Slashdot Log In
Gmail Vulnerability May Expose User Information
Posted by
Zonk
on Thu Sep 27, 2007 12:23 PM
from the that's-not-so-good dept.
from the that's-not-so-good dept.
An anonymous reader writes "A cross-site scripting vulnerability may mean bad news for Gmail users. The ethical hacking group GNUCitizen has developed a proof-of-concept program that deftly steals contact information and emails from the popular web-based mail service. At the moment there are no 'wild' exploits for this vulnerability. The article discusses how lax security makes holes like this a problem for corporate IT houses as well as Google. '"People do use private accounts to store work information," IBRS security analyst James Turner said. "I've worked at one organization where this was implicitly expected, because the mail server at the time was so unreliable. But that scenario is certainly less than optimal. "In an ideal world, an organization would be able to draw a line in the sand and say that corporate data does not pass this point. The current reality is that there are Gen-Y workers who are sharing information with each other on multiple alternative communication channels--Gmail and Facebook included."'" This, just a few days after a search-based exploit was discovered.
Related Stories
[+]
GoogHOle Exploits GMail, Picasa and 200K Other Sites 167 comments
Giorgio Maone writes "Multiple Google-targeted exploits disclosed in the past 3 days could compromise your GMail account, steal your pictures from Picasa or impersonate you on almost 200,000 big sites which outsourced their search engines (vulnerabilities included in the price). If even Google, a very reactive company when web security matters, does face this kind of problems, how serious is the threat and what can you do, as a "normal" web user, to protect yourself?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Encrypt it (Score:3, Funny)
Re: (Score:3, Insightful)
A simpler approach would be to have the UN put out a resolution asking everyone to be nice.
Oh, and another resolution asking people not to send spam, pretty please, would also be helpful.
Online apps (Score:5, Insightful)
Online apps are only going to get more and more popular. Webmail is like the gateway drug of internet apps. It starts off innocently enough. Going from an in house email system that is only intranet. Then you need to give employees the ability to send outside email, no problem, but your servers can still filter out attachments both ways and give the company a security and intellectual property barrier. Then the online apps start looking appealing, no maintenance, no servers, just internet access. A lot of cost savings for the company. What could go wrong? Then Microsoft and the other big players start talking about making Office an online application and hyping the benifits of such a new age system. The benifits are described in beautiful powerpoint presentations to the execs and the IT departments warnings are just plain text. What's going to happen to the companies that fall for this new online paradigm? I think more of the same. Information leaks, database vulnerabilities, simple password guessing, general hacks, etc. And all the information accessed through these new online applications is going to be out there for the taking. Ease of use and availability on a new level, to the hackers.
Re:Online apps (Score:5, Insightful)
When it comes to convenience vs. privacy or security, people will choose convenience.
Parent
How about a web hoster? (Score:2)
Of course (Score:4, Interesting)
In short: ditch the free and go with a service provider that provides service. GMail is ok for your Grandpa, but do you really want those million-dollar business contracts and project bids on it?
Re: (Score:3, Insightful)
To think, people actually do this across any email... **shudder**
Seriously, all potentially sensitive business should be conducted in person (perhaps by a representative). Anybody not smart enough to realize this should not be running a "million-dollar business".
(Yes, I _realize_ that it happens.)
That is inane. (Score:3, Informative)
email is not a secure mechanism to transmit information, unless it is encrypted. End of the history.
And as in regard to all those valuable contracts and what have you, I would like to inform you that email is not a guaranteed delivery mechanism, it works in a "best effort" to deliver basis. So I will not be sending any urgent information by email
Re: (Score:3, Informative)
So I guess my point is, even if they have the professional-looking email, it doesn't mean they're not using gmail.
Close sites off by default (Score:2, Insightful)
because (Score:4, Insightful)
You can say tough shit, and I'd agree, employer has that right. But then I'd counter by saying I'd probably be keeping an eye open for a new employer
Parent
Then go online in your own computer. (Score:2)
You may want to go online on your office computer. Well I am even pickier, I want blonde masseuses at my disposal for my lunch break, as well as the massages provided in rooms with plasma TVs and free drinks.
The sky is the limit to what employees think they should be entitled to do with company's resources....
Re: (Score:2)
Re: (Score:2)
Dude. Did you even read my post? I said,
"You can say tough shit, and I'd agree, employer has that right."
It is their resource. However, education tends to work better than locking people away from useful resources (I'm an engineer
Well I am even pickier, I want blonde masseuses at my disposal for my lunch break, as well
Re: (Score:2)
And then you can also kill productivity by (a) not allowing people to communicate in the ways their job requires, or (b) not allow
Ideal situation? (Score:5, Insightful)
Always GMail (Score:3, Insightful)
Astroturfers aren't motivated (Score:2)
That said, I'm not sure you're correct. I seem to recall a Yahoo! Mail exploit being publicized fairly recently. As for Hotmail, I'm not sure, but I suspect that it's a generic enough system that any exploits found are interesting as generic exploits more than as Hotmail-specific.
Yet another "we hate Gmail article"? (Score:5, Insightful)
Sure, they are a key player in the market, but so is Yahoo, Hotmail, and a number of others.
From a technical perspective, cross-site scripting (XSS) vulnerabilities isn't exactly a new thing. Nor are they isolated to Gmail.
The article is not wrong - so I am not attempting to protect Google. On the other hand, this problem is fairly general in nature, and probably applicable to a ton of websites. In fact, the "cookie grabbing technique" is one of the oldest tricks in the areas of XSS.
With this in mind, the article (and in general the constant rampage against Google) seems
- Jesper
httponly (Score:5, Informative)
Parent
Re: (Score:2)
Security vulnerabilities in web-based services as common as email are extremely dangerous and do not deserve to be glossed over just because they are using old tricks. If they really are as common you imply, then I'm quite disappointed in GMail for not
Re: (Score:2)
My point is, that by constantly picking on GMail, the world will translate this into a "GMail problem". Only it isn't. It is just as big a problem for Amazon, e-bay, Hotmail, Yahoo, LinkedIn,
I am not out to protect Google. If they screwed up, they deserve a little spanking. But it is important that we don't think of this as a "GMail problem", and ignore the threat for all non-Google websites.
Agree?
- Jesper
Re: (Score:2)
Re: (Score:3, Informative)
From a technical perspective, cross-site scripting (XSS) vulnerabilities isn't exactly a new thing. Nor are they isolated to Gmail.
From what I gather about this exploit (and contrary to what the CNET article has to say about it) this is actually a cross-site reference forgery (CSRF) attack rather than XSS. The attack takes advantage of the fact that a malicious Web site's clients may have persistent GMail cookies in their web browsers: The attacking site directs the victim's web browser, (possibly, but not necessarily) using JavaScript, to make a POST request to GMail which creates a mail filter to copy all messages to an email addr
Re:Yet another "we hate Gmail article"? (Score:4, Insightful)
In fact, the total nightmare-scenario for the end-users (and the total wet-dream for XSS hackers) would be to gain access to an ad-server. Imagine the XSS hacks you could do if you managed to compromise a DoubleClick server? Millions of users could be targeted, across thousands of sites where your compromised ad-server would even be white-listed for all sorts of crap? In that case, the popularity of the sites themselves would be of no consequence. As long as it displayed ads from your compromised server.
Hmmm... come to think of it, that is a pretty clever idea. I just might wanna take a look at the scripting used in streaming video ads
- Jesper
Parent
Re: (Score:2)
Javascript needs a sandbox/security model (Score:3, Interesting)
It seems to me that the most foolproof solution is to display the HTML email inside a sandbox that does not have access to the cookies (or any other part) of the enclosing page. There may be some way(s) to do this with browsers as they are today, but it seems like ultimately, such a sandbox should be designed-in to HTML and/or Javascript. Something like a chroot command.
This would eliminate the constant cat & mouse game of scrubbing the HTML for something dangerous, then a new HTML/browser feature being used to get around it, etc.
Re:Javascript needs a sandbox/security model (Score:5, Informative)
Displaying the html mail in its own internal frame that pulls from a different domain name than the rest of the application should solve the problem you're referring to. Something like mail.googlecontent.com would work nicely.
Parent
Re: (Score:2)
You seeing the point? We already have technologies that do all that, but because the first attempt was bad, people just lost interest and moved on. What we should have done was improve applets, not go and copy XMLHTTPRequest from Microsoft.
Insecure by Default (Score:2, Interesting)
Trusting Google with you data is like playing Russian Roulette with an Automatic pistol, bad things will happen to your data
Google says it is so easy to keep all your information online - and it is - where they can search it
Google is the new Microsoft, more interested in profit than anything else (security, privacy, user rights)
But hey, they use Linux, so I guess it is ok
Re:Insecure by Default (Score:5, Interesting)
This is a XSS browser exploit, which basically means that one site you're visiting can talk to other sites you're logged into. It's not Google's fault; nothing is breaking in to their servers, it's just malicious code running on your computer hijacking the connection you made to Google. It's your browser's fault for not sandboxing sites properly.
Or to use an real-world analogy, it's like blaming Google because you forgot to log out at an internet cafe and then somebody else sat down and read your email.
Parent
Re: (Score:2)
Another reason to use NoScript (Score:4, Informative)
Re: (Score:2, Informative)
I've had NoScript on my machine for almost a year now, and it's been getting better and better every month, especially now that they've included NoXSS. I've seen the XSS warning mostly on "news" sites, such as FoxNews, CNN and various big-name newspapers, and every time I saw it, NoScript had nixed it.
I've seen the XSS warning in Gmail three times in all, always when clicking on a spam email, and each time it was stopped cold. I didn't dig too deep into it, but not long afterw
A good reason to use NoScript and Firefox (Score:2, Informative)
I'm also wondering if running Gmail over SSL would make any difference...
Avoidable? (Score:2)
But what if you tell both the browser and GMail not to remember your password? I make that a policy with most web sites I use, mostly to protect me if someone steals my laptop -- no password bypass mechanisms allowed, no passwords stored in clear text allowed.
Does that make you safe against this attack also?
Re: (Score:3, Informative)
Webamil for insecure, POP for secure (Score:2)
Because gmail is better (Score:3, Interesting)
Anyone not using PGP? (Score:2)
When you look at my GMail boxes, you'd probably get a very strange picture of me...
Generation X, not Y (Score:2)
Anyway... If you want to avoid browser vulnerabilities with GMail, simply use their free POP3 access (make sure SSL is enabled).
I have a GMail account and I have NEVER exposed it (Score:2)
I'd say, "Yeah there's a security hole in there..."
Re: (Score:2)
Just a counter-point.
so, until Google does get this fixed... (Score:2)
Physician, heal thyself! (Score:2)
Woo-hoo, meta-discovery! Oh wait - no, it's just Zonk screwing up.
Not XSS (Score:3, Interesting)
Much More Informative Article Here (Score:5, Informative)
A link to the ACTUAL article - and some FACTS! (Score:3, Informative)
Some interesting points
The webmail conundrum... (Score:2)
That's the conundrum.
Perhaps a solution would be to alter the HTML spec, in that you could include a specific file (a-la XMLHTTPRequest) and render it as html, but disabling all scripting inside that piece of html.
Or can it be done with existing technologies?
Re: (Score:2)
Yes: Don't use Javascript to send HTTP requests. Just like we had to tell everyone not to use SSI's because of vulnerabilities created by those, we should stop using Javascript to send HTTP requests. If you can demonstrate a real need for a web page that sends HTTP requests in the background, I can demonstrate a real applet that does the job with fewer security risks. There were webmail interfaces a long time before XMLHTTPRequest was invented, and they w