightful)
And if you do it yourself, you can be sure that the security will not be higher than your own skill set.
If you want to trust nobody, you might as well retreat to am isolated island somewhere, as you will be unable to function in a society. The key to functioning in a society isn't distrust, but to to be able to judge who to trust and who not to. Which is quite annoyingly mostly a social rather than a technical skill.
----
I personally trust the people at Google more than I trust the people and products responsible for our internal mail solution (which is also available as web mail). Especially with regards to competence (as opposed to integrity). So I would love for us to switch.
Parent
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
The only thing is that it ends up costing me in ISP price. Most of the net has gravitated toward the position
Not really clear (Score:3, Interesting)
How do I know if I'm vulnerable?
Can I do anything to protect myself?
If you run Firefox, install NoScript plugin (Score:5, Informative)
Parent
Re: (Score:2)
I wonder if these sites will show up in the "warning, this site may be nasty..." messages you sometimes get when browsing to a site via Google search...pretty useless IMHO, 'blacklists' go out of date so fast...
Re:If you run Firefox, install NoScript plugin (Score:5, Interesting)
Since Firefox users like to push forward NoScript a lot as some safety precaution (I run it for 2 months, and finally got fed up with enabling virtually any site I visit, so it operates, what's the point), I read a very interesting article about the embeddable nature of IE.
You see, if Firefox can play WMP files on your machine (Windows machine) then every time you open a page (or video) in Firefox you potentially open IE, since WMP can open pages directly inside, and it uses IE regardless of your preferences.
Similar situation occurs with IM-s like Skype and ICQ.
As another commenter said above, security is illusion. Pure and simple.
Parent
Re: (Score:2)
Is it completely in their hands?
They own the XSS code that has the vulnerability that is being exploited. Even programming that is outsourced is usually wholly owned by the outsourcing parent. To answer your question: yes, it is completely in their hands.
How do I know if I'm vulnerable?
Are you plugged into the interweb? Do you have a Gmail account? Yes and yes? You're vulnerable to this XSS exploit.
Can I do anything to protect myself?
There are no suggestions in TFA or the subsequent articles as to how to protect yourself from this specific exploit. However, there have been a few good recommendations in
Very few details. (Score:5, Interesting)
It would have been nice if they went into some more detail for technical users.
Re: (Score:2)
Well, based on the links that were provided in the many levels of linked blogs (which should have gotten as close to the Russian source as possible rather than the pimped blog listed in the blurb (PAY ATTENTION "EDITORS"), it seems like people have been alerted to this action.
I can't find a single working link in any of the blogs
Re: (Score:2, Informative)
If you need to check your mail or use another of the Google suite, close all other tabs/windows and then sign in. Don't do random browsing at the same time for now.
Re: (Score:2, Interesting)
Seriously, stop watering down the term 'slashvertisment'. It's tossed around enough as it is.
Re: (Score:2)
How to Protect Yourself? (Score:4, Insightful)
Safety is an Illusion (Score:5, Insightful)
You'll never be safe.
Complex software designed for diverse interactions will always be vulnerable to some kind of attack, even if it's as simple as someone walking out of a data center with a thumb drive in their pocket. Almost every vulnerability stems from a "feature" implemented to make software easier/flashier/useful. Flexibility and expansiveness carry with them the price of vulnerability, and pretending otherwise is to wear blinders.
Of course developers should do their best to prevent security problems -- but there is only so much that can be done when you also need to implement Really Cool Stuff. Every door you make is a door than can be kicked in, no matter how good your locks. The real world has never offered perfect security because it can't -- why expect engineered items to be safe from all evil?
Treat software and computers with caution, like walking through a major city's downtown at midnight. Sure, it's dangerous at times -- but it can also be exciting. Just don't pretend that danger doesn't exist...
Call me paranoid... (Score:5, Interesting)
FTFA:
... but I already use a separate SeaMonkey browser profile for my GMail account (don't want it being associated with my normal Google searches), and access untrusted URLs using another browser running under a different user. As a matter of habit (I do web-based stuff and I'm used to having several different browsers open). Probably not 100% foolproof, but helps me sleep easier at night.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
If "they" were really after me specifically, I'm sure they would. It's more a matter of not having all my stuff associated with the same Google cookie.
Re: (Score:2)
you should patent that: STMPD (Score:3, Funny)
which is of course a joke, but is a philosophically sound observation: you can't steal the identity of someone whose identity is fluid
How many work on Linux (Score:2)
Re: (Score:3, Informative)
The answer is in the question... (Score:5, Insightful)
There is no way (unless you're writing something with hundreds, rather than thousands of lines of code) that every code path is going to be audited carefully enough to catch every possible bug. Good coding practices aside, programmers are human and make errors. You do your best to catch as many as you can, and that's all you can do. When you're a "consumer" of code, you look for an organization that seems to be doing this and use their stuff. There's no complete, proactive solution to bugs.
The important thing is that you want someone "very reactive." An organization that acknowledges these flaws up-front, publicly announces vulnerabilities with a work-around until they're patched, and then corrects problems in a timely manner. Some companies are more like this than others.
Re: (Score:3, Insightful)
We like to pretend that the internet is some how this brave new world, but it's still built on a physical infrastructure that exists in the real world, and is designed and maintained by people that live in the real world. In the real world, making something 100% secure is not really feasible, so we just do the b
Dont use hosted services!!! (Score:3, Insightful)
If you're drinking the google-juice just because it's "cool" or you want to support them because they're "not evil", you're only doing yourself a dis-service.
Keep your email local, dont save your passwords on a public "service", dont keep naked pictures of your girlfriend on your "G-Drive", etc etc etc
Common Sense
How is one protected in this case? (Score:2, Insightful)
For such an attack to be successful, the victim just needs to visit a malicious website while logged in Google, e.g. by following a link from an incoming message
This is something that can pretty much be said about any site where you login, and is really nothing new. If you're logged in someplace on one browser/profile, then anywhere you visit can potentially have the same rights as you on this site. With the prevalence of XSS and CSRF vulnerabilities around the internet these days, I don't consider any site "safe". This doesn't mean I suggest going all tinfoil hat, just be aware of what rights you currently have and take measures to protect the data that co
Contradiction? (Score:2, Redundant)
consider a vending machine (Score:5, Interesting)
now consider the number of hacks you can use to exploit a vending machine (granted many are physical hacks, but you could call that analogous to social engineering hacks involving "real" software)
now, if something as simple and as straightforward as a vending machine can be exploited, then the obvious conclusion is that:
we should not express shock that google can be hacked, but we should express shock that any of us expected it couldn't be hacked
any computer program of sufficient complexity will be hacked. not could be. will be
and the internet is well into the zone of "sufficient complexity"
what to do (Score:3, Insightful)
Turn off client side scripting.
OR
echo "127.0.0.1 google.com" >> etc/hosts
When I first started in web development it was hammered into us that client side scripting MUST degrade gracefully. What ever happened to that rule?
I hate sites locked to "Web2.0" only! For the most part I will not use them. There are only a handful of URL's in my scripting white list, most of them my own sites.
Yes, I use some client scripting, but it degrades properly.
Keep Your Own Secrets (Score:5, Insightful)
The Web would be a lot more secure if my browser had a keyring integrated with my own computer, and I kept my secrets on my own computer under my own control. When challenged by any server for a secret, my browser or other client SW I'm using should pull the secret from the keyring and supply it to the server. That service should let me use a master key from any remote terminal to query my own computer, over my home broadband or wherever I keep the secrets. All by a standard protocol that lets me just fill web forms (and other challenges) as I do now, possibly entering the master key and maybe an additional confirmation challenge to let the 3rd parties communicate, but otherwise just as transparent as just filling in the forms.
If a 3rd party server is going to store my secrets, I want it to be my bank. I don't know why banks haven't gotten into this business already, after well over a decade watching their profits multiply from the Web, along with many risks. Maybe Google will push a key distribution protocol like this in partnership with some banks. That would also finally get Google into the payment business to challenge eBay's PayPal, which I hate precisely because its (mostly unregulated) global Internet bank is a monopoly, and I don't trust PayPal with my secrets. If Google does recover from this crack, they might be solid enough to trust.
Replace 'Google' with 'Microsoft' (Score:4, Insightful)
You know that there is some truth in what I say.
It looks to me that there are major holes in Google's services, and they need to be called out on it, not given excuses.
So what about their web office suite (Score:4, Interesting)
"very *re*active"? (Score:3, Insightful)